VM images lack an integrity check of the file system at boot time Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-19-017 Final 1 1 2019-11-14T00:00:00 Current version 2019-11-14T00:00:00 2019-11-14T00:00:00 VM appliance lack of root file system integrity check may allow an attacker with read/write access to the VM image (before it is booted up) to inject malicious implants in the image. Execute unauthorized code or commands FortiOS VM all versions below 6.0.5 (CVE-2019-5587)FortiManager VM version 6.2.0, 6.0.6 and below (CVE-2019-6695) Upgrade to FortiOS VM versions 6.0.5 or 6.2.0Upgrade to FortiManager VM versions 6.0.7 or 6.2.1Workarounds:Verify the VM images' integrity by comparing the SHA-512 checksum with the checksum indicated on https://support.fortinet.com/ (downloads section) for that image.Revision History:05-17-2019 Initial Version07-15-2019 CVE-2019-6695 disclosed11-14-2019 CVE-2019-6695 6.0 branch fixed. Fortinet is pleased to thank Bart Dopheide, Axians for reporting CVE-2019-5587 and independent research team Denis Kolegov, Maxim Gorbunov, Nikita Oleksov and Anton Nikolaev for reporting CVE-2019-6695 under responsible disclosure. FortiADC 5.2.2 FortiAnalyzer 6.2.0 FortiAuthenticator 6.1.3 FortiAuthenticator 6.1.2 FortiAuthenticator 6.1.1 FortiAuthenticator 6.1.0 FortiMail 6.0.4 FortiMail 5.4.9 FortiManager 6.2.0 FortiManager 6.0.7 FortiManager 6.0.6 FortiManager 6.0.5 FortiManager 6.0.4 FortiManager 6.0.3 FortiManager 6.0.2 FortiManager 6.0.1 FortiManager 6.0.0 FortiManager 5.6.9 FortiManager 5.6.8 FortiManager 5.6.7 FortiManager 5.6.6 FortiManager 5.6.5 FortiManager 5.6.4 FortiManager 5.6.3 FortiManager 5.6.2 FortiManager 5.6.11 FortiManager 5.6.10 FortiManager 5.6.1 FortiManager 5.6.0 FortiManager 5.4.7 FortiManager 5.4.6 FortiManager 5.4.5 FortiManager 5.4.4 FortiManager 5.4.3 FortiManager 5.4.2 FortiManager 5.4.1 FortiManager 5.4.0 FortiOS 6.0.4 FortiOS 6.0.3 FortiOS 6.0.2 FortiOS 6.0.1 FortiOS 6.0.0 FortiOS 5.6.9 FortiOS 5.6.8 FortiOS 5.6.7 FortiOS 5.6.6 FortiOS 5.6.5 FortiOS 5.6.4 FortiOS 5.6.3 FortiOS 5.6.2 FortiOS 5.6.14 FortiOS 5.6.13 FortiOS 5.6.12 FortiOS 5.6.11 FortiOS 5.6.10 FortiOS 5.6.1 FortiOS 5.6.0 FortiOS 5.4.9 FortiOS 5.4.8 FortiOS 5.4.7 FortiOS 5.4.6 FortiOS 5.4.5 FortiOS 5.4.4 FortiOS 5.4.3 FortiOS 5.4.2 FortiOS 5.4.13 FortiOS 5.4.12 FortiOS 5.4.11 FortiOS 5.4.10 FortiOS 5.4.1 FortiOS 5.4.0 FortiProxy 1.1.5 FortiProxy 1.1.2 FortiProxy 1.0.6 FortiTester 3.5.0 FortiVoice 5.3.26 FortiVoice 5.3.25 FortiWAN 5.2.0 FortiRecorder 2.7.1 FortiRecorder 2.6.3 FortiADCManager 5.2.1 FortiDDoS-CM 5.1.0 CVE-2019-5587 CVE-2019-6695 FortiADC-5.2.2 FortiAnalyzer-6.2.0 FortiAuthenticator-6.1.3 FortiAuthenticator-6.1.2 FortiAuthenticator-6.1.1 FortiAuthenticator-6.1.0 FortiMail-6.0.4 FortiMail-5.4.9 FortiManager-6.2.0 FortiManager-6.0.7 FortiManager-6.0.6 FortiManager-6.0.5 FortiManager-6.0.4 FortiManager-6.0.3 FortiManager-6.0.2 FortiManager-6.0.1 FortiManager-6.0.0 FortiManager-5.6.9 FortiManager-5.6.8 FortiManager-5.6.7 FortiManager-5.6.6 FortiManager-5.6.5 FortiManager-5.6.4 FortiManager-5.6.3 FortiManager-5.6.2 FortiManager-5.6.11 FortiManager-5.6.10 FortiManager-5.6.1 FortiManager-5.6.0 FortiManager-5.4.7 FortiManager-5.4.6 FortiManager-5.4.5 FortiManager-5.4.4 FortiManager-5.4.3 FortiManager-5.4.2 FortiManager-5.4.1 FortiManager-5.4.0 FortiOS-6.0.4 FortiOS-6.0.3 FortiOS-6.0.2 FortiOS-6.0.1 FortiOS-6.0.0 FortiOS-5.6.9 FortiOS-5.6.8 FortiOS-5.6.7 FortiOS-5.6.6 FortiOS-5.6.5 FortiOS-5.6.4 FortiOS-5.6.3 FortiOS-5.6.2 FortiOS-5.6.14 FortiOS-5.6.13 FortiOS-5.6.12 FortiOS-5.6.11 FortiOS-5.6.10 FortiOS-5.6.1 FortiOS-5.6.0 FortiOS-5.4.9 FortiOS-5.4.8 FortiOS-5.4.7 FortiOS-5.4.6 FortiOS-5.4.5 FortiOS-5.4.4 FortiOS-5.4.3 FortiOS-5.4.2 FortiOS-5.4.13 FortiOS-5.4.12 FortiOS-5.4.11 FortiOS-5.4.10 FortiOS-5.4.1 FortiOS-5.4.0 FortiProxy-1.1.5 FortiProxy-1.1.2 FortiProxy-1.0.6 FortiTester-3.5.0 FortiVoice-5.3.26 FortiVoice-5.3.25 FortiWAN-5.2.0 FortiRecorder-2.7.1 FortiRecorder-2.6.3 FortiADCManager-5.2.1 FortiDDoS-CM-5.1.0 https://fortiguard.fortinet.com/psirt/FG-IR-19-017 VM images lack an integrity check of the file system at boot time Reference>