SB2021071352 - Multiple vulnerabilities in Fortinet FortiMail
Published: July 13, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Missing Required Cryptographic Step (CVE-ID: CVE-2021-26099)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing cryptographic steps in FortiMail IBE. A remote attacker who comes in possession of the encrypted master keys can compromise their confidentiality by observing a few invariant properties of the ciphertext.
2) Missing Required Cryptographic Step (CVE-ID: CVE-2021-26100)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a missing cryptographic step in FortiMail IBE. A remote attacker who intercepts the encrypted messages can manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible.
3) Missing required cryptographic step (CVE-ID: CVE-2021-24020)
The vulnerability allows a remote attacker to bypass signature verification.
The vulnerability exists due to a missing cryptographic step in the implementation of the hash digest algorithm in FortiMail. A remote non-authenticated attacker can tamper with signed URLs by appending further data which allows bypass of signature verification.
4) SQL injection (CVE-ID: CVE-2021-24007)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
5) OS Command Injection (CVE-ID: CVE-2021-24015)
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in FortiMail administrative interface. A remote authenticated user can send a specially crafted HTTP request and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Memory leak (CVE-ID: CVE-2021-26090)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in FortiMail Webmail. A remote attacker can exhaust available memory resources via specifically crafted login requests.
7) Use of cryptographically weak pseudo-random number generator (PRNG) (CVE-ID: CVE-2021-26091)
The vulnerability allows a remote attacker to reset credentials of other users.
The vulnerability exists due to usage of weak pseudo-random number generator in the authenticator of FortiMail Identity Based Encryption service. A remote attacker can infer parts of users authentication tokens and reset their credentials.
8) Inadequate encryption strength (CVE-ID: CVE-2021-26095)
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to a combination of various cryptographic issues in the session management of FortiMail, including the encryption construction of the session cookie. A remote user with possession of a valid session cookie can decrypt it and reveal or alter its content.
Successful exploitation of the vulnerability may allow an attacker to escalate privileges on the system.
9) Path traversal (CVE-ID: CVE-2021-24013)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
10) Buffer overflow (CVE-ID: CVE-2021-22129)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to multiple boundary errors within the FortiMail Webmail and Administrative interfaces. A remote authenticated user can send a specially crafted HTTP request, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.
References
- https://fortiguard.com/advisory/FG-IR-20-244
- https://fortiguard.com/advisory/FG-IR-21-003
- https://fortiguard.com/advisory/FG-IR-21-027
- https://fortiguard.com/advisory/FG-IR-21-012
- https://fortiguard.com/advisory/FG-IR-21-021
- https://fortiguard.com/advisory/FG-IR-21-042
- https://www.fortiguard.com/psirt/FG-IR-21-031
- https://www.fortiguard.com/psirt/FG-IR-21-019
- https://fortiguard.com/advisory/FG-IR-21-014
- https://fortiguard.com/advisory/FG-IR-21-023