PSIRT Advisories

FortiManager and FortiAnalyzer - Buffer overflow vulnerability through the diagnose system geoip-city command

Summary

A buffer overflow vulnerability in FortiAnalyzer and FortiManager CLI may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution.

Affected Products

FortiAnalyzer versions 6.4.5 and below.
FortiAnalyzer versions 6.2.7 and below.
FortiAnalyzer versions 6.0.x
FortiManager versions 6.4.5 and below.
FortiManager versions 6.2.7 and below.
FortiManager versions 6.0.x

Solutions

Please upgrade to FortiAnalyzer version 7.0.0 or above.

Please upgrade to FortiAnalyzer version 6.4.6 or above.

Please upgrade to FortiAnalyzer version 6.2.8 or above.

Please upgrade to FortiManager version 7.0.0 or above.

Please upgrade to FortiManager version 6.4.6 or above.

Please upgrade to FortiManager version 6.2.8 or above.