Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.3264
FortiClient (Windows) - Privilege Escalation via directory traversal attack
6 July 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Forticlient
Publisher: FortiGuard
Operating System: Windows
Resolution: Patch/Upgrade
CVE Names: CVE-2021-41031
Original Bulletin:
https://fortiguard.fortinet.com/psirt/FG-IR-21-190
Comment: CVSS (Max): 7.8 CVE-2021-41031 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X)
CVSS Source: FortiGuard
Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?
vector=CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
- --------------------------BEGIN INCLUDED TEXT--------------------
FortiClient (Windows) - Privilege Escalation via directory traversal attack
IR Number : FG-IR-21-190
Date : Jul 5, 2022
Severity : High
CVSSv3 Score : 7.8
Impact : Escalation of privilege
CVE ID : CVE-2021-41031
Affected
Products : FortiClientWindows : 7.0.2, 7.0.1, 7.0.0, 6.4.6, 6.4.5, 6.4.4,
6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8,
6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2,
6.2.1, 6.2.0
Summary
A relative path traversal vulnerability [CWE-23] in FortiClient for Windows may
allow a local unprivileged attacker to escalate their privileges to SYSTEM via
the named pipe responsible for FortiESNAC service.
Affected Products
FortiClientWindows version 7.0.0 through 7.0.2
FortiClientWindows version 6.4.0 through 6.4.6
FortiClientWindows version 6.2.0 through 6.2.9
Solutions
Please upgrade to FortiClientWindows version 7.0.3 or above
Please upgrade to FortiClientWindows version 6.4.7 or above
Acknowledgement
Fortinet is pleased to thank Daniel Hulliger of Armasuisse - CYD Campus for
reporting this vulnerability under responsible disclosure
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBYsUgJ8kNZI30y1K9AQj8phAAtZ2I7JVl2ShDkcZW9ZnMjGt0FhEdgtIO
brlUpGZMFAvrAntqHTXz3mDlYAouwzsNG1smKXZ47ivvg9xGOR4wnZiozqNNsY+8
XENP6cA4egy4svYOdp/fkHQO0PKJ7b+ygtucaGu9N47Etbly2woXsJP7uxzuqosV
zjpurtW1p1gk0bSt0tb/4Tn1OgPHQA61c0/MjWobdXdS+Y2GaBaD7oDRFLyTuVVW
cWjKDKIcTCRjVX9iznAtwZxuNHnHDOYxWFRGNSl2Uw1RIJmtV0yU79VAnNw5kXNT
Bxv9hnksqa/5+hb30R8SF0cI/mjS6/97fhdB9dviMzGlMtR1vdRe7ggw7iKT7M/E
HwKhpHbAAmLC+CVE6p9cvYJaHZiXh/wLV/ZvvIF5hqGQCk+M8RWRmJFn5XldKRcU
pf9fKPCOH5wXTzz6eF7Uky/ixbCxoTxmnKMBctjp+IrUdTJ/f8VVZ4tIQnWMP5Dg
I/ldtzBdk2p3Nie1IlyJUQIq94eE42amqmU/blxYDGxSEQZ3N6j5NGETr3hMlmcU
ykR3LXfRhAX+4vOAyuTLSPwfB4ysHoVDeKQ2fDJqf+8MCGaimhMS28foTNwU2Pvf
S+AM8Dnutqw7LavC8rIprnwtinOwAXsl5qFpAk4XWp2Yd/wQyAlp5E7uQVG+CjGU
/TAswXM/CRA=
=YcZN
-----END PGP SIGNATURE-----