Fortinet FortiOS VM CVE-2019-5587 Local Security Bypass Vulnerability

Bugtraq ID:	108628
Class:	Unknown
CVE:	CVE-2019-5587
Remote:	No
Local:	Yes
Published:	May 17 2019 12:00AM
Updated:	May 17 2019 12:00AM
Credit:	Bart Dopheide from Axians.
Vulnerable:	Fortinet Fortios 6.0.4 Fortinet Fortios 6.0.3 Fortinet Fortios 6.0.2 Fortinet Fortios 6.0.1 Fortinet Fortios 6.0 Fortinet Fortios 5.6.9 Fortinet Fortios 5.6.8 Fortinet Fortios 5.6.7 Fortinet Fortios 5.6.6 Fortinet Fortios 5.6.5 Fortinet Fortios 5.6.4 Fortinet Fortios 5.6.3 Fortinet Fortios 5.6.2 Fortinet Fortios 5.6 Fortinet Fortios 5.4.11 Fortinet Fortios 5.4.10 Fortinet Fortios 5.4.9 Fortinet Fortios 5.4.8 Fortinet Fortios 5.4.7 Fortinet Fortios 5.4.6 Fortinet Fortios 5.4.5 Fortinet Fortios 5.4.4 Fortinet Fortios 5.4.3 Fortinet Fortios 5.4.2 Fortinet Fortios 5.4.1 Fortinet Fortios 5.2.13 Fortinet Fortios 5.2.12 Fortinet Fortios 5.2.11 Fortinet Fortios 5.2.8 Fortinet Fortios 5.2.7 Fortinet Fortios 5.2.6 Fortinet Fortios 5.2.5 Fortinet Fortios 5.2.4 Fortinet Fortios 5.2.3 Fortinet Fortios 5.2.2 Fortinet Fortios 5.2.1 Fortinet Fortios 5.0.13 Fortinet Fortios 5.0.9 Fortinet Fortios 5.0.8 Fortinet Fortios 5.0.7 Fortinet FortiOS 5.0.3 Fortinet FortiOS 5.0.2 Fortinet FortiOS 5.0.1 Fortinet Fortios 4.7.7 Fortinet Fortios 4.3.19 Fortinet Fortios 4.3.17 Fortinet Fortios 4.3.15 Fortinet FortiOS 4.3.10 Fortinet Fortios 4.3.9 Fortinet FortiOS 4.3.8 B0630 Fortinet FortiOS 4.3.8 B0537 Fortinet FortiOS 4.3.8 Fortinet Fortios 4.3 Fortinet Fortios 4.2.13 Fortinet Fortios 4.2.12 Fortinet Fortios 4.1.11 Fortinet Fortios 4.1.10 Fortinet FortiOS 3.0 Fortinet FortiOS 2.80 Fortinet FortiOS 2.50 MR5 Fortinet FortiOS 2.50 Fortinet FortiOS 2.36 Fortinet FortiOS 2.8 MR10 Fortinet FortiOS 2.5 0MR4 Fortinet Fortios 5.6.1 Fortinet Fortios 5.4.0 Fortinet Fortios 5.2.9 Fortinet Fortios 5.2.10 Fortinet Fortios 5.2.0 Fortinet Fortios 5.2 Fortinet Fortios 5.0.6 Fortinet FortiOS 5.0.5 Fortinet Fortios 5.0.4 Fortinet Fortios 5.0.12 Fortinet Fortios 5.0.11 Fortinet Fortios 5.0.0 Fortinet Fortios 4.3.18 Fortinet Fortios 4.3.16 Fortinet FortiOS 4.3.14 Fortinet FortiOS 4.3.13 Fortinet FortiOS 4.3.12 Fortinet FortiOS 3.0 MR2 Fortinet FortiOS 3.0 MR1 Fortinet FortiOS 2.80 MR12
Not Vulnerable:	Fortinet Fortios 6.2 Fortinet Fortios 6.0.5

Fortinet FortiOS VM CVE-2019-5587 Local Security Bypass Vulnerability

Fortinet FortiOS VM is prone to a local security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

Versions prior to FortiOS VM 6.0.5 are vulnerable.

Fortinet FortiOS VM CVE-2019-5587 Local Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Fortinet FortiOS VM CVE-2019-5587 Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Fortinet FortiOS VM CVE-2019-5587 Local Security Bypass Vulnerability

References:

• Fortinet Homepage (Fortinet)
  
• FortiOS Homepage (Fortinet)
  
• FG-IR-19-017: FortiOS VM images lack an integrity check of the file system at bo (Fortinet)