lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 01 May 2013 12:36:17 +0200 From: Thierry Zoller <thierry@...ler.lu> To: full-disclosure@...ts.grok.org.uk Subject: Re: Forticlient VPN client credential interception vulnerability You got to be kidding me... > FORTICLIENT VPN CLIENT CREDENTIAL INTERCEPTION VULNERABILITY > When the FortiClient VPN client is tricked into connecting to a proxy > server rather than to the original firewall (e.g. through ARP or DNS > spoofing,) it detects the wrong SSL certificate but it only warns the > user _AFTER_ it has already sent the password to the proxy. > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists