Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Fortinet Says Backdoor in FortiOS Not Malicious

A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.

A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.

FortiOS is a hardened operating system that powers Fortinet’s FortiGate firewall platform. Earlier this week, what appeared to be an exploit for an SSH backdoor in FortiOS 4.x through 5.0.7 was published on the Full Disclosure mailing list. Tests confirmed that the exploit was working.

Fortigate FortiOS backdoorExperts assumed that this could be a backdoor similar to the one found by Juniper Networks in its ScreenOS operating system. In the case of Juniper, the backdoor existed due to unauthorized code introduced by unknown parties.

Fortinet claims the flaw found in its products is not a backdoor vulnerability introduced as a result of malicious activity conducted by internal or external actors. Instead, the company says it’s a management authentication issue identified in 2014 by the company’s product security team as part of their regular testing and review efforts.

According to Fortinet, the security hole could have been exploited for remote console access to vulnerable devices that had the admin access feature enabled for SSH.

The vendor has pointed out that the vulnerability, which it has classified as high risk, was fixed in FortiOS 4.3 with the release of version 4.3.17 on July 9, 2014, and in FortiOS 5.0 with the release of version 5.0.8 on July 28, 2014. The company says later versions, including currently supported 5.2 and 5.4 branches, are not impacted by the flaw. The vulnerability appears to have existed since the release of FortiOS 5.0.0 and 4.3.0.

Fortinet did not release an advisory for this vulnerability at the time when it was patched. In an advisory published on Tuesday, the company provided the following workarounds: disable SSH admin access on all interfaces, or restrict SSH access to authorized IP addresses.

After analyzing the exploit, some experts confirmed that the “backdoor” is likely an internal appliance management mechanism since it only works with the username “Fortimanager_Access.”

In the case of Juniper Networks, the company is still investigating the source of the unauthorized code found in its ScreenOS operating system for NetScreen firewalls. The code introduces two vulnerabilities: one that can be exploited for remote admin access and one that can be leveraged to decrypt VPN traffic.

Advertisement. Scroll to continue reading.

Despite reports that malicious actors have been attempting to exploit the remote access flaw, many Juniper devices remain unpatched.

Following reports that decrypting VPN traffic might have been possible due to the use of the backdoored Dual EC deterministic random bit generator, Juniper announced last week that it will replace the technology with the one currently used in its Junos operating system.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.