Release mode: Forced release, vendor has not replied.
Ref : TZO-112009 - Fortinet Generic Evasion
Vendor : http://www.fortinet.com
Security notification reaction rating : Catastrophic
Disclosure Policy :
Affected products :
- t.b.a (Vendor has not reacted, please see below)
As this bug has not been reproduced by the vendor, this limited advisory relies on the assumption that my tests were conclusive and that the test environment mimics the production environment.
The parsing engine can be bypassed by a specially crafted and formatted archive file. Details are currently witheld due to other vendors that are in process of deploying patches.
A professional reaction to a vulnerability notification is a way to measure the maturity of a vendor in terms of security. Fortinet is given a grace period of two (2) weeks to reply to my notification. Failure to do so will result in POC being released in two (2) weeks.
As this bug has not been reproduced by the vendor, this limited advisory relies on the assumption that my tests were conclusive.
A general description of the impact and nature of AV Bypasses/evasions can be read at :http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
The bug results in denying the engine the possibility to inspect code within the archive. There is no inspection of the content at all.
IV. Disclosure time line
- 09/03/2009 Send proof of concept, description the terms under which I cooperate and the planned disclosure date. There is no security adress listed at  and hence took the industry standard security contacts addresses secure@ and security@.
- 14/03/2009 : Resending specifying this is the last attempt to disclose responsibly.
- 15/04/2009 : Fortinet published advisories for third party vendors with the address firstname.lastname@example.org, used email@example.com to resend advisory.
- 17/04/2009 : Last attempt to contact, information sent to firstname.lastname@example.org
No reply, as of time of publishing
- 17/04/2009 : Release of this advisory and begin of grace period.
- 17/04/2009 : Fortinet replied instantly, investigation on going