Vulnerabilities > CVE-2013-4669 - Cryptographic Issues vulnerability in Fortinet Forticlient, Forticlient Lite and Forticlient SSL VPN

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

fortinet

CWE-310

NVD

Published: 2013-06-25

Updated: 2024-11-21

Summary

FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Forticlient - Fortinet Forticlient 4.0.0 Fortinet Forticlient 4.0.1 Fortinet Forticlient 4.0.2 Fortinet Forticlient 4.0.3 Fortinet Forticlient 4.0.4 Fortinet Forticlient 4.1.0 Fortinet Forticlient 4.1.1 Fortinet Forticlient 4.1.2 Fortinet Forticlient 4.1.3 Fortinet Forticlient 4.2.0 Fortinet Forticlient 4.2.1 Fortinet Forticlient 4.2.2 Fortinet Forticlient 4.2.3 Fortinet Forticlient 4.2.4 Fortinet Forticlient 4.2.5 Fortinet Forticlient 4.2.6 Fortinet Forticlient 4.2.7 Fortinet Forticlient 4.3.0 Fortinet Forticlient 4.3.1 Fortinet Forticlient 4.3.2 Fortinet Forticlient 4.3.3 Fortinet Forticlient 4.3.3.445 Fortinet Forticlient Lite 2.0 Fortinet Forticlient Lite 4.3.3.445 Fortinet Forticlient SSL VPN 4.0.2012	29
OS	Microsoft Microsoft Windows *	1
OS	Linux Linux Linux Kernel *	1
OS	Apple Apple MAC OS X *	1
OS	Google Google Android *	1

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References