FortiClient Windows Service or Process Tampering
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-19-148
Final
1
1
2019-10-18T00:00:00
Current version
2019-10-18T00:00:00
2019-10-18T00:00:00
FortiClient for Windows could be subject to the following shut down or tampering attempts:a) User Interface or Command Line shut downBy default a privileged user can close the FortiClient for Windows program  b) Service or Process shut downMalicious privileged programs can stop the FortiClient for Windows process via the taskkill command c) Uninstall By default a privileged user can unintall the FortiClient for Windows program  d) Code InjectionA component of FortiClient for Windows will search a specific un-existing Windows Dynamic Link library when starting related to the programming framework used in FortiClient. A malicious and privileged program can forge that DLL, leading to arbitrary code execution.
Execute unauthorized code or commands
a) User Interface or Command Line shut downFortiClient for Windows all versions under default configurations. b) Service or Process shut downFortiClient for Windows 6.2.1 and below versions. c) Uninstall FortiClient for Windows all versions under default configurations. d) Code Injection FortiClient for Windows 6.2.0 and below versions.All of the above require the malicious program or attacker to have the same or higher level of privilege as FortiClient.
a) User Interface or Command Line Tampering FortiClient for Windows supports disabling program-closing under both managed mode and standalone mode: o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS o Standalone mode: Enablethe "Lock Settings" setting in FortiClient console b) Service or Process shut down Upgrade to FortiClient for Windows 6.2.2 c) Uninstall FortiClient for Windows supports disabling program uninstall under both managed mode and standalone mode: o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS o Standalone mode: Enable the "Lock Settings" setting in FortiClient console d) Code Injection Upgrade to FortiClient for Windows 6.2.1 Revision History: 2019-07-25 Initial release 2019-10-17 FortiClient for Windows 6.2.2 released to address issue b)
https://fortiguard.fortinet.com/psirt/FG-IR-19-148
FortiClient Windows Service or Process Tampering
https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself
https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself
Fortinet is pleased to thank Edsel Valle - security researcher from NSS Labs for reporting this vulnerability under responsible disclosure.
FortiClientWindows 6.2.1
FortiClientWindows 6.2.0
FortiClientWindows 6.0.10
FortiClientWindows 6.0.9
FortiClientWindows 6.0.8
FortiClientWindows 6.0.7
FortiClientWindows 6.0.6
FortiClientWindows 6.0.5
FortiClientWindows 6.0.4
FortiClientWindows 6.0.3
FortiClientWindows 6.0.2
FortiClientWindows 6.0.1
FortiClientWindows 6.0.0
FortiClientWindows 5.6.6
FortiClientWindows 5.6.5
FortiClientWindows 5.6.4
FortiClientWindows 5.6.3
FortiClientWindows 5.6.2
FortiClientWindows 5.6.1
FortiClientWindows 5.6.0
FortiClient Windows Service or Process Tampering
CVE-2019-6692
FortiClientWindows-6.2.1
FortiClientWindows-6.2.0
FortiClientWindows-6.0.10
FortiClientWindows-6.0.9
FortiClientWindows-6.0.8
FortiClientWindows-6.0.7
FortiClientWindows-6.0.6
FortiClientWindows-6.0.5
FortiClientWindows-6.0.4
FortiClientWindows-6.0.3
FortiClientWindows-6.0.2
FortiClientWindows-6.0.1
FortiClientWindows-6.0.0
FortiClientWindows-5.6.6
FortiClientWindows-5.6.5
FortiClientWindows-5.6.4
FortiClientWindows-5.6.3
FortiClientWindows-5.6.2
FortiClientWindows-5.6.1
FortiClientWindows-5.6.0
6.2
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X
https://fortiguard.fortinet.com/psirt/FG-IR-19-148
FortiClient Windows Service or Process Tampering
Reference>
https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself
https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself