PT-2014-2004 · Fortinet · Fortios

Gregor Kopf · Published 2014-09-08 · Updated 2017-08-29 · CVE-2014-0351

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 4.3.16 FortiOS versions 5.x prior to 5.0.8

Description The issue is related to the FortiManager protocol service in Fortinet FortiOS, which does not prevent the use of anonymous ciphersuites. This makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream. The vulnerability can be exploited by a remote attacker to perform a man-in-the-middle attack, gain access to protected information, and redirect network traffic.

Recommendations For FortiOS versions prior to 4.3.16, update to version 4.3.16 or later. For FortiOS versions 5.x prior to 5.0.8, update to version 5.0.8 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2018-01301

CVE-2014-0351

Affected Products

Fortios

References · 6

• https://bdu.fstec.ru/vul/2018-01301 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0351 · Security Note
• http://fortiguard.com/advisory/FG-IR-14-006 · Vendor Advisory
• http://kb.cert.org/vuls/id/730964 · Note
• http://securityfocus.com/bid/69754 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96119 · Note