CVE-2019-17652: Buffer Overflow
First published: Thu Feb 06 2020(Updated: )
A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under root priviledge crashes via sending specially crafted "StartAvCustomScan" type IPC client requests to the fctsched process due the argv data not been well sanitized.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet Forticlient | <=6.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this FortiClient vulnerability?
The vulnerability ID is CVE-2019-17652.
What is the severity of CVE-2019-17652?
The severity of CVE-2019-17652 is medium with a CVSS score of 6.5.
How does CVE-2019-17652 impact FortiClient for Linux?
CVE-2019-17652 may allow a user with low privilege to cause FortiClient processes running under root privilege to crash.
How can an attacker exploit CVE-2019-17652?
An attacker can exploit CVE-2019-17652 by sending specially crafted "StartAvCustomScan" type IPC client requests to the fctsched process.
Is there a fix available for CVE-2019-17652?
Yes, upgrading to FortiClient for Linux version 6.2.2 or higher resolves the vulnerability.
- collector/nvd-index
- vendor/fortinet
- canonical/fortinet forticlient
- version/fortinet forticlient/6.2.1