Fortinet FortiClient VPN Client SSL Certificate Validation Security Bypass Vulnerability
BID:59604
Info
Fortinet FortiClient VPN Client SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 59604 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 01 2013 12:00AM |
| Updated: | May 01 2013 12:00AM |
| Credit: | Cedric Tissieres, Philippe Oechslin |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Fortinet FortiClient VPN Client SSL Certificate Validation Security Bypass Vulnerability
Fortinet FortiClient VPN client is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server.
An attacker can exploit this issue to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Fortinet FortiClient VPN client is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server.
An attacker can exploit this issue to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Exploit / POC
Fortinet FortiClient VPN Client SSL Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Fortinet FortiClient VPN Client SSL Certificate Validation Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Fortinet FortiClient VPN Client SSL Certificate Validation Security Bypass Vulnerability
References:
References:
- Fortinet Homepage (Fortinet)