TITLE:
FortiGate URL Filter and Virus Scanning Bypass Vulnerabilities

SECUNIA ADVISORY ID:
SA18844

VERIFY ADVISORY:
http://secunia.com/advisories/18844/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From local network

OPERATING SYSTEM:
Fortinet FortiOS (FortiGate) 2.x
http://secunia.com/product/2289/
Fortinet FortiOS (FortiGate) 3.x
http://secunia.com/product/6802/

DESCRIPTION:
Mathieu Dessus has reported two vulnerabilities in FortiGate, which
can be exploited by malicious people and users to bypass certain
security restrictions.

1) The URL blocking functionality can be bypassed by
specially-crafted HTTP requests that are terminated by the CR
character instead of the CRLF characters. It is also possible to
bypass the functionality via a HTTP/1.0 request with no host header.

The vulnerability has been reported in FortiOS v2.8MR10 and v3beta.
Other versions may also be affected.

2) The virus scanning functionality can be bypassed when sending
files over FTP under certain conditions. 

The vulnerability has been reported in FortiOS v2.8MR10 and v3beta.
Other versions may also be affected.

SOLUTION:
Do not rely on URL blocking as the only means of blocking users'
access. Desktop-based on-access virus scanners should be used
together with server-based virus scanners.

PROVIDED AND/OR DISCOVERED BY:
Mathieu Dessus

ORIGINAL ADVISORY:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042139.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042140.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------