var-201804-0647
Vulnerability from variot

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms. Fortinet FortiClient and FortiClient SSLVPN Client Contains a cryptographic strength vulnerability.Information may be obtained. Fortinet FortiClient for Windows is a Windows-based mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. There is a security vulnerability in the Fortinet FortiClient based on the Windows platform. The vulnerability stems from the program's use of static encryption keys and weak encryption algorithms. A remote attacker could exploit this vulnerability to disclose information

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201804-0647",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "forticlient",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "fortinet",
        "version": "5.6.0"
      },
      {
        "model": "forticlient sslvpn client",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "fortinet",
        "version": "4.4.2335"
      },
      {
        "model": "forticlient",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "fortinet",
        "version": "5.6.0   (windows/mac osx)"
      },
      {
        "model": "forticlient sslvpn client",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "fortinet",
        "version": "4.4.2335   (linux)"
      },
      {
        "model": "forticlient sslvpn client",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "fortinet",
        "version": "4.4.2335"
      },
      {
        "model": "forticlient",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "fortinet",
        "version": "5.6.0"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:fortinet:forticlient",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:fortinet:forticlient_sslvpn_client",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      }
    ]
  },
  "cve": "CVE-2017-17543",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-17543",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-108576",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-17543",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-17543",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-17543",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201712-456",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-108576",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-17543",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Users\u0027 VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms. Fortinet FortiClient and FortiClient SSLVPN Client Contains a cryptographic strength vulnerability.Information may be obtained. Fortinet FortiClient for Windows is a Windows-based mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. There is a security vulnerability in the Fortinet FortiClient based on the Windows platform. The vulnerability stems from the program\u0027s use of static encryption keys and weak encryption algorithms. A remote attacker could exploit this vulnerability to disclose information",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17543"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-17543",
        "trust": 2.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-108576",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17543",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "id": "VAR-201804-0647",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T22:48:44.527000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "FG-IR-17-214",
        "trust": 0.8,
        "url": "https://fortiguard.com/psirt/FG-IR-17-214"
      },
      {
        "title": "Fortinet FortiClient for Windows Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117527"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-326",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://fortiguard.com/advisory/fg-ir-17-214"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17543"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17543"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/326.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-04-26T00:00:00",
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "date": "2018-04-26T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-17543"
      },
      {
        "date": "2018-06-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "date": "2017-12-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "date": "2018-04-26T20:29:00.243000",
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-05-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-108576"
      },
      {
        "date": "2020-05-11T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-17543"
      },
      {
        "date": "2018-06-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      },
      {
        "date": "2020-05-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      },
      {
        "date": "2024-11-21T03:18:08.213000",
        "db": "NVD",
        "id": "CVE-2017-17543"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Fortinet FortiClient and  FortiClient SSLVPN Client Vulnerabilities related to cryptographic strength",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-013362"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-456"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.