PSIRT Advisory

FortiOS TCP timestamp response

Summary

FortiOS by default enables TCP timestamp response, which may lead to information disclosure.


The TCP timestamp response can be used to approximate the FortiOS device uptime, potentially aiding in further attacks. This may be used by an attacker to estimate if FortiOS has not been upgraded to the latest version, because upgrading resets the device's uptime.

Impact

Information Disclosure

Affected Products

FortiOS all versions, when TCP timestamp is enabled (default setting)

Solutions

FortiOS supports admin CLI console commands to disable the TCP timestamp:


config system global

set tcp-option disable /* enable is the default value */

end


Disabling tcp-option will strip TCP header Timestamp, Selective Acknowledgements (SACK) and Window Scaling altogether which can lead performance penalty for services hosted on FortiOS under certain network environment.


For details about the tcp-option, please refer to the Fortinet knowledge base:

https://kb.fortinet.com/kb/documentLink.do?externalID=FD44724