PSIRT Advisory
FortiClient for Windows Insecure Temporary File vulnerability
Summary
An Insecure Temporary File (CWE-377) vulnerability in FortiClient for Windows may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
Impact
Improper Access Control, Privilege Escalation
Affected Products
FortiClient for Windows 6.2.1 and below
Solutions
Please upgrade to FortiClient for Windows version 6.2.2 or above
Acknowledgement
Fortinet is pleased to thank Lasse Trolle Borup of Danish Cyber Defence for reporting this issue under responsible disclosure.