Details of VAR-201708-0474

ID

VAR-201708-0474

CVE

CVE-2017-3130

TITLE

Fortinet FortiOS Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2017-007034

DESCRIPTION

An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets. Fortinet FortiOS Contains an information disclosure vulnerability.Information may be obtained. Fortinet FortiOS is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Fortinet FortiOS 5.0.0 through 5.4.4 and 5.6.0 are vulnerable. Fortinet FortiOS is a set of security operating systems developed by Fortinet Corporation for the FortiGate network security platform. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSL VPN, Web content filtering and anti-spam

Trust: 1.98

sources: NVD: CVE-2017-3130 // JVNDB: JVNDB-2017-007034 // BID: 100211 // VULHUB: VHN-111333

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.8	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.6	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.5	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.4	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.3	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.2	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.9	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.10	Trust: 1.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.0	Trust: 1.6
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.7	Trust: 1.6
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.4	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.3	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.2	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.1	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.1	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.13	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.9	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.8	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.7	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.0	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.6	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.4	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.12	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.11	Trust: 1.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.14	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.3	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.10	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.1	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.5	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.6.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.0.2	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	-	version:	-	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.6	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.11	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	5.4.5	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	5.6.1	Trust: 0.3

sources: BID: 100211 // JVNDB: JVNDB-2017-007034 // CNNVD: CNNVD-201708-468 // NVD: CVE-2017-3130

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-3130
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-3130
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201708-468
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-111333
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-3130
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-111333
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-3130
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-111333 // JVNDB: JVNDB-2017-007034 // CNNVD: CNNVD-201708-468 // NVD: CVE-2017-3130

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-111333 // JVNDB: JVNDB-2017-007034 // NVD: CVE-2017-3130

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-468

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201708-468

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-007034

PATCH

title:	FG-IR-17-073	url:	http://fortiguard.com/psirt/FG-IR-17-073	Trust: 0.8
title:	Fortinet FortiOS Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=72515	Trust: 0.6

sources: JVNDB: JVNDB-2017-007034 // CNNVD: CNNVD-201708-468

EXTERNAL IDS

db:	NVD	id:	CVE-2017-3130	Trust: 2.8
db:	BID	id:	100211	Trust: 1.4
db:	JVNDB	id:	JVNDB-2017-007034	Trust: 0.8
db:	CNNVD	id:	CNNVD-201708-468	Trust: 0.7
db:	VULHUB	id:	VHN-111333	Trust: 0.1

sources: VULHUB: VHN-111333 // BID: 100211 // JVNDB: JVNDB-2017-007034 // CNNVD: CNNVD-201708-468 // NVD: CVE-2017-3130

REFERENCES

url:	https://fortiguard.com/advisory/fg-ir-17-073	Trust: 1.7
url:	http://www.securityfocus.com/bid/100211	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3130	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3130	Trust: 0.8
url:	http://www.fortinet.com/	Trust: 0.3
url:	http://fortiguard.com/psirt/fg-ir-17-073	Trust: 0.3

sources: VULHUB: VHN-111333 // BID: 100211 // JVNDB: JVNDB-2017-007034 // CNNVD: CNNVD-201708-468 // NVD: CVE-2017-3130

CREDITS

Alexis La Goutte

Trust: 0.3

sources: BID: 100211

SOURCES

db:	VULHUB	id:	VHN-111333
db:	BID	id:	100211
db:	JVNDB	id:	JVNDB-2017-007034
db:	CNNVD	id:	CNNVD-201708-468
db:	NVD	id:	CVE-2017-3130

LAST UPDATE DATE

2024-08-14T13:46:35.120000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-111333	date:	2017-08-21T00:00:00
db:	BID	id:	100211	date:	2017-08-08T00:00:00
db:	JVNDB	id:	JVNDB-2017-007034	date:	2017-09-11T00:00:00
db:	CNNVD	id:	CNNVD-201708-468	date:	2017-08-11T00:00:00
db:	NVD	id:	CVE-2017-3130	date:	2017-08-21T14:49:21.070

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-111333	date:	2017-08-10T00:00:00
db:	BID	id:	100211	date:	2017-08-08T00:00:00
db:	JVNDB	id:	JVNDB-2017-007034	date:	2017-09-11T00:00:00
db:	CNNVD	id:	CNNVD-201708-468	date:	2017-08-11T00:00:00
db:	NVD	id:	CVE-2017-3130	date:	2017-08-10T21:29:00.187