PSIRT Advisory

FortiClient for Windows Insecure Temporary File vulnerability

Summary

An Insecure Temporary File (CWE-377) vulnerability in FortiClient for Windows may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.

Impact

Improper Access Control, Privilege Escalation

Affected Products

FortiClient for Windows 6.2.1 and below

Solutions

Please upgrade to FortiClient for Windows version 6.2.2 or above

Acknowledgement

Fortinet is pleased to thank Lasse Trolle Borup of Danish Cyber Defence for reporting this issue under responsible disclosure.