Sign-up

ID

VAR-201508-0030


CVE

CVE-2015-5965


TITLE

Fortinet FortiOS of SSL-VPN Vulnerability in function forgery of encrypted content

Trust: 0.8

sources: JVNDB: JVNDB-2015-004043

DESCRIPTION

The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted content via a crafted MAC field. Fortinet FortiOS is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. Fortinet FortiOS 4.3.12 and prior versions are vulnerable. Fortinet FortiOS is a set of security operating systems developed by Fortinet Corporation for the FortiGate network security platform. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSL VPN, Web content filtering and anti-spam. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201508-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Adobe Flash Player: Multiple vulnerabilities Date: August 15, 2015 Bugs: #554882, #557342 ID: 201508-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-plugins/adobe-flash < 11.2.202.508 >= 11.2.202.508 Description =========== Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Trust: 2.07

sources: NVD: CVE-2015-5965 // JVNDB: JVNDB-2015-004043 // BID: 76065 // VULHUB: VHN-83926 // PACKETSTORM: 133099

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiosscope:lteversion:4.3.12

Trust: 1.0

vendor:fortinetmodel:fortiosscope:eqversion:4.3.12

Trust: 0.9

vendor:fortinetmodel:fortiosscope:ltversion:4.3.13

Trust: 0.8

vendor:fortinetmodel:fortiosscope:eqversion:4.3.10

Trust: 0.3

vendor:fortinetmodel:fortiosscope:eqversion:4.3.8

Trust: 0.3

vendor:fortinetmodel:fortiosscope:eqversion:4.3

Trust: 0.3

vendor:fortinetmodel:fortiosscope:neversion:4.3.13

Trust: 0.3

sources: BID: 76065 // JVNDB: JVNDB-2015-004043 // CNNVD: CNNVD-201508-054 // NVD: CVE-2015-5965

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-5965
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-5965
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201508-054
value: MEDIUM

Trust: 0.6

VULHUB: VHN-83926
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-5965
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-83926
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-83926 // JVNDB: JVNDB-2015-004043 // CNNVD: CNNVD-201508-054 // NVD: CVE-2015-5965

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-83926 // JVNDB: JVNDB-2015-004043 // NVD: CVE-2015-5965

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 133099 // CNNVD: CNNVD-201508-054

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201508-054

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-004043

PATCH
title:"POODLE has friends" vulnerabilityurl:http://www.fortiguard.com/advisory/FG-IR-15-016/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-004043

EXTERNAL IDS
db:NVDid:CVE-2015-5965
Trust: 2.9
db:BIDid:76065
Trust: 1.4
db:SECTRACKid:1033256
Trust: 1.1
db:JVNDBid:JVNDB-2015-004043
Trust: 0.8
db:CNNVDid:CNNVD-201508-054
Trust: 0.7
db:VULHUBid:VHN-83926
Trust: 0.1
db:PACKETSTORMid:133099
Trust: 0.1
sources:
            
            
            VULHUB: VHN-83926 // 
            
            
            
            BID: 76065 // 
            
            
            
            JVNDB: JVNDB-2015-004043 // 
            
            
            
            PACKETSTORM: 133099 // 
            
            
            
            CNNVD: CNNVD-201508-054 // 
            
            
            
            NVD: CVE-2015-5965

REFERENCES
url:http://www.fortiguard.com/advisory/fg-ir-15-016/
Trust: 2.0
url:https://vivaldi.net/en-us/blogs/entry/the-poodle-has-friends
Trust: 1.7
url:https://security.gentoo.org/glsa/201508-01
Trust: 1.2
url:http://www.securityfocus.com/bid/76065
Trust: 1.1
url:http://www.securitytracker.com/id/1033256
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5965
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5965
Trust: 0.8
url:http://www.fortinet.com/
Trust: 0.3
url:https://www.fortinet.com/products/fortigate/fortios.html
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-5540
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5551
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5134
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5557
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5560
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5134
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5550
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5561
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5548
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5130
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5131
Trust: 0.1
url:https://security.gentoo.org/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5123
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5123
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5563
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5553
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5132
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5550
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5129
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-3107
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5556
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5564
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5125
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5552
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5554
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5545
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5554
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5131
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5133
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5124
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5129
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5544
Trust: 0.1
url:http://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5539
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5547
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-3107
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5122
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5125
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5133
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5546
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5555
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5551
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5122
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5553
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5562
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5544
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5127
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5132
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5552
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5541
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5547
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5548
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5556
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5549
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5127
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5539
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5540
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5558
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5124
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5545
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5546
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5559
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5130
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5541
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5555
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5965
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-5549
Trust: 0.1
sources:
            
            
            VULHUB: VHN-83926 // 
            
            
            
            BID: 76065 // 
            
            
            
            JVNDB: JVNDB-2015-004043 // 
            
            
            
            PACKETSTORM: 133099 // 
            
            
            
            CNNVD: CNNVD-201508-054 // 
            
            
            
            NVD: CVE-2015-5965

CREDITS
Yngve N. Pettersen
Trust: 0.3
sources:
            
            
            BID: 76065

SOURCES
db:VULHUBid:VHN-83926
db:BIDid:76065
db:JVNDBid:JVNDB-2015-004043
db:PACKETSTORMid:133099
db:CNNVDid:CNNVD-201508-054
db:NVDid:CVE-2015-5965

LAST UPDATE DATE
2024-08-14T12:21:50.032000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-83926date:2016-12-24T00:00:00
db:BIDid:76065date:2015-11-03T19:03:00
db:JVNDBid:JVNDB-2015-004043date:2015-08-12T00:00:00
db:CNNVDid:CNNVD-201508-054date:2015-08-12T00:00:00
db:NVDid:CVE-2015-5965date:2016-12-24T02:59:31.840

SOURCES RELEASE DATE
db:VULHUBid:VHN-83926date:2015-08-11T00:00:00
db:BIDid:76065date:2015-07-15T00:00:00
db:JVNDBid:JVNDB-2015-004043date:2015-08-12T00:00:00
db:PACKETSTORMid:133099date:2015-08-17T15:41:19
db:CNNVDid:CNNVD-201508-054date:2015-08-12T00:00:00
db:NVDid:CVE-2015-5965date:2015-08-11T14:59:16.477