Multiple Fortinet Products Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	109347
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 17 2019 12:00AM
Updated:	Jul 17 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Fortinet Fortios 6.2 Fortinet Fortios 6.0.5 Fortinet Fortios 6.0.4 Fortinet Fortios 6.0.3 Fortinet Fortios 6.0.2 Fortinet Fortios 6.0.1 Fortinet Fortios 6.0 Fortinet Fortios 5.6.9 Fortinet Fortios 5.6.8 Fortinet Fortios 5.6.7 Fortinet Fortios 5.6.6 Fortinet Fortios 5.6.5 Fortinet Fortios 5.6.4 Fortinet Fortios 5.6.3 Fortinet Fortios 5.6.2 Fortinet Fortios 5.6 Fortinet Fortios 5.4.11 Fortinet Fortios 5.4.10 Fortinet Fortios 5.4.9 Fortinet Fortios 5.4.8 Fortinet Fortios 5.4.7 Fortinet Fortios 5.4.6 Fortinet Fortios 5.4.5 Fortinet Fortios 5.4.4 Fortinet Fortios 5.4.3 Fortinet Fortios 5.4.2 Fortinet Fortios 5.4.1 Fortinet Fortios 5.2.13 Fortinet Fortios 5.2.12 Fortinet Fortios 5.2.11 Fortinet Fortios 5.2.8 Fortinet Fortios 5.2.7 Fortinet Fortios 5.2.6 Fortinet Fortios 5.2.5 Fortinet Fortios 5.2.4 Fortinet Fortios 5.2.3 Fortinet Fortios 5.2.2 Fortinet Fortios 5.2.1 Fortinet Fortios 5.6.1 Fortinet Fortios 5.4.0 Fortinet Fortios 5.2.9 Fortinet Fortios 5.2.10 Fortinet FortiManager 6.2 Fortinet FortiManager 6.0.5 Fortinet FortiManager 6.0.2 Fortinet FortiManager 6.0.1 Fortinet FortiManager 6.0 Fortinet FortiManager 5.6.8 Fortinet FortiManager 5.6.5 Fortinet FortiManager 5.6.4 Fortinet FortiManager 5.6.1 Fortinet FortiManager 5.6 Fortinet FortiManager 5.4.6 Fortinet FortiManager 5.4.4 Fortinet FortiManager 5.4.2 Fortinet FortiManager 5.4.1 Fortinet FortiManager 5.4 Fortinet FortiAnalyzer 6.0.1 Fortinet FortiAnalyzer 6.0 Fortinet FortiAnalyzer 5.6.8 Fortinet FortiAnalyzer 5.6.5 Fortinet FortiAnalyzer 5.6.4 Fortinet FortiAnalyzer 5.6.1 Fortinet FortiAnalyzer 5.6 Fortinet FortiAnalyzer 5.4.6 Fortinet FortiAnalyzer 5.4.1 Fortinet FortiAnalyzer 5.4
Not Vulnerable:	Fortinet Fortios 6.2.1 Fortinet Fortios 6.0.6 Fortinet Fortios 5.6.10 Fortinet Fortios 5.4.12 Fortinet Fortios 5.2.14 Fortinet FortiManager 6.2.1 Fortinet FortiManager 6.0.6 Fortinet FortiManager 5.6.9 Fortinet FortiManager 5.4.7 Fortinet FortiAnalyzer 6.2.1 Fortinet FortiAnalyzer 6.0.6 Fortinet FortiAnalyzer 5.6.9 Fortinet FortiAnalyzer 5.4.7

Multiple Fortinet Products Certificate Validation Security Bypass Vulnerability

Multiple Fortinet Products are prone to a security-bypass vulnerability.

An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks.

Multiple Fortinet Products Certificate Validation Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Fortinet Products Certificate Validation Security Bypass Vulnerability

Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.

Multiple Fortinet Products Certificate Validation Security Bypass Vulnerability

References:

• Fortinet Homepage (Fortinet)
  
• Improper check for certificate revocation vulnerability ()