PSIRTUnencrypted keychain permanent password
Summary
A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS may allow an unauthenticated attacker that has physical access to a jailbroken device to obtain cleartext passwords via keychain dump.
| Version | Affected | Solution |
|---|---|---|
| FortiClientiOS 7.4 | Not affected | Not Applicable |
| FortiClientiOS 7.2 | 7.2 all versions | Migrate to a fixed release |
| FortiClientiOS 7.0 | 7.0 all versions | Migrate to a fixed release |
| FortiClientiOS 6.4 | 6.4 all versions | Migrate to a fixed release |
| FortiClientiOS 6.2 | 6.2 all versions | Migrate to a fixed release |
| FortiClientiOS 6.0 | 6.0 all versions | Migrate to a fixed release |