A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.
FortiOS is a hardened operating system that powers Fortinet’s FortiGate firewall platform. Earlier this week, what appeared to be an exploit for an SSH backdoor in FortiOS 4.x through 5.0.7 was published on the Full Disclosure mailing list. Tests confirmed that the exploit was working.
Experts assumed that this could be a backdoor similar to the one found by Juniper Networks in its ScreenOS operating system. In the case of Juniper, the backdoor existed due to unauthorized code introduced by unknown parties.
Fortinet claims the flaw found in its products is not a backdoor vulnerability introduced as a result of malicious activity conducted by internal or external actors. Instead, the company says it’s a management authentication issue identified in 2014 by the company’s product security team as part of their regular testing and review efforts.
According to Fortinet, the security hole could have been exploited for remote console access to vulnerable devices that had the admin access feature enabled for SSH.
The vendor has pointed out that the vulnerability, which it has classified as high risk, was fixed in FortiOS 4.3 with the release of version 4.3.17 on July 9, 2014, and in FortiOS 5.0 with the release of version 5.0.8 on July 28, 2014. The company says later versions, including currently supported 5.2 and 5.4 branches, are not impacted by the flaw. The vulnerability appears to have existed since the release of FortiOS 5.0.0 and 4.3.0.
Fortinet did not release an advisory for this vulnerability at the time when it was patched. In an advisory published on Tuesday, the company provided the following workarounds: disable SSH admin access on all interfaces, or restrict SSH access to authorized IP addresses.
After analyzing the exploit, some experts confirmed that the “backdoor” is likely an internal appliance management mechanism since it only works with the username “Fortimanager_Access.”
In the case of Juniper Networks, the company is still investigating the source of the unauthorized code found in its ScreenOS operating system for NetScreen firewalls. The code introduces two vulnerabilities: one that can be exploited for remote admin access and one that can be leveraged to decrypt VPN traffic.
Despite reports that malicious actors have been attempting to exploit the remote access flaw, many Juniper devices remain unpatched.
Following reports that decrypting VPN traffic might have been possible due to the use of the backdoored Dual EC deterministic random bit generator, Juniper announced last week that it will replace the technology with the one currently used in its Junos operating system.
