PT-2016-3749 · Fortinet · Forticlient Linux Sslvpn

Publicado 2016-01-08 · Atualizado 2016-12-03 · CVE-2015-7362

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiClient Linux SSLVPN versions prior to build 2313

Description The issue allows local users to gain privileges via the helper/subroc setuid program when Fortinet FortiClient Linux SSLVPN is installed on Linux in a home directory that is world readable and executable.

Recommendations For versions prior to build 2313, update to build 2313 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the home directory to prevent world readability and executability. Restrict access to the helper/subroc setuid program to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-7362

Produtos afetados

Forticlient Linux Sslvpn

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-7362 · Nota de Segurança
• http://fortiguard.com/advisory/forticlient-sslvpn-linux-client-local-privilege-escalation-vulnerability · Aviso do Fabricante