PSIRT Advisories

FortiClient (Windows) - Privilege Escalation via directory traversal attack

Summary

A relative path traversal vulnerability [CWE-23] in FortiClient for Windows may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service. 

Affected Products

FortiClientWindows version 7.0.0 through 7.0.2
FortiClientWindows version 6.4.0 through 6.4.6
FortiClientWindows 6.2 all versions

Solutions

Please upgrade to FortiClientWindows version 7.0.3 or above
Please upgrade to FortiClientWindows version 6.4.7 or above

Acknowledgement

Fortinet is pleased to thank Daniel Hulliger of Armasuisse - CYD Campus for reporting this vulnerability under responsible disclosure