CVE-2017-3130 FortiGate IKE VendorID version info disclosure

Summary

The FortiOS IKE packets which include the Vendor ID embed the FortiOS build version number.

Affected Products

FortiOS 5.2.0 -> 5.2.11
FortiOS 5.4.0 -> 5.4.4
FortiOS 5.6.0

Solutions

FortiOS 5.2 branch, upgrade to 5.2.11 or newer versions. FortiOS 5.4 branch, upgrade to 5.4.5 or newer versions. FortiOS 5.6 branch, upgrade to 5.6.1 or newer versions.

Acknowledgement

Fortinet is pleased to thank independent researcher Alexis La Goutte for reporting this vulnerability under responsible disclosure.