CVE-2012-4948

Description

The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.

Affected (29)

Products: Fortinet: Fortigate 1000c, Fortigate 100d, Fortigate 110c, Fortigate 1240b, Fortigate 200b, Fortigate 20c, Fortigate 300c, Fortigate 3040b, Fortigate 310b, Fortigate 311b, Fortigate 3140b, Fortigate 3240c, Fortigate 3810a, Fortigate 3950b, Fortigate 40c, Fortigate 5001a Sw, Fortigate 5001b, Fortigate 5020, Fortigate 5060, Fortigate 50b, Fortigate 5101c, Fortigate 5140b, Fortigate 600c, Fortigate 60c, Fortigate 620b, Fortigate 800c, Fortigate 80c, Fortigate Voice 80c, Fortigaterugged 100c

29 products

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortigate 1000c	All versions
Fortinet Fortigate 100d	All versions
Fortinet Fortigate 110c	All versions
Fortinet Fortigate 1240b	All versions
Fortinet Fortigate 200b	All versions
Fortinet Fortigate 20c	All versions
Fortinet Fortigate 300c	All versions
Fortinet Fortigate 3040b	All versions
Fortinet Fortigate 310b	All versions
Fortinet Fortigate 311b	All versions
Fortinet Fortigate 3140b	All versions
Fortinet Fortigate 3240c	All versions
Fortinet Fortigate 3810a	All versions
Fortinet Fortigate 3950b	All versions
Fortinet Fortigate 40c	All versions
Fortinet Fortigate 5001a Sw	All versions
Fortinet Fortigate 5001b	All versions
Fortinet Fortigate 5020	All versions
Fortinet Fortigate 5060	All versions
Fortinet Fortigate 50b	All versions
Fortinet Fortigate 5101c	All versions
Fortinet Fortigate 5140b	All versions
Fortinet Fortigate 600c	All versions
Fortinet Fortigate 60c	All versions
Fortinet Fortigate 620b	All versions
Fortinet Fortigate 800c	All versions
Fortinet Fortigate 80c	All versions
Fortinet Fortigate Voice 80c	All versions
Fortinet Fortigaterugged 100c	All versions