PT-2015-3365 · Fortinet · Fortios

Published 2015-07-15 · Updated 2016-12-24 · CVE-2015-5965

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 4.3.13

Description The issue is related to the SSL-VPN feature, which only checks the first byte of the TLS MAC in finished messages. This makes it easier for remote attackers to spoof encrypted content via a crafted MAC field. The vulnerability is caused by errors in processing input data, allowing a remote attacker to substitute encrypted traffic with a specially formed MAC.

Recommendations For versions prior to 4.3.13, update to version 4.3.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSL-VPN feature until a patch is available. Avoid using the SSL-VPN feature in sensitive environments until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-310

Related Identifiers

BDU:2018-01294

CVE-2015-5965

Affected Products

Fortios

References · 9

• http://fortiguard.com/advisory/FG-IR-15-016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5965; · Security Note
• https://security.gentoo.org/glsa/201508-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01294 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5965 · Security Note
• https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends · Note
• https://securityfocus.com/bid/76065; · Note
• http://securityfocus.com/bid/76065 · Note
• http://securitytracker.com/id/1033256 · Note