FG-IR-23-151: DOS in headers management
Published Nov 14, 2023
·Updated
A null pointer dereference [CWE-476] in FortiOS and FortiProxy SSL VPN may allow an authenticated attacker to perform a DoS attack on the device via specifically crafted HTTP requests.
Affected Software
12 affected componentsFixes available
Fortinet FortiOS=.
Fortinet FortiOS>=7.2.0<=7.2.5
Fortinet FortiOS>=7.0.0<=7.0.12
Fortinet FortiOS>=6.4
Fortinet FortiOS>=6.2
Fortinet FortiOS>=6.0
Fortinet FortiProxy>=7.2.0<=7.2.4
Fortinet FortiProxy>=7.0.0<=7.0.10
Fortinet FortiProxy>=2.0
Fortinet FortiProxy>=1.2
Fortinet FortiProxy>=1.1
Fortinet FortiProxy>=1.0
Event History
Nov 14, 2023
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-23-151?
The severity of FG-IR-23-151 is critical as it allows for a denial of service attack on FortiOS and FortiProxy SSL VPN.
2
How do I fix FG-IR-23-151?
To fix FG-IR-23-151, upgrade to the recommended FortiOS or FortiProxy versions which mitigate the vulnerability.
3
What devices are affected by FG-IR-23-151?
FG-IR-23-151 affects FortiOS versions prior to 7.4.1 and FortiProxy versions prior to 7.2.5.
4
Can FG-IR-23-151 be exploited remotely?
Yes, FG-IR-23-151 can be exploited remotely by an authenticated attacker through crafted HTTP requests.
5
What is a null pointer dereference in the context of FG-IR-23-151?
A null pointer dereference in FG-IR-23-151 refers to an error that can crash the application, leading to a denial of service condition.