CVE-2015-5737
HighSummary
The mdare64_48.sys, mdare32_48.sys, mdare32_52.sys, mdare64_52.sys, and Fortishield.sys drivers in Fortinet FortiClient before version 5.2.4 do not properly restrict access to the API for management of processes and the Windows registry. This allows local users to obtain a privileged handle to a PID and possibly have unspecified other impact.
Risk Assessment
Local users may gain access to sensitive system resources, potentially leading to privilege escalation and security breaches within the organization.
Recommendation
It is recommended to update FortiClient to version 5.2.4 or later to mitigate this vulnerability and restrict access to the process and registry management API.
Other vulnerabilities in Fortinet FortiClient
See all- CVE-2015-5736High
The Fortishield.sys driver in Fortinet FortiClient before version 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in ioctl calls 0x220024 or 0x220028.
- CVE-2015-5735High
The mdare64_48.sys, mdare32_48.sys, mdare32_52.sys, and mdare64_52.sys drivers in Fortinet FortiClient before version 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
Original NVD description (English source)
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, (4) mdare64_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do not properly restrict access to the API for management of processes and the Windows registry, which allows local users to obtain a privileged handle to a PID and possibly have unspecified other impact, as demonstrated by a 0x2220c8 ioctl call.