PT-2019-6275 · Fortinet · Forticlient For Linux

Published 2019-11-05 · Updated 2020-08-24 · CVE-2019-15711

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiClient for Linux versions 6.2.1 and below

Description The issue is related to the Export logs function in FortiClient for Linux, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow an attacker to elevate privileges by sending specially crafted IPC requests. This can enable a user with low privilege to run system commands under root privilege via injecting specially crafted "ExportLogs" type IPC client requests to the fctsched process.

Recommendations For FortiClient for Linux versions 6.2.1 and below, consider restricting access to the fctsched process to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the "ExportLogs" type IPC client requests to the fctsched process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-06506

CVE-2019-15711

Affected Products

Forticlient For Linux

References · 6

• 🔥 https://danishcyberdefence.dk/blog/forticlient_linux · Exploit
• https://fortiguard.com/psirt/FG-IR-19-238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15711 · Security Note
• https://bdu.fstec.ru/vul/2022-06506 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15711 · Vendor Advisory
• https://t.me/cvenotify/845 · Telegram Post