FortiOS & FortiProxy SSL-VPN Flaw Allows IP Spoofing

A vulnerability has been discovered in Fortinet’s FortiOS SSL-VPN and FortiProxy SSL-VPN. The flaw is identified as FG-23-225 which allows attackers to spoof IP addresses and bypass security controls by sending specially crafted packets.

According to the advisory published by Fortinet, An insufficient verification of data authenticity vulnerability [CWE-345] in FortiOS & FortiProxy SSL-VPN tunnel mode may allow an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.

• Vulnerabilities

Google fixes Chrome Password Manager bug hiding credentials

By infosecbulletin / Saturday , July 27 2024

Google fixed a bug in Chrome's Password Manager that caused user credentials to vanish temporarily. A problem with Google Chrome's...

Read More

• Cyber Attack

India Confirms BSNL’s Data Breach, formed committee to investigate

By infosecbulletin / Saturday , July 27 2024

India’s Communications Minister Chandra Sekhar Pemmasani confirmed a breach at the state-owned telecom operator BSNL on May 20 during a...

Read More

• Uncategorized

Malware Attacks Increase 30% in First Half of 2024

By infosecbulletin / Saturday , July 27 2024

Malware based threats increased by 30% in the first half of 2024 compared to the same period in 2023, according...

Read More

• International

New DNS Vulnerability “TuDoor” Threatens Internet Security

By infosecbulletin / Friday , July 26 2024

A new critical vulnerability in the Domain Name System (DNS) has been found. This vulnerability allows a specialized attack called...

Read More

• Vulnerabilities

Acronis Urged Users to Patch Vulnerability

By infosecbulletin / Friday , July 26 2024

A serious vulnerability, CVE-2023-45249 (CVSS 9.8), has been found in Acronis Cyber Infrastructure (ACI), a widely used software-defined infrastructure solution...

Read More

• Hot Topic

OpenAI to test search engine called SearchGPT

By infosecbulletin / Friday , July 26 2024

OpenAI is testing a new search engine "SearchGPT" using generative artificial intelligence to challenge Google's dominance in the online search...

Read More

• Uncategorized

CISA Unveils advisories for Two Industrial Control Systems

By infosecbulletin / Thursday , July 25 2024

CISA released two advisories about security issues for Industrial Control Systems (ICS) on July 25, 2024. These advisories offer important...

Read More

• Vulnerabilities

Researchers unveil ConfusedFunction Vulnerability in Google Cloud Platform

By infosecbulletin / Thursday , July 25 2024

Tenable security researchers found a vulnerability in Google Cloud Platform's Cloud Functions service that could allow an attacker to access...

Read More

• Cyber Attack
• National

BD CIRT published advisory on Web Application and Database Security

By infosecbulletin / Thursday , July 25 2024

BDG e-GOV CIRT's Cyber Threat Intelligence Unit has noticed a concerning increase in cyber-attacks against web applications and database servers...

Read More

• Vulnerabilities

GitLab fixed six security flaws and recommends updating shortly

By infosecbulletin / Thursday , July 25 2024

GitLab released a security update today to fix six vulnerabilities in its software. Although none of the flaws are critical,...

Read More

Version                Affected                        Solution

FortiOS 7.4          7.4.0 through 7.4.1      Upgrade to 7.4.2 or above
FortiOS 7.2          7.2.0 through 7.2.7      Upgrade to 7.2.8 or above
FortiOS 7.0          7.0.0 through 7.0.12     Upgrade to 7.0.13 or above
FortiOS 6.4           6.4 all versions            Migrate to a fixed release
FortiOS 6.2          6.2 all versions             Migrate to a fixed release
FortiProxy 7.4      7.4.0 through 7.4.1       Upgrade to 7.4.2 or above
FortiProxy 7.2      7.2.0 through 7.2.7       Upgrade to 7.2.8 or above
FortiProxy 7.0      7.0.0 through 7.0.13      Upgrade to 7.0.14 or above
FortiProxy 2.0      2.0 all versions               Migrate to a fixed release