ID
VAR-201502-0396
CVE
CVE-2015-1453
TITLE
Android for Fortinet FortiClient of qm There is a vulnerability in the class that can retrieve important data such as passwords.
Trust: 0.8
DESCRIPTION
The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences. Fortinet FortiClient is prone to multiple security vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to perform man-in-the-middle attacks, to view encrypted data disclose and obtain sensitive information, which will aid in further attacks. Fortinet FortiClient for Android is a terminal security solution based on the Android platform from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. There is a security vulnerability in the qm class of Android Fortinet FortiClient version 5.2.3.091. The vulnerability stems from the fact that the program uses FoRtInEt!AnDrOiD as a hardcoded encryption key
Trust: 1.98
AFFECTED PRODUCTS
| vendor: | fortinet | model: | forticlient | scope: | eq | version: | 5.2.3.091 | Trust: 1.7 |
| vendor: | fortinet | model: | forticlient | scope: | lte | version: | 5.2.3.091 | Trust: 1.0 |
| vendor: | fortinet | model: | forticlient | scope: | eq | version: | 5.2.28 | Trust: 0.3 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-310 | Trust: 1.9 |
THREAT TYPE
remote
Trust: 0.6
TYPE
encryption problem
Trust: 0.6
CONFIGURATIONS
PATCH
| title: | トップページ | url: | http://www.fortinet.co.jp/ | Trust: 0.8 |
| title: | FortiClientエンドポイントセキュリティ | url: | http://www.fortinet.co.jp/products/forticlient/top.html | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2015-1453 | Trust: 2.8 |
| db: | BID | id: | 72383 | Trust: 1.1 |
| db: | JVNDB | id: | JVNDB-2015-001415 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-201502-024 | Trust: 0.7 |
| db: | BID | id: | 72377 | Trust: 0.3 |
| db: | VULHUB | id: | VHN-79414 | Trust: 0.1 |
REFERENCES
| url: | http://www.security-assessment.com/files/documents/advisory/fortinet_forticlient_multiple_vulnerabilities.pdf | Trust: 2.5 |
| url: | http://seclists.org/fulldisclosure/2015/jan/124 | Trust: 2.0 |
| url: | http://www.securityfocus.com/bid/72383 | Trust: 1.1 |
| url: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1453 | Trust: 0.8 |
| url: | http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1453 | Trust: 0.8 |
| url: | http://www.fortinet.com/ | Trust: 0.3 |
CREDITS
Denis Andzakovic
Trust: 0.3
SOURCES
| db: | VULHUB | id: | VHN-79414 |
| db: | BID | id: | 72377 |
| db: | JVNDB | id: | JVNDB-2015-001415 |
| db: | CNNVD | id: | CNNVD-201502-024 |
| db: | NVD | id: | CVE-2015-1453 |
LAST UPDATE DATE
2024-11-23T22:08:10.187000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-79414 | date: | 2015-11-30T00:00:00 |
| db: | BID | id: | 72377 | date: | 2015-05-07T17:26:00 |
| db: | JVNDB | id: | JVNDB-2015-001415 | date: | 2015-02-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-201502-024 | date: | 2015-02-03T00:00:00 |
| db: | NVD | id: | CVE-2015-1453 | date: | 2024-11-21T02:25:27.497 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-79414 | date: | 2015-02-02T00:00:00 |
| db: | BID | id: | 72377 | date: | 2015-01-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2015-001415 | date: | 2015-02-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-201502-024 | date: | 2015-02-03T00:00:00 |
| db: | NVD | id: | CVE-2015-1453 | date: | 2015-02-02T16:59:06.457 |