Details of VAR-201608-0364

ID

VAR-201608-0364

CVE

CVE-2016-6909

TITLE

Fortinet FortiOS and FortiSwitch of Cookie Parser buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-004445

DESCRIPTION

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER. Fortinet FortiOS and FortiSwitch of Cookie The parser contains a buffer overflow vulnerability. Fortinet FortiGate is a network security platform developed by Fortinet. The platform provides features such as firewall, anti-virus and intrusion prevention (IPS), application control, anti-spam, wireless controller and WAN acceleration. The vulnerability stems from the program not performing correct boundary checks on user-submitted input. An attacker could use this vulnerability to execute arbitrary code in the context of an affected application and may cause a denial of service. Fortinet FortiGate is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will result in denial-of-service conditions. The following versions are affected: Fortinet FortiGate 4.3.8 and prior Fortinet FortiGate 4.2.12 and prior Fortinet FortiGate 4.1.10 and prior. Fortinet FortiOS and FortiSwitch are products developed by Fortinet

Trust: 2.61

sources: NVD: CVE-2016-6909 // JVNDB: JVNDB-2016-004445 // CNNVD: CNNVD-201608-383 // BID: 92523 // VULHUB: VHN-95729 // VULMON: CVE-2016-6909

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortios	scope:	lt	version:	4.3.9	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	lt	version:	4.2.13	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	4.1.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	4.2.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	4.3.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	lt	version:	4.1.11	Trust: 1.0
vendor:	fortinet	model:	fortiswitch	scope:	lte	version:	3.4.2	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.3.8	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.2.12	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.1.10	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.1.11	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	lt	version:	4.2.x	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	lt	version:	4.3.x	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.3.9	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	lt	version:	4.x	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.2.13	Trust: 0.8
vendor:	fortinet	model:	fortiswitch	scope:	eq	version:	3.4.2	Trust: 0.6
vendor:	fortinet	model:	fortios	scope:	eq	version:	4.3	Trust: 0.3
vendor:	fortinet	model:	fortigate	scope:	eq	version:	0	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	4.3.9	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	4.2.13	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	4.1.11	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	5.0	Trust: 0.3

sources: BID: 92523 // JVNDB: JVNDB-2016-004445 // CNNVD: CNNVD-201608-446 // NVD: CVE-2016-6909

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-6909
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2016-6909
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201608-446
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-95729
value:	HIGH
Trust: 0.1
VULMON:	CVE-2016-6909
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-6909
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-95729
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-6909
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-95729 // VULMON: CVE-2016-6909 // JVNDB: JVNDB-2016-004445 // CNNVD: CNNVD-201608-446 // NVD: CVE-2016-6909

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-95729 // JVNDB: JVNDB-2016-004445 // NVD: CVE-2016-6909

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201608-383 // CNNVD: CNNVD-201608-446

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201608-383

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-004445

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-95729 // VULMON: CVE-2016-6909

PATCH

title:	Cookie Parser Buffer Overflow Vulnerability	url:	http://fortiguard.com/advisory/FG-IR-16-023	Trust: 0.8
title:	Fortinet FortiOS and FortiSwitch Buffer Overflow Vulnerability Fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=63770	Trust: 0.6

sources: JVNDB: JVNDB-2016-004445 // CNNVD: CNNVD-201608-446

EXTERNAL IDS

db:	BID	id:	92523	Trust: 2.7
db:	NVD	id:	CVE-2016-6909	Trust: 2.6
db:	EXPLOIT-DB	id:	40276	Trust: 1.8
db:	PACKETSTORM	id:	138387	Trust: 1.8
db:	SECTRACK	id:	1036643	Trust: 1.8
db:	JVNDB	id:	JVNDB-2016-004445	Trust: 0.8
db:	CNNVD	id:	CNNVD-201608-446	Trust: 0.7
db:	CNNVD	id:	CNNVD-201608-383	Trust: 0.6
db:	VULHUB	id:	VHN-95729	Trust: 0.1
db:	VULMON	id:	CVE-2016-6909	Trust: 0.1

sources: VULHUB: VHN-95729 // VULMON: CVE-2016-6909 // BID: 92523 // JVNDB: JVNDB-2016-004445 // CNNVD: CNNVD-201608-383 // CNNVD: CNNVD-201608-446 // NVD: CVE-2016-6909

REFERENCES

url:	http://www.securityfocus.com/bid/92523	Trust: 2.4
url:	https://www.exploit-db.com/exploits/40276/	Trust: 1.9
url:	http://fortiguard.com/advisory/fg-ir-16-023	Trust: 1.8
url:	http://packetstormsecurity.com/files/138387/egregiousblunder-fortigate-remote-code-execution.html	Trust: 1.8
url:	https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html	Trust: 1.8
url:	http://www.securitytracker.com/id/1036643	Trust: 1.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6909	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6909	Trust: 0.8
url:	http://www.fortinet.com/	Trust: 0.3
url:	http://fortiguard.com/advisory/cookie-parser-buffer-overflow-vulnerability	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	https://www.rapid7.com/db/vulnerabilities/fortios-cve-2016-6909	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=48526	Trust: 0.1

sources: VULHUB: VHN-95729 // VULMON: CVE-2016-6909 // BID: 92523 // JVNDB: JVNDB-2016-004445 // CNNVD: CNNVD-201608-383 // CNNVD: CNNVD-201608-446 // NVD: CVE-2016-6909

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 92523

SOURCES

db:	VULHUB	id:	VHN-95729
db:	VULMON	id:	CVE-2016-6909
db:	BID	id:	92523
db:	JVNDB	id:	JVNDB-2016-004445
db:	CNNVD	id:	CNNVD-201608-383
db:	CNNVD	id:	CNNVD-201608-446
db:	NVD	id:	CVE-2016-6909

LAST UPDATE DATE

2024-08-14T14:46:21.830000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-95729	date:	2019-05-22T00:00:00
db:	VULMON	id:	CVE-2016-6909	date:	2019-05-22T00:00:00
db:	BID	id:	92523	date:	2016-08-17T00:00:00
db:	JVNDB	id:	JVNDB-2016-004445	date:	2016-08-25T00:00:00
db:	CNNVD	id:	CNNVD-201608-383	date:	2016-08-19T00:00:00
db:	CNNVD	id:	CNNVD-201608-446	date:	2019-05-23T00:00:00
db:	NVD	id:	CVE-2016-6909	date:	2019-05-22T15:06:00.610

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-95729	date:	2016-08-24T00:00:00
db:	VULMON	id:	CVE-2016-6909	date:	2016-08-24T00:00:00
db:	BID	id:	92523	date:	2016-08-17T00:00:00
db:	JVNDB	id:	JVNDB-2016-004445	date:	2016-08-25T00:00:00
db:	CNNVD	id:	CNNVD-201608-383	date:	2016-08-19T00:00:00
db:	CNNVD	id:	CNNVD-201608-446	date:	2016-08-25T00:00:00
db:	NVD	id:	CVE-2016-6909	date:	2016-08-24T16:30:00.137