Detections
Analytics
Fortinet FortiOS < 4.3.16 / 5.x < 5.0.8 Multiple Vulnerabilities (FG-IR-14-006)
high Nessus Plugin ID 77988
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The remote host is running FortiOS prior to 4.3.16 or 5.x prior to 5.0.8. It is, therefore, affected by the following vulnerabilities :- A flaw exists within the FortiManager service when handling incoming requests. Using a specially crafted request, a remote attacker can exploit this to cause a denial of service or possibly execute arbitrary code.
(CVE-2014-2216)
- A flaw exists within the FortiManager communications protocol that allows a man-in-the-middle attacker, using an anonymous cipher suite, to acquire sensitive information or otherwise impact host communications.
(CVE-2014-0351)
Solution
Upgrade to Fortinet FortiOS 4.3.16 / 5.0.8 / 5.2.0 or later.See Also
Plugin Details
Severity: High
ID: 77988
File Name: fortios_FG-IR-14-006.nasl
Version: 1.4
Type: local
Family: Firewalls
Published: 9/30/2014
Updated: 11/15/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:fortinet:fortios
Required KB Items: Settings/ParanoidReport, Host/Fortigate/model, Host/Fortigate/version, Host/Fortigate/build
Exploit Ease: No known exploits are available
Patch Publication Date: 8/19/2014
Vulnerability Publication Date: 8/19/2014
Reference Information
CVE: CVE-2014-0351, CVE-2014-2216
CERT: 730964