FortiOS & FortiProxy - Out-of-bounds Write in captive portal

An out-of-bounds write vulnerability [CWE-787] and a Stack-based Buffer Overflow [CWE-121] in FortiOS & FortiProxy captive portal may allow an inside attacker who has access to captive portal to execute arbitrary code or commands via specially crafted HTTP requests.
Workaround:
Set a non form-based authentication scheme:
config authentication scheme
edit scheme
set method method
next
end
Where can be any of those :
ntlm NTLM authentication.
basic Basic HTTP authentication.
digest Digest HTTP authentication.
negotiate Negotiate authentication.
fsso Fortinet Single …

access amp arbitrary code attacker authentication buffer buffer overflow captive portal code config cwe edit fortios fortiproxy http http requests may non out-of-bounds out-of-bounds write overflow portal requests stack vulnerability workaround