FG-IR-19-037: FG default configuration is not secure/ By default, FG does not verify LDAP server identity
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable verification of the LDAP server identity; the default configuration does not verify LDAP server identity.
FortiOS LDAP configuration LDAP server identity verification = enabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FortiGate deployments that use LDAP and do not verify the LDAP server's identity are exposed. The attacker must be on the same subnet as the affected device.
What does an attacker need to exploit the vulnerability?
No authentication or user interaction is required. An attacker on the same subnet can impersonate the LDAP server to intercept sensitive information.
Are default settings affected?
Yes. The issue is caused by the default configuration not verifying LDAP server identity.