PSIRT Advisories

FortiClient Windows Service or Process Tampering

Summary

FortiClient for Windows could be subject to the following shut down or tampering attempts:

a) User Interface or Command Line shut down

By default a privileged user can close the FortiClient for Windows program 

 

b) Service or Process shut down

Malicious privileged programs can stop the FortiClient for Windows process via the taskkill command

 

c) Uninstall 

By default a privileged user can unintall the FortiClient for Windows program 

 

d) Code Injection

A component of FortiClient for Windows will search a specific un-existing Windows Dynamic Link library when starting related to the programming framework used in FortiClient. A malicious and privileged program can forge that DLL, leading to arbitrary code execution.

Affected Products

a) User Interface or Command Line shut down

FortiClient for Windows all versions under default configurations.

 

b) Service or Process shut down

FortiClient for Windows 6.2.1 and below versions.

 

c) Uninstall 

FortiClient for Windows all versions under default configurations.

 

d) Code Injection 

FortiClient for Windows 6.2.0 and below versions.

All of the above require the malicious program or attacker to have the same or higher level of privilege as FortiClient.

Solutions

a) User Interface or Command Line Tampering

FortiClient for Windows supports disabling program-closing  under both managed mode and standalone mode:

o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS

o Standalone mode: Enablethe "Lock Settings" setting in FortiClient console

 

b) Service or Process shut down

Upgrade to FortiClient for Windows 6.2.2

 

c) Uninstall 

FortiClient for Windows supports disabling program uninstall under both managed mode and standalone mode:

o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS

o Standalone mode: Enable the "Lock Settings" setting in FortiClient console

 

d) Code Injection 

Upgrade to FortiClient for Windows 6.2.1

Revision History:
2019-07-25 Initial release
2019-10-17 FortiClient for Windows 6.2.2 released to address issue b)

Acknowledgement

Fortinet is pleased to thank Edsel Valle - security researcher from NSS Labs for reporting this vulnerability under responsible disclosure.

References

• https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself