[Full-disclosure] [TZO-11-2009] Fortinet bypass / evasion (Limited details)



______________________________________________________________________

From the low-hanging-fruit-department - Fortinet bypass/evasion
______________________________________________________________________

Release mode: Forced release, vendor has not replied.
Ref : TZO-112009 - Fortinet Generic Evasion
WWW : http://blog.zoller.lu/2005/04/fortinet-evasion-bypass-limited-details.html
Vendor : http://www.fortinet.com
Security notification reaction rating : Catastrophic

Disclosure Policy :
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

Affected products :
- t.b.a (Vendor has not reacted, please see below)

As this bug has not been reproduced by the vendor, this limited advisory
relies on the assumption that my tests were conclusive and that the test
environment mimics the production environment.

I. Background
~~~~~~~~~~~~~
Quote: "Fortinet is a leading provider of network security appliances and the
leader of the unified threat management (UTM) market worldwide.
Fortinet's award-winning portfolio of security gateways,
subscription services, and complementary products delivers
the highest level of network, content, and application
security for enterprises of all sizes, managed service providers,
and telecommunications carriers, while reducing total cost of
ownership and providing a flexible, scalable path for expansion. "


II. Description
~~~~~~~~~~~~~~~
The parsing engine can be bypassed by a specially crafted and formated
archive file. Details are currently witheld due to other vendors that are
in process of deploying patches.

A professional reaction to a vulnerability notification is a way to
measure the maturity of a vendor in terms of security. Fortinet is given
a grace period of two (2) weeks to reply to my notification. Failure
to do so will result in POC being released in two (2) weeks.

Fortinet (aswell as others) is advised to leave a specific security contact
at [1] in order to simplify getting in contact with them.

As this bug has not been reproduced by the vendor, this limited advisory
relies on the assumption that my tests were conclusive.

III. Impact
~~~~~~~~~~~
A general description of the impact and nature of AV Bypasses/evasions
can be read at :
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

The bug results in denying the engine the possibility to inspect
code within the archive. There is no inspection of the content
at all.


IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
09/03/2009 : Send proof of concept, description the terms under which
I cooperate and the planned disclosure date. There is
no security adress listed at [1] and hence took the industry
tandard security contacts addresses secure@ and security@.

No reply.

14/03/2009 : Resending specifying this is the last attempt to disclose
reponsibly.

No reply.

15/04/2009 : Fortinet published advisories for third party vendors with
the adress dontreply-secresearch@xxxxxxxxxxxx, used secresearch@xxxxxxxxxxxx
to resend advirory.

No reply.

17/04/2009 : Last attempt to contact, information sent to info@xxxxxxxxxxxx

no reply, as of time of publishing

17/04/2009 : Release of this advisory and begin of grace period.


[1] http://osvdb.org/vendor/1/Fortinet%20Inc_


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Call to arms - INFORMATION ANARCHY
    ... Its one thing to prove to a Vendor they have a problem in their code. ... and its not resolved by keeping "Full Disclosure" alive. ... > the Vendor for a vulnerability without accepting responsibility for your ... > feed the feature versus security mentality of many Vendors. ...
    (NT-Bugtraq)
  • Re: Call to arms - INFORMATION ANARCHY
    ... Its one thing to prove to a Vendor they have a problem in their code. ... and its not resolved by keeping "Full Disclosure" alive. ... the Vendor for a vulnerability without accepting responsibility for your ... feed the feature versus security mentality of many Vendors. ...
    (NT-Bugtraq)
  • Re: Using 0days as part of pen-test?
    ... the client the option to determine how the vendor gets notified. ... vulnerability information you discover during ... The legal issue isn't the disclosure process, you can act as "legal entity" ... security threats until the vendor release a patch. ...
    (Pen-Test)
  • [TZO-11-2009] Fortinet bypass / evasion (Limited details)
    ... Forced release, vendor has not replied. ... Security notification reaction rating: Catastrophic ... Disclosure Policy: ...
    (Bugtraq)
  • [Full-disclosure] [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure &
    ... Forced disclosure, no answer from vendor. ... Security notification reaction rating: Catastrophic ... As IBM has not cooperated in any way and I have better ...
    (Full-Disclosure)