Re: Backdoor in Fortinet´s firewall Fortigate
This is a documented feature of the FortiGate and FortiLog devices.
You must have a local serial connection. So, this is not remotely exploitble. If
someone has physical access to your firewall to make a serial connection, then
you have plenty of other problems too.
For reference:
http://kc.forticare.com/default.asp?SID=&Lang=1&id=407
http://kc.forticare.com/default.asp?id=837&Lang=1
Mike
Quoting Johan Andersson <andersson@xxxxxx>:
> If you have console access to this box, you are able to get root access
> or more by using the Username: maintainer
> Password: pbcpbn[here should you type the serialnr. of the box, the
> characters should be in Capital letters.]
> FortiOS: 2.x
>
> Regards
> Johan Andersson
> Atea Security, Sweden
> Phone: +46-709-19 71 76
> Mail: johan.andersson@xxxxxxxx
>
--
************************************************************
Michael J. McCafferty
Principal, Security Engineer
M5 Hosting
858-576-7325 Voice
http://www.m5hosting.com
************************************************************
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.