A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortiproxy | Fortinet | 1.1.0 (including) | 1.1.6 (including) |
| Fortiproxy | Fortinet | 1.2.0 (including) | 1.2.13 (including) |
| Fortiproxy | Fortinet | 2.0.0 (including) | 2.0.11 (including) |
| Fortiproxy | Fortinet | 7.0.0 (including) | 7.0.8 (excluding) |
| Fortiproxy | Fortinet | 7.2.0 (including) | 7.2.0 (including) |
| Fortiproxy | Fortinet | 7.2.1 (including) | 7.2.1 (including) |
| Fortios | Fortinet | 6.0.0 (including) | 6.0.16 (including) |
| Fortios | Fortinet | 6.2.0 (including) | 6.2.12 (including) |
| Fortios | Fortinet | 6.4.0 (including) | 6.4.11 (including) |
| Fortios | Fortinet | 7.0.0 (including) | 7.0.8 (excluding) |
| Fortios | Fortinet | 7.2.0 (including) | 7.2.0 (including) |
CBC mode eliminates a weakness of Electronic Code Book (ECB) mode by allowing identical plaintext blocks to be encrypted to different ciphertext blocks. This is possible by the XOR-ing of an IV with the initial plaintext block so that every plaintext block in the chain is XOR’d with a different value before encryption. If IVs are reused, then identical plaintexts would be encrypted to identical ciphertexts. However, even if IVs are not identical but are predictable, then they still break the security of CBC mode against Chosen Plaintext Attacks (CPA).