CVE-2015-5737
First published: Thu Sep 03 2015(Updated: )
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, (4) mdare64_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do not properly restrict access to the API for management of processes and the Windows registry, which allows local users to obtain a privileged handle to a PID and possibly have unspecified other impact, as demonstrated by a 0x2220c8 ioctl call.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiClient Virtual Private Network | <=5.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient
- http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html
- http://seclists.org/fulldisclosure/2015/Sep/0
- http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities
- http://www.fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient
- http://www.securityfocus.com/archive/1/536369/100/0/threaded
- http://www.securitytracker.com/id/1033439
Frequently Asked Questions
What is the severity of CVE-2015-5737?
CVE-2015-5737 is rated as a high severity vulnerability due to its potential to allow local users elevated privileges.
How do I fix CVE-2015-5737?
To fix CVE-2015-5737, update Fortinet FortiClient to version 5.2.4 or later.
What vulnerabilities are associated with CVE-2015-5737?
CVE-2015-5737 is associated with vulnerabilities in the Fortinet FortiClient drivers that improperly restrict access to process and registry management APIs.
Who is affected by CVE-2015-5737?
Any local user on systems running Fortinet FortiClient versions up to 5.2.3 is potentially affected by CVE-2015-5737.
What are the potential impacts of CVE-2015-5737?
The potential impacts of CVE-2015-5737 include unauthorized access to sensitive system processes and the Windows registry.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortinet forticlient virtual private network
- version/fortinet forticlient virtual private network/5.2.3