FG-IR-21-022: [FortiClientMac] Privilege escalation using installer/uninstaller binaries (Improper Symlink following)
A UNIX symbolic link (Symlink) Following (CWE-61) vulnerability in FortiClient for MacOS may allow a local and unprivileged user to overwrite privileged shell scripts executed during the installation phase via escalating their privileges to root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-21-022?
FG-IR-21-022 is considered a moderate severity vulnerability due to its potential for privilege escalation.
How do I fix FG-IR-21-022?
To fix FG-IR-21-022, ensure you update FortiClient for MacOS to the latest version that addresses this symlink vulnerability.
Who is affected by FG-IR-21-022?
FG-IR-21-022 affects local and unprivileged users of FortiClient for MacOS who can exploit the symlink vulnerability.
What can an attacker do with FG-IR-21-022?
An attacker exploiting FG-IR-21-022 can overwrite privileged shell scripts during installation, potentially gaining root privileges.
Is there a workaround for FG-IR-21-022?
Currently, the recommended approach for FG-IR-21-022 is to apply the software update rather than seeking workarounds.