CVE-2022-42475: Heap-based buffer overflow in sslvpnd
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Other sources
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.## Exploitation status:Fortinet is aware of an instance where this vulnerability was exploited in the wild, and recommends immediately validating your systems against the following indicators of compromise:Multiple log entries with:Logdesc=Application crashed and msg=[...] application:sslvpnd,[...], Signal 11 received, Backtrace: [...]Presence of the following artifacts in the filesystem:/data/lib/libips.bak/data/lib/libgif.so/data/lib/libiptcp.so/data/lib/libipudp.so/data/lib/libjepg.so/var/.sslvpnconfigbk/data/etc/wxd.conf/flashConnections to suspicious IP addresses from the FortiGate:188.34.130.40:444103.131.189.143:30080,30081,30443,20443193.36.119.61:8443,444172.247.168.153:8033139.180.184.19766.42.91.32158.247.221.101107.148.27.117139.180.128.142155.138.224.122185.174.136.20 For more information on how to check for the presence of the indicators of compromise above, please visit this Knowledge Base entry, and contact customer support for assistance. ## Workaround:Disable SSL-VPN.## Changelog:2022-12-12: Added FOS6k/k 2022-12-22: Added FortiProxy2022-12-27: Corrected typo in IOCs: 192.36.119.61 => 193.36.119.61
— FortiGuard
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
— CISA
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-42475?
CVE-2022-42475 is a vulnerability in Fortinet FortiOS SSL-VPN that allows an attacker to execute arbitrary code or commands remotely.
How can an attacker exploit CVE-2022-42475?
An attacker can exploit CVE-2022-42475 by sending specifically crafted requests to the Fortinet FortiOS SSL-VPN.
What is the severity of CVE-2022-42475?
CVE-2022-42475 has a severity rating of high.
How can I fix CVE-2022-42475?
To fix CVE-2022-42475, update Fortinet FortiOS SSL-VPN to the latest version provided by Fortinet.
Are there any references for CVE-2022-42475?
Yes, you can find more information about CVE-2022-42475 at the Fortinet PSIRT Advisory FG-IR-22-398.