PT-2021-23673 · Fortinet · Forticlientmac

Published 2021-11-02 · Updated 2021-11-04 · CVE-2021-42754

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions FortiClientMacOS versions 7.0.0 and below FortiClientMacOS versions 6.4.5 and below

Description An improper control of generation of code issue may allow an authenticated attacker to hijack the MacOS camera without user permission via a malicious dylib file. This could potentially affect a significant number of devices worldwide, although the exact number is not specified. The issue involves the generation of code in a way that can be exploited by an attacker to gain unauthorized access to the camera.

Recommendations For FortiClientMacOS versions 7.0.0 and below, update to a version above 7.0.0 to resolve the issue. For FortiClientMacOS versions 6.4.5 and below, update to a version above 6.4.5 to resolve the issue. As a temporary workaround, consider restricting access to the camera or disabling the dylib file loading functionality until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-42754

Affected Products

Forticlientmac

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-42754 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42754 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-21-079 · Vendor Advisory
• https://t.me/cibsecurity/31618 · Telegram Post
• https://t.me/cvenotify/22893 · Telegram Post