CVE-2015-5737: High severity fortinet forticlient virtual private network vulnerability
The (1) mdare6448.sys, (2) mdare3248.sys, (3) mdare3252.sys, (4) mdare6452.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do not properly restrict access to the API for management of processes and the Windows registry, which allows local users to obtain a privileged handle to a PID and possibly have unspecified other impact, as demonstrated by a 0x2220c8 ioctl call.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5737?
CVE-2015-5737 is rated as a high severity vulnerability due to its potential to allow local users elevated privileges.
How do I fix CVE-2015-5737?
To fix CVE-2015-5737, update Fortinet FortiClient to version 5.2.4 or later.
What vulnerabilities are associated with CVE-2015-5737?
CVE-2015-5737 is associated with vulnerabilities in the Fortinet FortiClient drivers that improperly restrict access to process and registry management APIs.
Who is affected by CVE-2015-5737?
Any local user on systems running Fortinet FortiClient versions up to 5.2.3 is potentially affected by CVE-2015-5737.
What are the potential impacts of CVE-2015-5737?
The potential impacts of CVE-2015-5737 include unauthorized access to sensitive system processes and the Windows registry.