News
Vigil@nce - FortiGate: man-in-the-middle attack
November 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
When the administrator did not change the default certification
authority for SSL/TLS inspection of FortiGate, an attacker can
create a fake server/proxy and intercept user’s data.
– Impacted products: FortiGate, FortiGate Virtual Appliance
– Severity: 2/4
– Creation date: 05/11/2012
DESCRIPTION OF THE VULNERABILITY
The FortiGate product can inspect SSL/TLS streams. In order to do
so, it has a certification authority, and signs new server
certificates. The client, who accepted this certification
authority, sees no warning in his web browser.
However, the certification authority (public and private keys) is
the same on all FortiGate. An attacker, who has access to one
FortiGate can therefore obtain the private key. He can then create
malicious server certificates, and sign them, so that users do not
see a warning when connecting to the server.
When the administrator did not change the default certification
authority for SSL/TLS inspection of FortiGate, an attacker can
therefore create a fake server/proxy and intercept user’s data.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/FortiGate-man-in-the-middle-attack-12109
