"Fortinet Patches High-Severity Vulnerabilities in FortiADC, FortiOS"

Fortinet recently announced its monthly set of security updates that address nine vulnerabilities in multiple products, including two high-severity bugs in FortiADC, FortiOS, and FortiProxy.  Impacting the FortiADC application delivery controller, the most severe of these issues is tracked as CVE-2023-27999 and is described as "an improper neutralization of special elements used in an OS command vulnerability."  The company stated that an attacker could exploit the bug via crafted arguments to existing commands, allowing them to execute unauthorized commands.  The attacker needs to be authenticated to exploit the vulnerability.  The issue impacts FortiADC versions 7.2.0, 7.1.1, and 7.1.0 and was addressed with the release of FortiADC versions 7.2.1 and 7.1.2.  The second high-severity flaw, CVE-2023-22640, is described as an out-of-bounds write in the "sslvpnd" component of FortiOS and FortiProxy.  Fortinet noted that the bug allows an authenticated attacker to send specifically crafted requests to achieve arbitrary code execution.  The bug was identified in FortiOS versions 7.2.x, 7.0.x, 6.4.x 6.2.x, and 6.0.x, and FortiProxy versions 7.2.x, 7.0.x, 2.0.x, and 1.x.x. It was addressed with the release of FortiOS versions 7.4.0, 7.2.4, 7.0.11, 6.4.12, and 6.2.14, and in FortiProxy versions 7.2.2 and 7.0.8.  Fortinet does not mention any of these vulnerabilities being exploited in malicious attacks.  

SecurityWeek reports: "Fortinet Patches High-Severity Vulnerabilities in FortiADC, FortiOS"