Alert GCSA-23051 - Aggiornamento di sicurezza nei prodotti Fortinet
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** Alert ID: GCSA-23051 Data: 13 Aprile 2023 Titolo: Aggiornamento di sicurezza nei prodotti Fortinet ****************************************************************** :: Descrizione del problema Sono state identificate vulnerabilita' multiple nei prodotti Fortinet che potrebberto essere sfruttate da un attaccante remoto per innescare condizioni di Denial of Service, oltrepassare restrizioni di sicurezza, rivelare informazioni riservate, eseguire attacchi di tipo cross-site scripting ed ottenere privilegi pie' elevati su un sistema che ne sia affetto. Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato FortiDDoS-F versioni precedenti alla 6.4.1 FortiDDoS versioni precedenti alla 5.7.0 FortiADC versioni precedenti alla 7.2.0 FortiAnalyzer versioni precedenti alla 7.2.2 FortiManager versioni precedenti alla 7.2.2 FortiAuthenticator versioni precedenti alla 6.5.0 FortiClientMac versioni precedenti alla 7.2.0 FortiClientWindows versioni precedenti alla 7.2.0 FortiOS versioni precedenti alla 7.2.4 FortiNAC-F versioni precedenti alla 7.2.0 FortiNAC versioni precedenti alla 9.4.2 FortiProxy versioni precedenti alla 7.2.3 FortiPresence versioni precedenti alla 2.0.0 FortiSOAR versioni precedenti alla 8.0.0 FortiSandbox versioni precedenti alla 4.2.3 FortiDeceptor versioni precedenti alla 4.2.0 FortiWeb versioni precedenti alla 7.2.0 FortiSIEM versioni precedenti alla 6.5.0 :: Impatto Esecuzione remota di codice arbitrario (RCE) Bypass delle funzionalita' di sicurezza (SFB) :: Soluzioni Applicare gli aggiornamenti rilasciati dal produttore: https://www.fortiguard.com/psirt-monthly-advisory/april-2023-vulnerability-advisories https://www.fortiguard.com/psirt/FG-IR-22-050 https://www.fortiguard.com/psirt/FG-IR-22-056 https://www.fortiguard.com/psirt/FG-IR-22-060 https://www.fortiguard.com/psirt/FG-IR-22-186 https://www.fortiguard.com/psirt/FG-IR-22-275 https://www.fortiguard.com/psirt/FG-IR-22-320 https://www.fortiguard.com/psirt/FG-IR-22-335 https://www.fortiguard.com/psirt/FG-IR-22-336 https://www.fortiguard.com/psirt/FG-IR-22-355 https://www.fortiguard.com/psirt/FG-IR-22-363 https://www.fortiguard.com/psirt/FG-IR-22-381 https://www.fortiguard.com/psirt/FG-IR-22-409 https://www.fortiguard.com/psirt/FG-IR-22-428 https://www.fortiguard.com/psirt/FG-IR-22-429 https://www.fortiguard.com/psirt/FG-IR-22-432 https://www.fortiguard.com/psirt/FG-IR-22-439 https://www.fortiguard.com/psirt/FG-IR-22-444 https://www.fortiguard.com/psirt/FG-IR-22-479 https://www.fortiguard.com/psirt/FG-IR-22-481 https://www.fortiguard.com/psirt/FG-IR-22-502 https://www.fortiguard.com/psirt/FG-IR-23-051 :: Riferimenti Fortinet https://www.fortiguard.com/psirt-monthly-advisory/april-2023-vulnerability-advisories https://www.fortiguard.com/psirt?date=04-2023 https://www.fortiguard.com/psirt?page=2&date=04-2023 https://www.fortiguard.com/psirt/FG-IR-22-050 https://www.fortiguard.com/psirt/FG-IR-22-056 https://www.fortiguard.com/psirt/FG-IR-22-060 https://www.fortiguard.com/psirt/FG-IR-22-186 https://www.fortiguard.com/psirt/FG-IR-22-275 https://www.fortiguard.com/psirt/FG-IR-22-320 https://www.fortiguard.com/psirt/FG-IR-22-335 https://www.fortiguard.com/psirt/FG-IR-22-336 https://www.fortiguard.com/psirt/FG-IR-22-355 https://www.fortiguard.com/psirt/FG-IR-22-363 https://www.fortiguard.com/psirt/FG-IR-22-381 https://www.fortiguard.com/psirt/FG-IR-22-409 https://www.fortiguard.com/psirt/FG-IR-22-428 https://www.fortiguard.com/psirt/FG-IR-22-429 https://www.fortiguard.com/psirt/FG-IR-22-432 https://www.fortiguard.com/psirt/FG-IR-22-439 https://www.fortiguard.com/psirt/FG-IR-22-444 https://www.fortiguard.com/psirt/FG-IR-22-479 https://www.fortiguard.com/psirt/FG-IR-22-481 https://www.fortiguard.com/psirt/FG-IR-22-502 https://www.fortiguard.com/psirt/FG-IR-23-051 CSIRT Italia https://www.csirt.gov.it/contenuti/rilevate-vulnerabilita-in-prodotti-fortinet-al04-230412-csirt-ita CISA https://www.cisa.gov/news-events/alerts/2023/04/11/fortinet-releases-april-2023-vulnerability-advisories CIS - Center for Internet Security https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2023-040 Mitre CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0847 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27485 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27487 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35850 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40679 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40682 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41330 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41331 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42469 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42470 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42477 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43946 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43947 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43948 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43951 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43952 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43955 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22635 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22641 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22642 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27995 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCZDfn4AAKCRDBnEyTZRJg QovfAKCU4IUle+pbu+fwh719sd2U6+Vz5wCgrLWeUYoV2miRP/22JkddRrOZD3M= =X92o -----END PGP SIGNATURE-----