| Description: | Summary:
Fortinet FortiAnalyzer is prone to multiple vulnerabilities in
OpenSSL.
Vulnerability Insight:
The following flaws exist in the OpenSSL library:
- CVE-2014-0224: SSL/TLS MITM vulnerability
- CVE-2014-0221: DTLS recursion flaw
- CVE-2014-0195: DTLS invalid fragment vulnerability
- CVE-2010-5298: SSL_MODE_RELEASE_BUFFERS session injection or denial of service (DoS)
- CVE-2014-3470: Anonymous ECDH denial of service (DoS)
Vulnerability Impact:
CVE-2014-0224 may allow an attacker with a privileged network
position (man-in-the-middle) to decrypt SSL encrypted communications.
CVE-2014-0221 may allow an attacker to crash a DTLS client with an invalid handshake.
CVE-2014-0195 can result in a buffer overrun attack by sending invalid DTLS fragments to an
OpenSSL DTLS client or server.
CVE-2014-0198 and CVE-2010-5298 may allow an attacker to cause a denial of service under certain
conditions, when SSL_MODE_RELEASE_BUFFERS is enabled.
CVE-2014-3470 may allow an attacker to trigger a denial of service in SSL clients when anonymous
ECDH ciphersuites are enabled. This issue does not affect Fortinet products.
CVE-2014-0076 can be used to discover ECDSA nonces on multi-user systems by exploiting timing
attacks in CPU L3 caches. This does not apply to Fortinet products.
Affected Software/OS:
Fortinet FortiAnalyzer prior to version 5.0.7 build 321.
Solution:
Update to FortiAnalyzer 5.0.7 build 321, 5.2.0 or later.
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
