CVE-2019-17652: Buffer Overflow
A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under root priviledge crashes via sending specially crafted "StartAvCustomScan" type IPC client requests to the fctsched process due the argv data not been well sanitized.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this FortiClient vulnerability?
The vulnerability ID is CVE-2019-17652.
What is the severity of CVE-2019-17652?
The severity of CVE-2019-17652 is medium with a CVSS score of 6.5.
How does CVE-2019-17652 impact FortiClient for Linux?
CVE-2019-17652 may allow a user with low privilege to cause FortiClient processes running under root privilege to crash.
How can an attacker exploit CVE-2019-17652?
An attacker can exploit CVE-2019-17652 by sending specially crafted "StartAvCustomScan" type IPC client requests to the fctsched process.
Is there a fix available for CVE-2019-17652?
Yes, upgrading to FortiClient for Linux version 6.2.2 or higher resolves the vulnerability.