PT-2015-7058 · Fortinet · Forticlient

Enrique Nissim · Published 2015-09-03 · Updated 2018-10-09 · CVE-2015-5735

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiClient versions prior to 5.2.4

Description The issue allows local users to write to arbitrary memory locations via a specific ioctl call, 0x226108, in certain drivers.

Recommendations For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-5735

Affected Products

Forticlient

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-5735 · Security Note
• http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient · Vendor Advisory
• http://coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities · Note
• http://seclists.org/fulldisclosure/2015/Sep/0 · Note
• http://securitytracker.com/id/1033439 · Note
• http://securityfocus.com/archive/1/536369/100/0/threaded · Note
• http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html · Note