FortiClient: Increased Privileges -- Existing Account

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.0905
               Unquoted Service Path exploit in FortiClient
                               12 March 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           FortiClient
Publisher:         Fortinet
Operating System:  Windows
Impact/Access:     Increased Privileges -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-17658  

Original Bulletin: 
   https://fortiguard.com/psirt/FG-IR-19-281

- --------------------------BEGIN INCLUDED TEXT--------------------

Unquoted Service Path exploit in FortiClient

IR Number : FG-IR-19-281
Date      : Mar 09, 2020
Risk      : 3/5
Impact    : Escalation of privilege
CVE ID    : CVE-2019-17658
Summary

An unquoted service path vulnerability in the FortiClient FortiTray component
may allow an attacker to gain elevated privileges via the FortiClientConsole
executable service path.

Impact

Escalation of privilege

Affected Products

FortiClient for Windows Versions 6.2.2 and below.

Solutions

Please upgrade to FortiClient for Windows version 6.2.3 or above.

Acknowledgement

Fortinet is pleased to thank Michael Wollner from Deutsche Telekom AG for
reporting this vulnerability under responsible disclosure.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXmnXDWaOgq3Tt24GAQhDXw//fHPdHWlosepAfbjcHpb26Q1kALxWJCID
IjoxAmaJ2Yn7vrmZXoMGeE1PuXBVk6tfV1RLhrjzs44dnka50dRcEgZH+go/3b3A
5fHJKQVOjXVNrRMO2p+hHhuaTBaoc9Otq2UZ7WSZOU4ySWAruOZPS3p8Ntvc7ujK
PhMm8VIGhUhJtZD2ylV2u+f84SculWMUNpVNvgxGWe1uWe8xHKVN+/XqNizbZ8sw
9374sBY2bfb35OLEIcGRMWlVLJZxvUXXpB1J7zR7L6XPTbajwer3aB6zrC6uhyEC
MwCQ0QtykPT28zuYrFrtkFY+0C/LPfzZA1w3sE31kzyowMMlTkF4MPbyNXo+f32Z
3Y2ixSZkxD/eTzI5tR5asqux3cOPaWoAMf73Kyu2ZgwKThxYO6viPqT9jHFvwl+W
1e9pHbO4tkuZi2PoQvG7tbgqOFM76XHb7M67gS8GEqJtIIdA/zyllEKoPCVWvj77
Y7K74RVaoZYio6J8FD0oyxmI1m9Lli7cT8JGJ7i3/8y6AmOUxR8PmovPyAEi4Eg+
nsHUkuMf+4u/1H2bj6nObfDXQrAB1h1Ajy5EmpiLrHLt8kOTv1HeCnKNnOcTl6RS
KHLdJ/42+dNCiP4VaSbjtdEP6OwcLe2P1Fz/ZxDOZLQ0mljuNcxMktkulN2RVVE4
g34PF+LLVu0=
=BoRF
-----END PGP SIGNATURE-----