PT-2015-6410 · Fortinet · Forticlient

Mschenk + 1 · Publicado 2015-09-03 · Atualizado 2018-10-09 · CVE-2015-4077

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiClient versions prior to 5.2.4

Description The issue allows local users to read arbitrary kernel memory. This is achieved via a specific ioctl call, 0x22608C, to certain drivers, including mdare64 48.sys, mdare32 48.sys, mdare32 52.sys, and mdare64 52.sys.

Recommendations For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected drivers to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-4077

Produtos afetados

Forticlient

Referências · 8

• 🔥 https://exploit-db.com/exploits/45149 · Exploit
• http://coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2015/Sep/0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4077 · Nota de Segurança
• http://securitytracker.com/id/1033439 · Nota
• http://securityfocus.com/archive/1/536369/100/0/threaded · Nota
• http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html · Nota
• http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient · Aviso do Fabricante