Fortinet FortiGate Antivirus Engine Bypass Vulnerability

Bugtraq ID:	16597
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-3057
Remote:	Yes
Local:	No
Published:	Feb 13 2006 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Discovered by Mathieu Dessus <[email protected]>.
Vulnerable:	Fortinet FortiOS 3.0 beta Fortinet FortiOS 3.0 Fortinet FortiOS 2.80 Fortinet FortiOS 2.50 MR5 Fortinet FortiOS 2.50 Fortinet FortiOS 2.36 Fortinet FortiOS 2.8 MR10 Fortinet FortiOS 2.5 0MR4 Fortinet FortiOS 2.80 MR12
Not Vulnerable:	Fortinet FortiOS 3.0 MR1

Fortinet FortiGate Antivirus Engine Bypass Vulnerability

Fortinet FortiGate is reportedly prone to a vulnerability that allows an attacker to bypass antivirus protection. This issue is said to occur when files are transferred using the FTP protocol under certain conditions.

FortiGate devices running FortiOS v2.8MR10 and v3beta are affected by this issue. Other versions may also be vulnerable.

Fortinet FortiGate Antivirus Engine Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Fortinet FortiGate Antivirus Engine Bypass Vulnerability

Solution:
The vendor has released an advisory, along with fixes to address this issue. Please see the referenced advisory for further information on obtaining fixes.

Fortinet FortiGate Antivirus Engine Bypass Vulnerability

References:

• Advisory - Fortinet Provides Fix for FTP Anti-Virus Scanning Application Bypass (Fortinet)
  
• Fortinet Homepage (Fortinet)
  
• Bypass Fortinet anti-virus using FTP (Mathieu Dessus )