PT-2018-11783 · Microsoft+1 · Pptp+2

Published 2018-11-16 · Updated 2019-04-10 · CVE-2018-13366

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.1, 5.6.7 and below

Description The issue allows an attacker to reveal the serial number of a FortiGate device via the hostname field defined in connection control setup packets of the PPTP protocol. This is related to an information disclosure vulnerability in the PPTP service.

Recommendations For FortiOS versions 6.0.1 and 5.6.7, consider restricting access to the PPTP service until a fix is available. For versions below 5.6.7, apply the same restriction to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-13366

Affected Products

Fortigate

Fortios

Pptp

References · 3

• https://fortiguard.com/advisory/FG-IR-18-101 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13366 · Security Note