FortiClient Windows Service or Process Tampering

Summary

FortiClient for Windows could be subject to the following shut down or tampering attempts:

a) User Interface or Command Line shut down

By default a privileged user can close the FortiClient for Windows program 

 

b) Service or Process shut down

Malicious privileged programs can stop the FortiClient for Windows process via the taskkill command

 

c) Uninstall 

By default a privileged user can unintall the FortiClient for Windows program 

 

d) Code Injection

A component of FortiClient for Windows will search a specific un-existing Windows Dynamic Link library when starting related to the programming framework used in FortiClient. A malicious and privileged program can forge that DLL, leading to arbitrary code execution.

Affected Products

a) User Interface or Command Line shut down
FortiClient for Windows all versions under default configurations.
b) Service or Process shut down
FortiClient for Windows 6.2.1 and below versions.
c) Uninstall
FortiClient for Windows all versions under default configurations.
d) Code Injection
FortiClient for Windows 6.2.0 and below versions.
All of the above require the malicious program or attacker to have the same or higher level of privilege as FortiClient.

Solutions

a) User Interface or Command Line Tampering FortiClient for Windows supports disabling program-closing under both managed mode and standalone mode: o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS o Standalone mode: Enablethe "Lock Settings" setting in FortiClient console b) Service or Process shut down Upgrade to FortiClient for Windows 6.2.2 c) Uninstall FortiClient for Windows supports disabling program uninstall under both managed mode and standalone mode: o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS o Standalone mode: Enable the "Lock Settings" setting in FortiClient console d) Code Injection Upgrade to FortiClient for Windows 6.2.1 Revision History: 2019-07-25 Initial release 2019-10-17 FortiClient for Windows 6.2.2 released to address issue b)

Acknowledgement

Fortinet is pleased to thank Edsel Valle - security researcher from NSS Labs for reporting this vulnerability under responsible disclosure.

References

• https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself