Evasion by manipulating MIME attachment
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-22-074
Final
1
1
2022-11-01T00:00:00
Current version
2022-11-01T00:00:00
2022-11-01T00:00:00
An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.
None
Denial of service
FortiOS version 7.2.0FortiOS version 7.0.0 through 7.0.6FortiOS 6.4 all versionsFortiOS 6.2 all versionsFortiOS 6.0 all versionsFortiMail 7.2 all versions are not affectedFortiMail version 7.0.0 through 7.0.2FortiMail version 6.4.0 through 6.4.6FortiMail 6.2 all versionsFortiMail 6.0 all versionsAV Engine 6.4 all versions are not affectedAV Engine 6.2 all versions are not affectedAV Engine 6.0 all versions are not affectedAV Engine 6 all versionsAV Engine 4.4 all versionsAV Engine 2.0 all versionsAV Engine 0.4 all versions
Please upgrade AV engine to version 6.00169 or above.Please upgrade AV engine to version 6.00275 or above.Please upgrade to FortiMail version 7.2.0 or abovePlease upgrade to FortiMail version 7.0.3 or abovePlease upgrade to FortiMail version 6.4.7 or abovePlease upgrade to FortiOS version 7.0.8 or above.Please upgrade to FortiOS version 7.2.2 or above.Please upgrade FortiOS AV engine to version 6.00169 or above.Please upgrade FortiOS AV engine to version 6.00275 or above.
AV Engine 6.253
AV Engine 6.252
AV Engine 6.243
AV Engine 6.157
AV Engine 6.156
AV Engine 6.145
AV Engine 6.144
AV Engine 6.142
AV Engine 6.137
AV Engine 6.33
AV Engine 4.4.54
AV Engine 2.0.60
AV Engine 2.0.49
AV Engine 0.4.23
FortiMail 7.0.2
FortiMail 7.0.1
FortiMail 7.0.0
FortiMail 6.4.6
FortiMail 6.4.5
FortiMail 6.4.4
FortiMail 6.4.3
FortiMail 6.4.2
FortiMail 6.4.1
FortiMail 6.4.0
FortiMail 6.2.9
FortiMail 6.2.8
FortiMail 6.2.7
FortiMail 6.2.6
FortiMail 6.2.5
FortiMail 6.2.4
FortiMail 6.2.3
FortiMail 6.2.2
FortiMail 6.2.1
FortiMail 6.2.0
FortiMail 6.0.12
FortiMail 6.0.11
FortiMail 6.0.10
FortiMail 6.0.9
FortiMail 6.0.8
FortiMail 6.0.7
FortiMail 6.0.6
FortiMail 6.0.5
FortiMail 6.0.4
FortiMail 6.0.3
FortiMail 6.0.2
FortiMail 6.0.1
FortiMail 6.0.0
FortiOS 7.2.0
FortiOS 7.0.6
FortiOS 7.0.5
FortiOS 7.0.4
FortiOS 7.0.3
FortiOS 7.0.2
FortiOS 7.0.1
FortiOS 7.0.0
FortiOS 6.4.16
FortiOS 6.4.15
FortiOS 6.4.14
FortiOS 6.4.13
FortiOS 6.4.12
FortiOS 6.4.11
FortiOS 6.4.10
FortiOS 6.4.9
FortiOS 6.4.8
FortiOS 6.4.7
FortiOS 6.4.6
FortiOS 6.4.5
FortiOS 6.4.4
FortiOS 6.4.3
FortiOS 6.4.2
FortiOS 6.4.1
FortiOS 6.4.0
FortiOS 6.2.17
FortiOS 6.2.16
FortiOS 6.2.15
FortiOS 6.2.14
FortiOS 6.2.13
FortiOS 6.2.12
FortiOS 6.2.11
FortiOS 6.2.10
FortiOS 6.2.9
FortiOS 6.2.8
FortiOS 6.2.7
FortiOS 6.2.6
FortiOS 6.2.5
FortiOS 6.2.4
FortiOS 6.2.3
FortiOS 6.2.2
FortiOS 6.2.1
FortiOS 6.2.0
FortiOS 6.0.18
FortiOS 6.0.17
FortiOS 6.0.16
FortiOS 6.0.15
FortiOS 6.0.14
FortiOS 6.0.13
FortiOS 6.0.12
FortiOS 6.0.11
FortiOS 6.0.10
FortiOS 6.0.9
FortiOS 6.0.8
FortiOS 6.0.7
FortiOS 6.0.6
FortiOS 6.0.5
FortiOS 6.0.4
FortiOS 6.0.3
FortiOS 6.0.2
FortiOS 6.0.1
FortiOS 6.0.0
Evasion by manipulating MIME attachment
CVE-2022-26122
AV Engine-6.253
AV Engine-6.252
AV Engine-6.243
AV Engine-6.157
AV Engine-6.156
AV Engine-6.145
AV Engine-6.144
AV Engine-6.142
AV Engine-6.137
AV Engine-6.33
AV Engine-4.4.54
AV Engine-2.0.60
AV Engine-2.0.49
AV Engine-0.4.23
FortiMail-7.0.2
FortiMail-7.0.1
FortiMail-7.0.0
FortiMail-6.4.6
FortiMail-6.4.5
FortiMail-6.4.4
FortiMail-6.4.3
FortiMail-6.4.2
FortiMail-6.4.1
FortiMail-6.4.0
FortiMail-6.2.9
FortiMail-6.2.8
FortiMail-6.2.7
FortiMail-6.2.6
FortiMail-6.2.5
FortiMail-6.2.4
FortiMail-6.2.3
FortiMail-6.2.2
FortiMail-6.2.1
FortiMail-6.2.0
FortiMail-6.0.12
FortiMail-6.0.11
FortiMail-6.0.10
FortiMail-6.0.9
FortiMail-6.0.8
FortiMail-6.0.7
FortiMail-6.0.6
FortiMail-6.0.5
FortiMail-6.0.4
FortiMail-6.0.3
FortiMail-6.0.2
FortiMail-6.0.1
FortiMail-6.0.0
FortiOS-7.2.0
FortiOS-7.0.6
FortiOS-7.0.5
FortiOS-7.0.4
FortiOS-7.0.3
FortiOS-7.0.2
FortiOS-7.0.1
FortiOS-7.0.0
FortiOS-6.4.16
FortiOS-6.4.15
FortiOS-6.4.14
FortiOS-6.4.13
FortiOS-6.4.12
FortiOS-6.4.11
FortiOS-6.4.10
FortiOS-6.4.9
FortiOS-6.4.8
FortiOS-6.4.7
FortiOS-6.4.6
FortiOS-6.4.5
FortiOS-6.4.4
FortiOS-6.4.3
FortiOS-6.4.2
FortiOS-6.4.1
FortiOS-6.4.0
FortiOS-6.2.17
FortiOS-6.2.16
FortiOS-6.2.15
FortiOS-6.2.14
FortiOS-6.2.13
FortiOS-6.2.12
FortiOS-6.2.11
FortiOS-6.2.10
FortiOS-6.2.9
FortiOS-6.2.8
FortiOS-6.2.7
FortiOS-6.2.6
FortiOS-6.2.5
FortiOS-6.2.4
FortiOS-6.2.3
FortiOS-6.2.2
FortiOS-6.2.1
FortiOS-6.2.0
FortiOS-6.0.18
FortiOS-6.0.17
FortiOS-6.0.16
FortiOS-6.0.15
FortiOS-6.0.14
FortiOS-6.0.13
FortiOS-6.0.12
FortiOS-6.0.11
FortiOS-6.0.10
FortiOS-6.0.9
FortiOS-6.0.8
FortiOS-6.0.7
FortiOS-6.0.6
FortiOS-6.0.5
FortiOS-6.0.4
FortiOS-6.0.3
FortiOS-6.0.2
FortiOS-6.0.1
FortiOS-6.0.0
4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:R
https://fortiguard.fortinet.com/psirt/FG-IR-22-074
Evasion by manipulating MIME attachment
Reference>