FortiGate Cookie Parser Buffer Overflow Vulnerability——漏洞银行丨0DAY BANK

FortiGate is a Firewall/VPN appliance, manufactured by Fortinet, that runs on proprietary hardware. The operating system is FortiOS.
The vulnerability exists due to an improper parsing of cookie field in HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request designed to cause a buffer overflow.

Affected versions:
FortiGate (FOS) 4.3.8 and below
FortiGate (FOS) 4.2.12 and below
FortiGate (FOS) 4.1.10 and below

An exploit could allow the attacker to execute arbitrary code, which could result in a complete system compromise.

The vendor has released an updated version to resolve this issue. Refer to FG-IR-16-023 to obtain additional details.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

FG-IR-16-023