Administrative password hash disclosure in FortiOS

1) Information disclosure

EUVDB-ID: #VU1194

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-7542

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain hash of local administrator.

The vulnerability exists due to unknown error. A remote attacker with unspecified privileges may be able to obtain password hash of local administrator. It is unclear, if the attacker should be authenticated.

Successful exploitation of the vulnerability may allow an attacker to brute-force password hash and obtain administrative privileges on vulnerable device.

Mitigation

The vulnerability is fixed in versions 5.2.10 GA and 5.4.2 GA.

Vulnerable software versions

FortiOS: 5.2.0 - 5.4.1

CPE2.3

• cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.3:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.4:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.5:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.6:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.7:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.8:*:*:*:*:*:*:*
• cpe:2.3:o:fortinet:fortios:5.2.9:*:*:*:*:*:*:*

External links

https://fortiguard.com/advisory/FG-IR-16-050

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.