Fortinet warns customers to remove undocumented authentication feature ASAP.
A recently identified backdoor in hardware sold by security company Fortinet has been found in several new products, many that were running current software, the company warned this week.
The undocumented account with a hard-coded password came to light last week when attack code exploiting the backdoor was posted online. In response, Fortinet officials said it affected only older versions of Fortinet’s FortiOS software. The company went on to say the undocumented method for logging into servers using the secure shell (SSH) protocol was a “remote management” feature that had been removed in July 2014.
In a blog post published this week, Fortinet revised the statement to say the backdoor was still active in several current company products, including some versions of its FortiSwitch, FortiAnalyzer, and FortiCache devices. The company said it made the discovery after conducting a review of its products. Company officials wrote:
As previously stated, this vulnerability is an unintentional consequence of a feature that was designed with the intent of providing seamless access from an authorized FortiManager to registered FortiGate devices. It is important to note, this is not a case of a malicious backdoor implemented to grant unauthorized user access.
In accordance with responsible disclosure, today we have issued a security advisory that provides a software update that eliminates this vulnerability in these products. This update also covers the legacy and end-of-life products listed above. We are actively working with customers and strongly recommend that all customers using the following products update their systems with the highest priority:
- FortiAnalyzer: 5.0.0 to 5.0.11 and 5.2.0 to 5.2.4 (branch 4.3 is not affected)
- FortiSwitch: 3.3.0 to 3.3.2
- FortiCache: 3.0.0 to 3.0.7 (branch 3.1 is not affected)
- FortiOS 4.1.0 to 4.1.10
- FortiOS 4.2.0 to 4.2.15
- FortiOS 4.3.0 to 4.3.16
- FortiOS 5.0.0 to 5.0.7
Undocumented backdoors have long been a security concern because they make it possible for outsiders to gain unauthorized access to sensitive devices. Backdoors have received increased scrutiny since network hardware maker Juniper dropped last month’s bombshell that there was unauthorized code added to its Netscreen line of firewalls. Among other things, the unauthorized code in the Juniper product allowed attackers to surreptitiously decrypt encrypted traffic. While Fortinet officials say the backdoor in its products had no malicious intentions, there’s little doubt it could be used for covert eavesdropping by people with knowledge of its presence.
