PT-2015-3366 · Fortinet · Fortios

Published 2015-08-11 · Updated 2016-12-03 · CVE-2015-2323

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.0.x through 5.0.11 FortiOS versions 5.2.x through 5.2.3

Description The issue is caused by the use of weak ciphers when establishing TLS connections. This can allow a remote attacker to conduct man-in-the-middle attacks and spoof TLS content by modifying packets.

Recommendations For FortiOS versions 5.0.x through 5.0.11, update to version 5.0.12 or later to resolve the issue. For FortiOS versions 5.2.x through 5.2.3, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of anonymous, export, and RC4 ciphers in TLS connections to FortiGuard servers until a patch is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2018-01295

CVE-2015-2323

Affected Products

Fortios

References · 5

• http://fortiguard.com/advisory/FG-IR-15-021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2323 · Security Note
• https://bdu.fstec.ru/vul/2018-01295 · Security Note
• http://securitytracker.com/id/1033092 · Note
• http://fortiguard.com/advisory/2015-07-24-weak-ciphers-suites-are-presented-towards-fortiguard-servers · Note