http://seclists.org/fulldisclosure/2015/Jan/125

http://www.fortiguard.com/advisory/FG-IR-15-002/

http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf

MITRE disputed

** DISPUTED ** The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key.  NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack."

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key.  NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack.

** DISPUTADA ** La implementación del protocolo CAPWAP DTLS en Fortinet FortiOS 5.0 Patch 7 build 4457 utiliza el mismo certificado y clave privada a través de las distintas instalaciones de los clientes, lo que hace que sea más fácil para atacantes man-in-the-middle suplantar servidores SSL aprovechando la clave privada y certificado Fortinet_Factory. NOTA: FG-IR-15-002 dice "El certificado Fortinet_Factory es único para cada dispositivo ... Un atacante no puede por tanto perpetrar un ataque Mi

La implementación de protocolo CAPWAP DTLS en Fortinet FortiOS 5.0 Patch 7 build 4457 utiliza el mismo certificado y la misma clave privada para las instalaciones de clientes distintos, lo que facilita a atacantes man-in-the-middle falsificar servidores SSL mediante el aprovechamiento del certificado de Fortinet_Factory.

http://www.fortiguard.com/advisory/FG-IR-15-002/ No Types Assigned

http://www.fortiguard.com/advisory/FG-IR-15-002/ Advisory

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key.

** DISPUTED ** The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key.  NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack."

http://www.fortiguard.com/advisory/FG-IR-15-002/

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

CWE-310

Configuration 1
     OR
          *cpe:2.3:o:fortinet:fortios:5.0.7:*:*:*:*:*:*:*

http://seclists.org/fulldisclosure/2015/Jan/125 No Types Assigned

http://seclists.org/fulldisclosure/2015/Jan/125 Exploit

http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf No Types Assigned

http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf Exploit