Producent oprogramowania Fortinet udostępnił aktualizacje dla oprogramowania FortiWeb o numerze wersji 7.0.1. Dzięki aktualizacji został naprawiony problem z blokowaniem nieznanych adresów IP na podstawie funkcji geolokalizacji. Ponadto nieuzasadnione restartowanie oprogramowania zostało naprawione. Od wersji 7.0.1, skorygowano podatności, jak również poprawiono szyfrowanie SSH. Aktualizacja naprawiła również błędne działanie dzienników zdarzeń w formacie csv i txt. Po więcej szczegółowych informacji zapraszam do dalszej części materiału.
Wspierane modele:
- Supported Hardware:
- FortiWeb 100D
- FortiWeb 400C
- FortiWeb 400D
- FortiWeb 400E
- FortiWeb 600D
- FortiWeb 600E
- FortiWeb 1000D
- FortiWeb 1000E
- FortiWeb 2000E
- FortiWeb 3000D/3000DFsx
- FortiWeb 3000E
- FortiWeb 3010E
- FortiWeb 4000D
- FortiWeb 4000E
- FortiWeb 100E
- FortiWeb 2000F
- FortiWeb 3000F
- FortiWeb 4000F
Rozwiązane problemy:
| Bug ID | Description |
|---|---|
| 0801242 | When matching the trojan type, the file length is not correct which may cause outof-bounds read. |
| 0799289 | Details of attack log used to show labels of columns, such as HMM probability and argument length. But it is missing in 6.4.0 and 7.0.0. |
| 0792027 | Filesize less than 2B should be blocked by file type restriction in File Security |
| 0791238 | Advanced Audio Coding(AAC, .aac) extension is not available for use under Input Validation > File Security. |
| 0790976 | The sig_main_class fields should be hidden in syslog |
| 0787918 | Unable to view full logs (.csv) and .txt. |
| 0787470 | There are some weak ciphers in FortiWeb SSH. |
| 0787463 | Vulnerabilities in Pentest. |
| 0786805 | Cannot import valid YAML schema including a property called 'No’. |
| 0786238 | Issue with Bot Detection AdsGoogle vs. AdsARobot. |
| 0785593 | After upgrade to 7.0, widget order change is not working. |
| 0783927 | IP list and Protected Host name window are not expanded correctly |
| 0783906/0719707 | FortiWeb crashes and causes outage to services. |
| 0782697 | diagnose system perf command is broken in 7.0 GA. Pressing 'Q’ or 'q’ doesn’t quit the loop. |
| 0782679 | Cannot unblock IP from Secondary on Active-Active-Standard mode |
| 0779535 | RDS RDP services are not connecting when „known Exploits” or „Trojans” or „Informattion Disclosure” is enabled with action alert. |
| 0779405 | Need to add *.epub file format for File Protection. |
| 0778706 | Proxyd crashes which is credential related. |
| 0778084 | FortiWeb reboots frequently |
| 0777811 | False positive for Known Bots. |
| 0777092 | New traffic and attack logs don’t show up in GUI. |
| 0775480 | Proxyd Crash – SSL related. Under TCP proxy, while parsing ClientHello, there lacks necessary validation for invalid packet. |
| 0774835 | When base64 decoding is set in advanced setting, FortiWeb decodes parameter k/v pairs if field name is matched. This lead to Proxyd crash. |
| 0774063 | FWB does not block CML connections that don’t comply with the uploaded WSDL schema |
| 0773890 | Console errors related to XML schemas after the upgrade. |
| 0773349 | Cannot get the quarantine IP list from FortiGate. |
| 0772258 | Client ID is not shown correctly in event log after the ID is released. |
| 0770745 | Malicious IPs signature is triggered without reaching set limit. |
| 0768945 | Malformed request – bad parse context |
| 0767772 | Let’s encrypt certificate issue. |
| 0767491 | Attack logs take too much time to display. |
| 0764963 | Connectivity issue occurs after upgrading to 6.3.17, but when downgrading the version, everything works fine |
| 0764709 | Connections randomly drop |
| 0763557 | HSTS header should be added in 500 block pages. |
| 0760866 | Let’s encrypt certificate shows issued and work but GUI shows INIT state. |
| 0759044 | FortiWeb randomly reboot. |
| 0753355 | FortiWeb does not show the latest 2021 OWASP definitions in log message. |
| 0740664 | Exception count is not readable on signatures. |
| 0701031 | Random failures observed with FTM push for published site with 2FA. |
Notatki producenta: FortiWeb 7.0.1
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie
