Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Fortinet Says Backdoor in FortiOS Not Malicious

A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.

A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.

FortiOS is a hardened operating system that powers Fortinet’s FortiGate firewall platform. Earlier this week, what appeared to be an exploit for an SSH backdoor in FortiOS 4.x through 5.0.7 was published on the Full Disclosure mailing list. Tests confirmed that the exploit was working.

Fortigate FortiOS backdoorExperts assumed that this could be a backdoor similar to the one found by Juniper Networks in its ScreenOS operating system. In the case of Juniper, the backdoor existed due to unauthorized code introduced by unknown parties.

Fortinet claims the flaw found in its products is not a backdoor vulnerability introduced as a result of malicious activity conducted by internal or external actors. Instead, the company says it’s a management authentication issue identified in 2014 by the company’s product security team as part of their regular testing and review efforts.

According to Fortinet, the security hole could have been exploited for remote console access to vulnerable devices that had the admin access feature enabled for SSH.

The vendor has pointed out that the vulnerability, which it has classified as high risk, was fixed in FortiOS 4.3 with the release of version 4.3.17 on July 9, 2014, and in FortiOS 5.0 with the release of version 5.0.8 on July 28, 2014. The company says later versions, including currently supported 5.2 and 5.4 branches, are not impacted by the flaw. The vulnerability appears to have existed since the release of FortiOS 5.0.0 and 4.3.0.

Fortinet did not release an advisory for this vulnerability at the time when it was patched. In an advisory published on Tuesday, the company provided the following workarounds: disable SSH admin access on all interfaces, or restrict SSH access to authorized IP addresses.

After analyzing the exploit, some experts confirmed that the “backdoor” is likely an internal appliance management mechanism since it only works with the username “Fortimanager_Access.”

In the case of Juniper Networks, the company is still investigating the source of the unauthorized code found in its ScreenOS operating system for NetScreen firewalls. The code introduces two vulnerabilities: one that can be exploited for remote admin access and one that can be leveraged to decrypt VPN traffic.

Advertisement. Scroll to continue reading.

Despite reports that malicious actors have been attempting to exploit the remote access flaw, many Juniper devices remain unpatched.

Following reports that decrypting VPN traffic might have been possible due to the use of the backdoored Dual EC deterministic random bit generator, Juniper announced last week that it will replace the technology with the one currently used in its Junos operating system.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Jared Bartel has been named CISO at Idaho State University.

Automated phishing protection and scam prevention company Bolster has appointed Rod Schultz as CEO.

Bugcrowd has appointed Trey Ford as CISO for the Americas.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.