TCP timestamp response - RFC1323 Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-16-090 Final 1 1 2019-07-24T00:00:00 Current version 2019-07-24T00:00:00 2019-07-24T00:00:00 FortiOS by default enables TCP timestamp response, which may lead to information disclosure. The TCP timestamp response can be used to approximate the FortiOS device uptime, potentially aiding in further attacks. This may be used by an attacker to estimate if FortiOS has not been upgraded to the latest version, because upgrading resets the device's uptime. Information disclosure FortiOS all versions, when TCP timestamp is enabled (default setting) FortiOS supports admin CLI console commands to disable the TCP timestamp: config system global set tcp-option disable / enable is the default value / end Disabling tcp-option will strip TCP header Timestamp, Selective Acknowledgements (SACK) and Window Scaling altogether which can lead performance penalty for services hosted on FortiOS under certain network environment. For details about the tcp-option, please refer to the Fortinet knowledge base: https://kb.fortinet.com/kb/documentLink.do?externalID=FD44724 5.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-16-090 TCP timestamp response - RFC1323 Reference>