PSIRT Advisory

"POODLE has friends" vulnerability

Description

The SSL-VPN feature of FortiOS 4.3.12 and lower only checks the first byte of the TLS MAC in the finished message. An attacker may intercept encrypted packets in transit and modifying their contents by changing the middle or the end of the MAC field in the TLS finished message.

Impact

Man in the middle

Affected Products

FortiOS 4.3.12 and lower.

Solutions

Customers using the SSL-VPN feature and running FortiOS

Acknowledgement

Thanks to Yngve N. Pettersen for working with us to help protect customers.