A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x, 1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore image` and `execute certificate remote` operations with the tFTP protocol.

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-206 advisory.

  - A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version     7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version     5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below,     version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through     6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x,     1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore     image` and `execute certificate remote` operations with the tFTP protocol. (CVE-2021-43072)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of FortiAnalyzer that is 5.6.x through 5.6.11, 6.x through 6.0.11, 6.2.x through 6.2.9, 6.4.x through 6.4.7, or 7.x through 7.0.2. It is, therefore, affected by a buffer overflow vulnerability. An authenticated, remote attacker can exploit this issue, via the TFTP protocol with crafted CLI 'execute restore image' and 'execute certificate remote' operations, to execute arbitrary code or commands in the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of FortiManager that is 5.6.x through 5.6.11, 6.x through 6.0.11, 6.2.x through 6.2.9, 6.4.x through 6.4.7, or 7.x through 7.0.2. It is, therefore, affected by a buffer overflow vulnerability. An authenticated, remote attacker can exploit this issue, via the TFTP protocol with crafted CLI 'execute restore image' and 'execute certificate remote' operations, to execute arbitrary code or commands in the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of FortiOS that is 6.0.x through 6.0.14, 6.2.x through 6.2.10, 6.4.x through 6.4.8, or 7.0.x through 7.0.5. It is, therefore, affected by a buffer overflow vulnerability. An authenticated, remote attacker can exploit this issue, via the TFTP protocol with crafted CLI 'execute restore image' and 'execute certificate remote' operations, to execute arbitrary code or commands in the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209744	Fortinet Fortigate Stack-based buffer overflows via crafted CLI commands (FG-IR-21-206)	Nessus	Firewalls	medium
163255	Fortinet FortiAnalyzer Buffer Overflow (FG-IR-21-206)	Nessus	CGI abuses	medium
163254	Fortinet FortiManager Buffer Overflow (FG-IR-21-206)	Nessus	Firewalls	medium
163253	Fortinet FortiOS Buffer Overflow (FG-IR-21-206)	Nessus	Firewalls	medium

Detections

Analytics

CVE-2021-43072

medium

Tenable Plugins

medium

medium

medium

medium