SB2020010605 - Multiple vulnerabilities in Fortinet WiFi WPA3 standard implementation for FortiOS and FortiAP-S/W2

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2019-9495)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to the implementations of EAP-PWD are vulnerable to side-channel attacks as a result of cache access patterns. A remote attacker with ability to install and execute applications can crack weak passwords when memory access patterns are visible in a shared cache.

2) Information disclosure (CVE-ID: CVE-2019-9494)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the implementations of SAE are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. A remote attacker can gain leaked information from a side channel attack that can be used for full password recovery.

Remediation

Install update from vendor's website.

References

• https://fortiguard.com/psirt/FG-IR-19-107