OpenSSH regreSSHion Attack (CVE-2024-6387)
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-24-258
Final
1
1
2024-07-09T00:00:00
Current version
2024-07-09T00:00:00
2025-05-13T00:00:00
CVE-2024-6387A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This could lead to remote code execution with root privileges.
None
Execute unauthorized code or commands
https://fortiguard.fortinet.com/psirt/FG-IR-24-258
OpenSSH regreSSHion Attack (CVE-2024-6387)
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
https://www.openssh.com/txt/release-9.8
https://www.openssh.com/txt/release-9.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387
FortiADC 7.4.4
FortiADC 7.4.3
FortiADC 7.4.2
FortiADC 7.4.1
FortiADC 7.4.0
FortiADC 7.2.6
FortiADC 7.2.5
FortiADC 7.2.4
FortiADC 7.2.3
FortiADC 7.2.2
FortiADC 7.2.1
FortiADC 7.2.0
FortiAIOps 2.0.1
FortiAIOps 2.0.0
FortiAnalyzer 7.4.3
FortiAnalyzer 7.4.2
FortiAnalyzer 7.4.1
FortiAnalyzer 7.4.0
FortiAnalyzer 7.2.5
FortiAnalyzer 7.2.4
FortiAnalyzer 7.2.3
FortiAnalyzer 7.2.2
FortiAnalyzer 7.2.1
FortiAnalyzer 7.2.0
FortiAnalyzer 7.0.12
FortiAnalyzer 7.0.11
FortiAnalyzer 7.0.10
FortiAnalyzer 7.0.9
FortiAnalyzer 7.0.8
FortiAnalyzer 7.0.7
FortiAnalyzer 7.0.6
FortiAnalyzer 7.0.5
FortiAnalyzer 7.0.4
FortiAnalyzer 7.0.3
FortiAnalyzer 7.0.2
FortiAnalyzer 7.0.1
FortiAnalyzer 7.0.0
FortiAnalyzer 6.4.14
FortiAnalyzer 6.4.13
FortiAnalyzer 6.4.12
FortiAnalyzer 6.4.11
FortiAnalyzer 6.4.10
FortiAnalyzer 6.4.9
FortiAnalyzer 6.4.8
FortiAnalyzer 6.4.7
FortiAnalyzer 6.4.6
FortiAnalyzer 6.4.5
FortiAnalyzer 6.4.4
FortiAnalyzer 6.4.3
FortiAnalyzer 6.4.2
FortiAnalyzer 6.4.1
FortiAnalyzer 6.4.0
FortiAnalyzer-BigData 7.4.0
FortiAuthenticator 6.6.1
FortiAuthenticator 6.6.0
FortiDDoS 5.7.3
FortiDDoS 5.7.2
FortiDDoS 5.7.1
FortiDDoS 5.7.0
FortiDDoS-F 7.0.1
FortiDDoS-F 7.0.0
FortiDeceptor 5.3.1
FortiDeceptor 5.3.0
FortiDeceptor 5.2.0
FortiExtender 7.4.5
FortiExtender 7.4.4
FortiExtender 7.4.3
FortiExtender 7.4.2
FortiExtender 7.4.1
FortiExtender 7.4.0
FortiExtender 7.2.5
FortiExtender 7.2.4
FortiExtender 7.2.3
FortiExtender 7.2.2
FortiExtender 7.2.1
FortiExtender 7.2.0
FortiExtender 7.0.5
FortiExtender 7.0.4
FortiExtender 7.0.3
FortiExtender 7.0.2
FortiExtender 7.0.1
FortiExtender 7.0.0
FortiGuest 1.3.0
FortiGuest 1.2.1
FortiGuest 1.2.0
FortiGuest 1.1.0
FortiGuest 1.0.0
FortiMail 7.4.2
FortiMail 7.4.1
FortiMail 7.4.0
FortiMail 7.2.6
FortiMail 7.2.5
FortiMail 7.2.4
FortiMail 7.2.3
FortiMail 7.2.2
FortiMail 7.2.1
FortiMail 7.2.0
FortiMail 7.0.7
FortiMail 7.0.6
FortiMail 7.0.5
FortiMail 7.0.4
FortiMail 7.0.3
FortiMail 7.0.2
FortiMail 7.0.1
FortiMail 7.0.0
FortiMail 6.4.8
FortiMail 6.4.7
FortiMail 6.4.6
FortiMail 6.4.5
FortiMail 6.4.4
FortiMail 6.4.3
FortiMail 6.4.2
FortiMail 6.4.1
FortiMail 6.4.0
FortiManager 7.4.3
FortiManager 7.4.2
FortiManager 7.4.1
FortiManager 7.4.0
FortiManager 7.2.5
FortiManager 7.2.4
FortiManager 7.2.3
FortiManager 7.2.2
FortiManager 7.2.1
FortiManager 7.2.0
FortiManager 7.0.12
FortiManager 7.0.11
FortiManager 7.0.10
FortiManager 7.0.9
FortiManager 7.0.8
FortiManager 7.0.7
FortiManager 7.0.6
FortiManager 7.0.5
FortiManager 7.0.4
FortiManager 7.0.3
FortiManager 7.0.2
FortiManager 7.0.1
FortiManager 7.0.0
FortiManager 6.4.14
FortiManager 6.4.13
FortiManager 6.4.12
FortiManager 6.4.11
FortiManager 6.4.10
FortiManager 6.4.9
FortiManager 6.4.8
FortiManager 6.4.7
FortiManager 6.4.6
FortiManager 6.4.5
FortiManager 6.4.4
FortiManager 6.4.3
FortiManager 6.4.2
FortiManager 6.4.1
FortiManager 6.4.0
FortiManager Cloud 7.2.4
FortiManager Cloud 7.2.3
FortiManager Cloud 7.2.1
FortiManager Cloud 7.0.12
FortiManager Cloud 7.0.10
FortiManager Cloud 7.0.7
FortiManager Cloud 7.0.6
FortiNAC-F 7.4.0
FortiNAC-F 7.2.6
FortiNAC-F 7.2.5
FortiNAC-F 7.2.4
FortiNAC-F 7.2.3
FortiNAC-F 7.2.2
FortiNAC-F 7.2.1
FortiNAC-F 7.2.0
FortiRecorder 7.2.1
FortiRecorder 7.2.0
FortiRecorder 7.0.4
FortiRecorder 7.0.3
FortiRecorder 7.0.2
FortiRecorder 7.0.1
FortiRecorder 7.0.0
FortiRecorder 6.4.5
FortiRecorder 6.4.4
FortiRecorder 6.4.3
FortiRecorder 6.4.2
FortiRecorder 6.4.1
FortiRecorder 6.4.0
FortiRecorder 6.0.12
FortiRecorder 6.0.11
FortiRecorder 6.0.10
FortiRecorder 6.0.9
FortiRecorder 6.0.8
FortiRecorder 6.0.7
FortiRecorder 6.0.6
FortiRecorder 6.0.5
FortiRecorder 6.0.4
FortiRecorder 6.0.3
FortiRecorder 6.0.2
FortiRecorder 6.0.1
FortiRecorder 6.0.0
FortiSandbox 4.4.6
FortiSandbox 4.4.5
FortiSandbox 4.4.4
FortiSandbox 4.4.3
FortiSandbox 4.4.2
FortiSandbox 4.4.1
FortiSandbox 4.4.0
FortiSandbox 4.2.7
FortiSandbox 4.2.6
FortiSandbox 4.2.5
FortiSandbox 4.2.4
FortiSandbox 4.2.3
FortiSandbox 4.2.2
FortiSandbox 4.2.1
FortiSandbox 4.0.5
FortiSandbox 4.0.4
FortiSandbox 4.0.3
FortiSandbox 4.0.2
FortiSandbox 4.0.1
FortiSandbox 4.0.0
FortiSandbox 3.2.4
FortiSandbox 3.2.3
FortiSandbox 3.2.2
FortiSandbox 3.2.1
FortiSandbox 3.2.0
FortiSwitch 7.4.3
FortiSwitch 7.4.2
FortiSwitch 7.4.1
FortiSwitch 7.4.0
FortiSwitch 7.2.8
FortiSwitch 7.2.7
FortiSwitch 7.2.6
FortiSwitch 7.2.5
FortiSwitch 7.2.4
FortiSwitch 7.2.3
FortiSwitch 7.2.2
FortiSwitch 7.2.1
FortiSwitch 7.2.0
FortiVoice 7.0.2
FortiVoice 7.0.1
FortiVoice 7.0.0
FortiVoice 6.4.9
FortiVoice 6.4.8
FortiVoice 6.4.7
FortiVoice 6.4.6
FortiVoice 6.4.5
FortiVoice 6.4.4
FortiVoice 6.4.3
FortiVoice 6.4.2
FortiVoice 6.4.1
FortiVoice 6.4.0
FortiWLC 8.6.7
FortiWLC 8.6.6
FortiWLC 8.6.5
FortiWLC 8.6.4
FortiWLC 8.6.3
FortiWLC 8.6.2
FortiWLC 8.6.1
FortiWLC 8.6.0
FortiWeb 7.6.0
FortiWeb 7.4.4
FortiWeb 7.4.3
FortiWeb 7.4.2
FortiWeb 7.4.1
FortiWeb 7.4.0
FortiWeb 7.2.9
FortiWeb 7.2.8
FortiWeb 7.2.7
FortiWeb 7.2.6
FortiWeb 7.2.5
FortiWeb 7.2.4
FortiWeb 7.2.3
FortiWeb 7.2.2
FortiWeb 7.2.1
FortiWeb 7.2.0
OpenSSH regreSSHion Attack (CVE-2024-6387)
CVE-2024-6387
FortiADC-7.4.4
FortiADC-7.4.3
FortiADC-7.4.2
FortiADC-7.4.1
FortiADC-7.4.0
FortiADC-7.2.6
FortiADC-7.2.5
FortiADC-7.2.4
FortiADC-7.2.3
FortiADC-7.2.2
FortiADC-7.2.1
FortiADC-7.2.0
FortiAIOps-2.0.1
FortiAIOps-2.0.0
FortiAnalyzer-7.4.3
FortiAnalyzer-7.4.2
FortiAnalyzer-7.4.1
FortiAnalyzer-7.4.0
FortiAnalyzer-7.2.5
FortiAnalyzer-7.2.4
FortiAnalyzer-7.2.3
FortiAnalyzer-7.2.2
FortiAnalyzer-7.2.1
FortiAnalyzer-7.2.0
FortiAnalyzer-7.0.12
FortiAnalyzer-7.0.11
FortiAnalyzer-7.0.10
FortiAnalyzer-7.0.9
FortiAnalyzer-7.0.8
FortiAnalyzer-7.0.7
FortiAnalyzer-7.0.6
FortiAnalyzer-7.0.5
FortiAnalyzer-7.0.4
FortiAnalyzer-7.0.3
FortiAnalyzer-7.0.2
FortiAnalyzer-7.0.1
FortiAnalyzer-7.0.0
FortiAnalyzer-6.4.14
FortiAnalyzer-6.4.13
FortiAnalyzer-6.4.12
FortiAnalyzer-6.4.11
FortiAnalyzer-6.4.10
FortiAnalyzer-6.4.9
FortiAnalyzer-6.4.8
FortiAnalyzer-6.4.7
FortiAnalyzer-6.4.6
FortiAnalyzer-6.4.5
FortiAnalyzer-6.4.4
FortiAnalyzer-6.4.3
FortiAnalyzer-6.4.2
FortiAnalyzer-6.4.1
FortiAnalyzer-6.4.0
FortiAnalyzer-BigData-7.4.0
FortiAuthenticator-6.6.1
FortiAuthenticator-6.6.0
FortiDDoS-5.7.3
FortiDDoS-5.7.2
FortiDDoS-5.7.1
FortiDDoS-5.7.0
FortiDDoS-F-7.0.1
FortiDDoS-F-7.0.0
FortiDeceptor-5.3.1
FortiDeceptor-5.3.0
FortiDeceptor-5.2.0
FortiExtender-7.4.5
FortiExtender-7.4.4
FortiExtender-7.4.3
FortiExtender-7.4.2
FortiExtender-7.4.1
FortiExtender-7.4.0
FortiExtender-7.2.5
FortiExtender-7.2.4
FortiExtender-7.2.3
FortiExtender-7.2.2
FortiExtender-7.2.1
FortiExtender-7.2.0
FortiExtender-7.0.5
FortiExtender-7.0.4
FortiExtender-7.0.3
FortiExtender-7.0.2
FortiExtender-7.0.1
FortiExtender-7.0.0
FortiGuest-1.3.0
FortiGuest-1.2.1
FortiGuest-1.2.0
FortiGuest-1.1.0
FortiGuest-1.0.0
FortiMail-7.4.2
FortiMail-7.4.1
FortiMail-7.4.0
FortiMail-7.2.6
FortiMail-7.2.5
FortiMail-7.2.4
FortiMail-7.2.3
FortiMail-7.2.2
FortiMail-7.2.1
FortiMail-7.2.0
FortiMail-7.0.7
FortiMail-7.0.6
FortiMail-7.0.5
FortiMail-7.0.4
FortiMail-7.0.3
FortiMail-7.0.2
FortiMail-7.0.1
FortiMail-7.0.0
FortiMail-6.4.8
FortiMail-6.4.7
FortiMail-6.4.6
FortiMail-6.4.5
FortiMail-6.4.4
FortiMail-6.4.3
FortiMail-6.4.2
FortiMail-6.4.1
FortiMail-6.4.0
FortiManager-7.4.3
FortiManager-7.4.2
FortiManager-7.4.1
FortiManager-7.4.0
FortiManager-7.2.5
FortiManager-7.2.4
FortiManager-7.2.3
FortiManager-7.2.2
FortiManager-7.2.1
FortiManager-7.2.0
FortiManager-7.0.12
FortiManager-7.0.11
FortiManager-7.0.10
FortiManager-7.0.9
FortiManager-7.0.8
FortiManager-7.0.7
FortiManager-7.0.6
FortiManager-7.0.5
FortiManager-7.0.4
FortiManager-7.0.3
FortiManager-7.0.2
FortiManager-7.0.1
FortiManager-7.0.0
FortiManager-6.4.14
FortiManager-6.4.13
FortiManager-6.4.12
FortiManager-6.4.11
FortiManager-6.4.10
FortiManager-6.4.9
FortiManager-6.4.8
FortiManager-6.4.7
FortiManager-6.4.6
FortiManager-6.4.5
FortiManager-6.4.4
FortiManager-6.4.3
FortiManager-6.4.2
FortiManager-6.4.1
FortiManager-6.4.0
FortiManager Cloud-7.2.4
FortiManager Cloud-7.2.3
FortiManager Cloud-7.2.1
FortiManager Cloud-7.0.12
FortiManager Cloud-7.0.10
FortiManager Cloud-7.0.7
FortiManager Cloud-7.0.6
FortiNAC-F-7.4.0
FortiNAC-F-7.2.6
FortiNAC-F-7.2.5
FortiNAC-F-7.2.4
FortiNAC-F-7.2.3
FortiNAC-F-7.2.2
FortiNAC-F-7.2.1
FortiNAC-F-7.2.0
FortiRecorder-7.2.1
FortiRecorder-7.2.0
FortiRecorder-7.0.4
FortiRecorder-7.0.3
FortiRecorder-7.0.2
FortiRecorder-7.0.1
FortiRecorder-7.0.0
FortiRecorder-6.4.5
FortiRecorder-6.4.4
FortiRecorder-6.4.3
FortiRecorder-6.4.2
FortiRecorder-6.4.1
FortiRecorder-6.4.0
FortiRecorder-6.0.12
FortiRecorder-6.0.11
FortiRecorder-6.0.10
FortiRecorder-6.0.9
FortiRecorder-6.0.8
FortiRecorder-6.0.7
FortiRecorder-6.0.6
FortiRecorder-6.0.5
FortiRecorder-6.0.4
FortiRecorder-6.0.3
FortiRecorder-6.0.2
FortiRecorder-6.0.1
FortiRecorder-6.0.0
FortiSandbox-4.4.6
FortiSandbox-4.4.5
FortiSandbox-4.4.4
FortiSandbox-4.4.3
FortiSandbox-4.4.2
FortiSandbox-4.4.1
FortiSandbox-4.4.0
FortiSandbox-4.2.7
FortiSandbox-4.2.6
FortiSandbox-4.2.5
FortiSandbox-4.2.4
FortiSandbox-4.2.3
FortiSandbox-4.2.2
FortiSandbox-4.2.1
FortiSandbox-4.0.5
FortiSandbox-4.0.4
FortiSandbox-4.0.3
FortiSandbox-4.0.2
FortiSandbox-4.0.1
FortiSandbox-4.0.0
FortiSandbox-3.2.4
FortiSandbox-3.2.3
FortiSandbox-3.2.2
FortiSandbox-3.2.1
FortiSandbox-3.2.0
FortiSwitch-7.4.3
FortiSwitch-7.4.2
FortiSwitch-7.4.1
FortiSwitch-7.4.0
FortiSwitch-7.2.8
FortiSwitch-7.2.7
FortiSwitch-7.2.6
FortiSwitch-7.2.5
FortiSwitch-7.2.4
FortiSwitch-7.2.3
FortiSwitch-7.2.2
FortiSwitch-7.2.1
FortiSwitch-7.2.0
FortiVoice-7.0.2
FortiVoice-7.0.1
FortiVoice-7.0.0
FortiVoice-6.4.9
FortiVoice-6.4.8
FortiVoice-6.4.7
FortiVoice-6.4.6
FortiVoice-6.4.5
FortiVoice-6.4.4
FortiVoice-6.4.3
FortiVoice-6.4.2
FortiVoice-6.4.1
FortiVoice-6.4.0
FortiWLC-8.6.7
FortiWLC-8.6.6
FortiWLC-8.6.5
FortiWLC-8.6.4
FortiWLC-8.6.3
FortiWLC-8.6.2
FortiWLC-8.6.1
FortiWLC-8.6.0
FortiWeb-7.6.0
FortiWeb-7.4.4
FortiWeb-7.4.3
FortiWeb-7.4.2
FortiWeb-7.4.1
FortiWeb-7.4.0
FortiWeb-7.2.9
FortiWeb-7.2.8
FortiWeb-7.2.7
FortiWeb-7.2.6
FortiWeb-7.2.5
FortiWeb-7.2.4
FortiWeb-7.2.3
FortiWeb-7.2.2
FortiWeb-7.2.1
FortiWeb-7.2.0
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
https://fortiguard.fortinet.com/psirt/FG-IR-24-258
OpenSSH regreSSHion Attack (CVE-2024-6387)
Reference>
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
https://www.openssh.com/txt/release-9.8
https://www.openssh.com/txt/release-9.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387