PT-2019-3150 · Fortinet · Fortios

Published 1999-01-01 · Updated 2020-08-24 · CVE-2019-5592

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 3.547 and below FortiOS versions 4.000 through 4.036 FortiOS versions 4.200 through 4.219 FortiOS versions 5.000 through 5.006

Description The issue is related to multiple padding oracle vulnerabilities in the CBC padding implementation of the FortiOS IPS engine. These vulnerabilities may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position. The vulnerability is associated with a lack of protection for service data and can be exploited by a remote attacker to conduct a Man-in-the-middle attack and reveal protected information.

Recommendations For FortiOS versions 3.547 and below, update to a version that includes a fix for the CBC padding implementation vulnerabilities. For FortiOS versions 4.000 through 4.036, update to a version that includes a fix for the CBC padding implementation vulnerabilities. For FortiOS versions 4.200 through 4.219, update to a version that includes a fix for the CBC padding implementation vulnerabilities. For FortiOS versions 5.000 through 5.006, update to a version that includes a fix for the CBC padding implementation vulnerabilities. As a temporary workaround, consider disabling the SSL Deep Inspection policies and the IPS sensor to minimize the risk of exploitation.

Fix

Information Disclosure

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-200

CWE-347

Related Identifiers

BDU:2019-03138

CVE-2019-5592

LOWSTRENGTHCIPHERSUITESCHECK

Affected Products

Fortios

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2019-5592 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4929 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0169 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6593 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3566 · Security Note
• https://bdu.fstec.ru/vul/2019-03138 · Security Note
• https://fortiguard.com/advisory/FG-IR-19-145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3389 · Security Note
• https://freakattack.com · Note
• https://shattered.io · Note
• https://fortiguard.com/psirt/FG-IR-19-145 · Note
• https://sweet32.info · Note