PSIRT Advisory
FortiClient Android and iOS multiple vulnerabilities
Description
FortiClient Android and iOS are affected by two vulnerabilities:
- Android and iOS FortiClient do not check the validity of server certificates.
An attacker may perform a man-in-the-middle attack between the FortiClient and the following services:- A remote FortiGate with SSL VPN service running by default on port 443
- A remote FortiGate with Endpoint control running by default on port 8010
- Android only FortiClient uses a hardcoded encryption key for the following profile preferences settings:
- Client certificate pkcs12
- Client certificate password
- IPSec pre-shared-key
- IPSec password
- SSLpassword
Impact
MitM condition and potential credential harvesting
Affected Products
FortiClient Android, FortiClient iOS
Solutions
FortiClient iOS version 5.2.1 for iPhone and iPad are available as of March 21 from Apple's App Store.FortiClient Android 5.2.6 is available as of July 17 from Google play store.