Format String Bug in fortiguard-resources CLI command

Summary

A format string vulnerability [CWE-134] in the command line interpreter of FortiOS and FortiProxy may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.

Affected Products

FortiOS version 7.2.0 through 7.2.4
FortiOS all versions 7.0, 6.4, 6.2
FortiProxy version 7.2.0 through 7.2.1
FortiProxy version 7.0.0 through 7.0.7

Solutions

Please upgrade to FortiOS version 7.4.0 or above
Please upgrade to FortiOS version 7.2.5 or above
Please upgrade to FortiOS version 7.0.12 or above
Please upgrade to FortiOS version 6.4.13 or above
Please upgrade to FortiProxy version 7.2.2 or above
Please upgrade to FortiProxy version 7.0.8 or above

Acknowledgement

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.

Timeline

2023-06-09: Initial publication