CVE-2015-2323: Medium severity fortios vulnerability
Published Aug 11, 2015
·Updated
FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.
Affected Software
16 affected components
Fortinet FortiOS=5.0.0
Fortinet FortiOS=5.0.1
Fortinet FortiOS=5.0.2
Fortinet FortiOS=5.0.3
Fortinet FortiOS=5.0.4
Fortinet FortiOS=5.0.5
Fortinet FortiOS=5.0.6
Fortinet FortiOS=5.0.7
Fortinet FortiOS=5.0.8
Fortinet FortiOS=5.0.9
Fortinet FortiOS=5.0.10
Fortinet FortiOS=5.0.11
Fortinet FortiOS=5.2.0
Fortinet FortiOS=5.2.1
Fortinet FortiOS=5.2.2
Fortinet FortiOS=5.2.3
Event History
Aug 11, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2323?
CVE-2015-2323 has a medium severity rating due to potential man-in-the-middle attacks.
2
How do I fix CVE-2015-2323?
To fix CVE-2015-2323, upgrade FortiOS to version 5.0.12 or 5.2.4 or later.
3
What software versions are affected by CVE-2015-2323?
CVE-2015-2323 affects FortiOS versions 5.0.x before 5.0.12 and 5.2.x before 5.2.4.
4
What type of attack does CVE-2015-2323 facilitate?
CVE-2015-2323 allows man-in-the-middle attackers to spoof TLS content by modifying packets.
5
What weak ciphers are involved in CVE-2015-2323?
CVE-2015-2323 involves support for anonymous, export, RC4, and possibly other weak ciphers.