CVE-2021-26096: Multiple heap corruption vulnerabilities in FSA's command shell
First published: Tue Aug 03 2021(Updated: )
Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifically crafted command line arguments.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiSandbox | <=3.1.4 | |
| Fortinet FortiSandbox | >=3.2.0<3.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this heap-based buffer overflow?
The vulnerability ID for this heap-based buffer overflow is CVE-2021-26096.
What is the affected software for this vulnerability?
The affected software is FortiSandbox versions up to and including 3.1.4, and versions between 3.2.0 and 3.2.3.
What is the severity of CVE-2021-26096?
The severity of CVE-2021-26096 is rated as high with a CVSS score of 8.8.
How can an attacker exploit this vulnerability?
An authenticated attacker can exploit this vulnerability by manipulating memory and altering its content through specifically crafted command line arguments.
Is there a fix or patch available for this vulnerability?
Yes, Fortinet has released FortiSandbox version 4.0.0 which addresses this vulnerability. It is recommended to upgrade to this version to fix the issue.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/last-modified-date
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2021-26096
- collector/fortiguard-psirt
- agent/title
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/fortinet
- canonical/fortinet fortisandbox
- version/fortinet fortisandbox/3.1.4
- version/fortinet fortisandbox/3.2.0