CVE-2024-33505: Heap buffer overflow in httpd

Published Nov 12, 2024

Updated

A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to escalation of privilege via specially crafted http requests

Other sources

A heap-based buffer overflow vulnerability [CWE-122] in FortiManager and FortiAnalyzer httpd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands as a low priivileged user via specifically crafted requests.

— FortiGuard

Affected Software

24 affected componentsFixes available

Fortinet FortiAnalyzer>=6.4.0<7.2.6

Fortinet FortiAnalyzer>=7.4.0<7.4.3

Fortinet FortiManager>=6.0.0<7.2.7

Fortinet FortiManager>=7.4.0<7.4.3

Fortinet FortiManager Cloud>=6.4.1<7.2.7

Fortinet FortiManager Cloud>=7.4.1<7.4.3

Fortinet FortiAnalyzer>=7.4.0<=7.4.2

Fortinet FortiAnalyzer>=7.2.0<=7.2.5

Fortinet FortiAnalyzer>=7.0

Fortinet FortiAnalyzer>=6.4

Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.2

Fortinet FortiAnalyzer Cloud>=7.2.1<=7.2.6

Fortinet FortiAnalyzer Cloud>=7.0

Fortinet FortiAnalyzer Cloud>=6.4

Fortinet FortiManager Cloud>=7.0

Fortinet FortiManager Cloud>=6.4

Fortinet FortiManager>=7.4.0<=7.4.2

Fortinet FortiManager>=7.4.1<=7.4.2

Fortinet FortiManager>=7.2.0<=7.2.5

Fortinet FortiManager>=7.2.1<=7.2.6

Fortinet FortiManager>=7.0

Fortinet FortiManager>=6.4

Fortinet FortiManager>=6.2

Fortinet FortiManager>=6.0

Remediation

Information

Please upgrade to FortiAnalyzer version 7.4.3 or above Please upgrade to FortiAnalyzer version 7.2.6 or above Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above Please upgrade to FortiAP-U version 7.0.4 or above Please upgrade to FortiClient (all) version 7.4.0 or above Please upgrade to FortiClient (all) version 7.2.5 or above Please upgrade to FortiClient (all) version 7.0.13 or above Please upgrade to FortiManager Cloud version 7.4.3 or above Please upgrade to FortiManager Cloud version 7.2.7 or above Please upgrade to FortiAP version 7.6.0 or above Please upgrade to FortiAP version 7.4.3 or above Please upgrade to FortiClientEMS version 7.2.7 or above Please upgrade to FortiAnalyzer Cloud version 7.4.3 or above Please upgrade to FortiAnalyzer Cloud version 7.2.7 or above

Event History

Nov 12, 2024

Advisory Published

via FortiGuard·12:00 AM

CVE Published

via MITRE·06:53 PM

Data Sourced

via MITRE·06:53 PM

RemedyDescriptionSeverityWeakness

Nov 15, 2024

Advisory Published

via FortiGuard·08:51 AM

Frequently Asked Questions

What is the severity of CVE-2024-33505?

The severity of CVE-2024-33505 is classified as critical due to the potential for remote code execution and escalation of privileges.

How do I fix CVE-2024-33505?

To fix CVE-2024-33505, upgrade Fortinet FortiAnalyzer and FortiManager to versions 7.4.3 or later, or 7.2.6 or later depending on your current version.

What versions are affected by CVE-2024-33505?

CVE-2024-33505 affects FortiAnalyzer versions 7.4.0 to 7.4.2, 7.2.0 to 7.2.5, 7.0.0 to 7.0.12, and all 6.4.x versions.

Is FortiManager affected by CVE-2024-33505?

Yes, FortiManager versions 7.4.0 to 7.4.2, 7.2.0 to 7.2.5, 7.0.0 to 7.0.12, and all 6.4.x versions are affected.

Does CVE-2024-33505 impact FortiAnalyzer Cloud?

Yes, FortiAnalyzer Cloud versions 7.4.1 to 7.4.2 and 7.2.1 to 7.2.6 are impacted by CVE-2024-33505.