Virtual Desktop Tools,Server Virtualization,Server Hypervisors

Fortinet confirms VPN vulnerability exploited in the wild

fortinet-confirms-vpn
Fortinet issued an advisory Monday detailing the heap-based buffer overflow flaw, tracked as CVE-2022-42475, affecting multiple versions of its FortiOS SSL-VPN. Ranked a 9.3 on the common vulnerability scoring system, Fortinet warned the critical flaw could allow a remote unauthenticated attacker to execute arbitrary code.

"Fortinet is aware of an instance where this vulnerability was exploited in the wild, and recommends immediately validating your systems against the following indicators of compromise," Fortinet wrote in the advisory.

Patches are available, and Fortinet recommended upgrading to the latest versions as well as the unaffected earlier version of FortiOS. In an email to TechTarget Editorial, Fortinet said it also continues to monitor the situation.

While the company's Product Security Incident Response team made the advisory publicly available Monday, it was not the first notification on the critical flaw. Olympe Cyberdefense, a France-based cyber threat intelligence vendor, released an alert Friday citing that a "new critical flaw, not yet made public" affected Fortinet SSL-VPN.

The alert, which was first reported Monday by TechTarget sister publication Le Mag IT, warned the zero-day vulnerability was easy to exploit and that attackers could gain full control of intended devices. Additionally, Olympe Cyberdefense recommended disabling VPN-SSL functionality if it's not essential.

Olympe updated its alert once Fortinet confirmed the vulnerability and urged customers to patch.

In a statement sent to TechTarget Editorial, Claire Tills, senior researcher engineer at Tenable, noted the time gap between the Olympe's initial disclosure and Fortinet's advisory. "Three days after its initial public disclosure, Fortinet patched CVE-2022-42475 and confirmed it has been exploited in the wild," Tills said.

"Fortinet SSL-VPNs have been a major target for years now -- to the extent that the FBI and CISA issued a dedicated advisory to these flaws and their exploitation in 2021. Nation state actors are still known to exploit those legacy vulnerabilities in Fortinet SSL-VPNs. Given that this new vulnerability has already been exploited, organizations should patch CVE-2022-42475 immediately before it joins the ranks of other legacy VPN flaws."

Attacks targeting VPNs have been on the rise, with multiple government warnings since 2020 when remote work increased amid the COVID-19 pandemic. In October, FortiOS faced another critical vulnerability that allowed attackers to bypass authentication and was exploited in the wild. Like Monday's advisory, Fortinet was not the first to publicly disclose the flaw.

Spotlight

Other News
Virtual Desktop Tools, Virtual Desktop Strategies

Leostream Enhances Security and Management of vSphere Hybrid Cloud Deployments

Business Wire | January 29, 2024

Leostream Corporation, the world's leading Remote Desktop Access Platform provider, today announced features to enhance security, management, and end-user productivity in vSphere-based hybrid cloud environments. The Leostream platform strengthens end-user computing (EUC) capabilities for vSphere users, including secure access to both on-premises and cloud environments, heterogeneous support, and reduced cloud costs. With the Leostream platform as the single pane of glass managing EUC environments, any hosted desktop environment, including individual virtual desktops, multi-user sessions, hosted physical workstations or desktops, and hosted applications, becomes simpler to manage, more secure, more flexible, and more cost-effective. Significant ways the Leostream platform expands vSphere’s capabilities include: Security The Leostream platform ensures data remains locked in the corporate network, and works across on-premises and cloud environments, providing even disparate infrastructures with the same levels of security and command over authorization, control, and access tracking. The Leostream platform supports multi-factor authentication and allows organizations to enforce strict access control rules, creating an EUC environment modeled on a zero-trust architecture. Multivendor/protocol support The Leostream platform was developed from the ground up for heterogeneous infrastructures and as the connection management layer of the EUC environment, the Leostream platform allows organizations to leverage vSphere today and other hypervisors or hyperconvergence platforms in the future as their needs evolve. The Leostream platform supports the industry’s broadest array of remote display protocols, including specialized protocols for mission-critical tasks. Consistent EUC experience The Leostream platform enables IT to make changes to the underlying environment while ensuring the end user experience is constant, and to incorporate AWS, Azure, Google Cloud, or OpenStack private clouds into their environment without disruptions in end-user productivity. By integrating with corporate Identity Providers (IdPs) that employees are already familiar with, and providing employees with a single portal they use to sign in, the Leostream platform offers simplicity to users too. Connectivity The Leostream Gateway securely connects to on-prem and cloud resources without virtual private networks (VPNs), and eliminates the need to manage and maintain security groups. End users get the same seamless login and high-performance connection across hybrid environments including corporate resources located off the internet. Controlling cloud costs The Leostream Connection Broker implements automated rules that control capacity and power state in the cloud, allowing organizations to optimize their cloud usage and minimize costs, such as ensuring cloud instances aren’t left running when they are no longer needed. The Connection Broker also intelligently pools and shares resources across groups of users, so organizations can invest in fewer systems, reducing overall cost of ownership. “These features deliver a streamlined experience with vSphere and hybrid or multi-cloud resources so end users remain productive, and corporate data and applications remain secure,” said Leostream CEO Karen Gondoly. “At a time when there is uncertainty about the future of support for VMware’s end-user computing, it’s important to bring these options to the market to show that organizations can extend vSphere’s capabilities and simultaneously plan for the future without disruption to the workforce.” About Leostream Corporation Leostream Corporation, the global leader in Remote Desktop Access Platforms, offers comprehensive solutions that enable seamless work-from-anywhere environments for individuals across diverse industries, regardless of organization size or location. The core of the Leostream platform is its commitment to simplicity and insight. It is driven by a unified administrative console that streamlines the management of users, cloud desktops, and IT assets while providing real-time dashboards for informed decision-making. The company continually monitors the evolving remote desktop landscape, anticipating future trends and challenges. This purposeful, proactive approach keeps clients well-prepared for the dynamic changes in remote desktop technology.

Read More

Spotlight

Resources