PT-2019-5736 · Forticlient · Forticlient
Publicado
2019-05-16
·
Atualizado
2020-10-06
·
CVE-2020-9290
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FortiClient for Windows versions 6.2.3 and below
Description
The issue is related to an Unsafe Search Path vulnerability, which may allow a local attacker to execute arbitrary code on the system. This can be achieved by uploading malicious Filter Library DLL files to the directory where FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe reside. The vulnerability is associated with errors in the path search mechanism.
Recommendations
For versions 6.2.3 and below, consider restricting access to the directory where FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe are located to prevent malicious DLL files from being uploaded. As a temporary workaround, avoid using the
FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Uncontrolled Search Path Element
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Forticlient