Fortinet FortiGate URL Filtering Bypass Vulnerability

Bugtraq ID:	16599
Class:	Design Error
CVE:	CVE-2005-3058
Remote:	Yes
Local:	No
Published:	Feb 13 2006 12:00AM
Updated:	Jan 04 2008 08:19PM
Credit:	Discovered by Mathieu Dessus <[email protected]>.
Vulnerable:	Fortinet FortiOS 3.0 beta Fortinet FortiOS 2.80 Fortinet FortiOS 2.50 MR5 Fortinet FortiOS 2.50 Fortinet FortiOS 2.36 Fortinet FortiOS 2.8 MR10 Fortinet FortiOS 2.5 0MR4
Not Vulnerable:	Fortinet FortiOS 3.0 Fortinet FortiOS 2.80 MR12

Fortinet FortiGate URL Filtering Bypass Vulnerability

Fortinet FortiGate is prone to a vulnerability that could allow users to bypass the device's URL filtering.

FortiGate devices running FortiOS v2.8MR10 and v3beta are vulnerable to this issue. Other versions may also be affected.

Fortinet FortiGate URL Filtering Bypass Vulnerability

An exploit is not required.

The following proof of concept Perl script is available:

http://www.securityfocus.com/data/vulnerabilities/exploits/http_req.pl

• http_req.pl
• /data/vulnerabilities/exploits/16509.pl

Fortinet FortiGate URL Filtering Bypass Vulnerability

Solution:
The vendor has released an advisory, along with fixes to address this issue. Please see the referenced advisory for further information on obtaining fixes.

Fortinet FortiGate URL Filtering Bypass Vulnerability

References:

• Advisory - Fortinet Provides Fix for URL Filtering Application Bypass Vulnerabil (Fortinet)
  
• Fortinet Homepage (Fortinet)
  
• FortiGuard: URL Filtering Application Bypass Vulnerability (Danux )
  
• Re: FortiGuard: URL Filtering Application Bypass Vulnerability (3APA3A <[email protected]>)
  
• URL filter bypass in Fortinet (Mathieu Dessus )