PT-2015-5293 · Fortinet · Forticlient

Denis Andzakovic · Publicado 2015-02-02 · Atualizado 2015-11-30 · CVE-2015-1453

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiClient version 5.2.3.091

Description The issue concerns the use of a hardcoded encryption key in the qm class, which can be leveraged by attackers to decrypt sensitive data, including passwords, stored in the Shared Preferences.

Recommendations For FortiClient version 5.2.3.091, consider updating to a newer version that does not use a hardcoded encryption key, or contact the vendor for specific guidance on securing the affected component. As a temporary workaround, restrict access to sensitive data stored in the Shared Preferences to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-1453

Produtos afetados

Forticlient

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2015/Jan/124 · Exploit
• 🔥 http://security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1453 · Nota de Segurança
• http://securityfocus.com/bid/72383 · Nota