var-201509-0287
Vulnerability from variot

The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call. FortiClient is prone to a local privilege-escalation vulnerability. Fortinet FortiClient is a mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. 1. Advisory Information

Title: FortiClient Antivirus Multiple Vulnerabilities Advisory ID: CORE-2015-0013 Advisory URL: http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities Date published: 2015-09-01 Date of last update: 2015-09-01 Vendors contacted: Fortinet Release mode: Coordinated release

  1. Vulnerability Information

Class: Information Exposure [CWE-200], Write-what-where Condition [CWE-123], Exposed Dangerous Method or Function [CWE-749], Exposed IOCTL with Insufficient Access Control [CWE-782] Impact: Code execution Remotely Exploitable: No Locally Exploitable: Yes CVE Name: CVE-2015-4077, CVE-2015-5735, CVE-2015-5736, CVE-2015-5737

  1. Vulnerability Description

Fortinet FortiClient [1] extends the power of FortiGate's Unified threat management to endpoints on your network. Desktops, laptops, tablets and smartphones, FortiClient enables every device - local or remote, stationary or mobile - to integrate with your FortiGate. With no per-seat license fees, FortiClient takes the headaches out of managing multiple endpoints so your users and guests can work efficiently anywhere, without compromising your security.

FortiClient drivers are prone to multiple attacks and expose a wide surface that allows users to easily get SYSTEM privileges.

  1. Vulnerable packages

FortiClient 5.2.3.633 Other versions may probably be affected too, but they were not checked.

  1. Vendor Information, Solutions and Workarounds

Fortinet released an updated version of FortiClient 5.2.4.0650 [2] that fixes the reported issues.

  1. Credits

These vulnerabilities were discovered and researched by Enrique Nissim from Core Security's Consulting Team. The publication of this advisory was coordinated by Joaquín Rodríguez Varela from Core Security's Advisories Team.

  1. Technical Description / Proof of Concept Code

[CVE-2015-4077] The vulnerability lies in the drivers "mdare64_48.sys", "mdare32_48.sys", "mdare32_52.sys" and "mdare64_52.sys". By using the IOCTL 0x22608C with the proper parameters, an attacker is able to read arbitrary memory content from kernelspace. By using the IOCTL 0x226108, the attacker is able to call ZwEnumerateValueKey and write its output to an arbitrary memory location.

[CVE-2015-5736] The vulnerability lies in "Fortishield.sys", which is a minifilter filesystem driver that hooks filesystem operations. IOCTL 0x220024 and 0x220028 both allow establishing callbacks that will be called during any IRP_MJ_WRITE and IRP_MJ_SET_INFORMATION, respectively. All of these drivers expose an API to manage processes and the Windows registry. For instance, the IOCTL 0x2220c8 of the "mdareXX_XX.sys" driver returns a full privileged handle to a given process PID. This same function is replicated inside "Fortishield.sys".

  1. Report Timeline

2015-06-25: Core Security notified Fortinet of the vulnerabilities. Publication date set for July 27th, 2015. 2015-06-30: Fortinet replied that they received Core Security's email and that they would like to receive the draft version of the advisory. 2015-07-01: Core Security sent Fortinet the draft version of the advisory and requested a tentative schedule for releasing the updates. 2015-07-01: Fortinet replied that they received the draft version of the advisory and that they would review it. 2015-07-15: Core Security requested an update from Fortinet regarding the reported vulnerabilities and a tentative schedule. 2015-07-19: Fortinet replied and confirmed the reported bugs, but stated that they were only able to trigger them with administrative privileges. They requested a PoC from Core Security. 2015-07-20: Core Security replied, explaining to Fortinet that they were able to trigger the vulnerabilities as a non-privileged user. They sent Fortinet a PoC code that opens a handle with read/write permissions to LSASS process and then uses it to allocate memory in its virtual address space. 2015-07-20: Fortinet replied that they would review the PoC. 2015-07-20: Fortinet asked if Core Security researchers could review an interim build when available. 2015-07-21: Core Security confirmed that they would be willing to review an interim build when available. 2015-08-03: Core Security requested an update from Fortinet regarding the availability of the interim build, and asked if there was a specific date Fortinet was planning to release the fix. 2015-08-04: Fortinet replied that their current release date was August 17. 2015-08-05: Fortinet updated the schedule, explaining that the interim build wouldn't include the MDARE fixes therefore delaying the release until the end of August. 2015-08-07: Core Security asked Fortinet if the interim build was going to be published by Fortinet, because if so, that would force Core Security to publish their findings as well. If that wasn't the case, Core Security recommended publishing everything together later that month. 2015-08-07: Fortinet replied that the interim build was private and therefore there wasn't a need to publish ahead of schedule. 2015-08-10: Fortinet sent Core Security a link to download the interim build and requested feedback. 2015-08-10: Core Security replied that they received and downloaded the interim build and would send feedback. Additionally, Core Security requested an updated ETA. 2015-08-18: Core Security requested the specific date Fortinet would release the patched version of their product so they could schedule their security advisory publication accordingly. 2015-08-20: Core Security again requested for a specific date for the publication of the updates and informed Fortinet them that if they didn't receive and answer in the following days they would be forced to schedule the advisory publication. 2015-08-20: Fortinet replied that the scheduled release date for the updated version of FortiClient was August 31. They asked if they had an opportunity to review the interim build andif they had any feedback. 2015-08-24: Core Security replied that they were able to review the interim build and that they could confirm that those bugs were no longer exploitable.Core Security requested and updated ETA of the updated version. 2015-08-24: Fortinet replied that the scheduled release seemed to be confirmed and that the estimated time of availability would be roughly 5 p.m. Pacific Time. 9. References

[1] http://www.forticlient.com/. [2] http://docs.fortinet.com/d/forticlient-5.2.4-windows-release-notes.pdf.

  1. About CoreLabs

CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.

  1. About Core Security

Core Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.

  1. Disclaimer

The contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

  1. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201509-0287",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "forticlient",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "fortinet",
        "version": "5.2.3"
      },
      {
        "model": "forticlient",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "fortinet",
        "version": "5.2.4"
      },
      {
        "model": "forticlient",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "fortinet",
        "version": "5.2.3"
      },
      {
        "model": "forticlient",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "fortinet",
        "version": "5.2.3.633"
      },
      {
        "model": "forticlient",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "fortinet",
        "version": "5.2.4.0650"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "76542"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:fortinet:forticlient",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Enrique Nissim",
    "sources": [
      {
        "db": "BID",
        "id": "76542"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-5736",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2015-5736",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-83697",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-5736",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-5736",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201509-021",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-83697",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2015-5736",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call. FortiClient is prone to a local privilege-escalation vulnerability. Fortinet FortiClient is a mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. 1. Advisory Information\n\nTitle: FortiClient Antivirus Multiple Vulnerabilities\nAdvisory ID: CORE-2015-0013\nAdvisory URL: http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities\nDate published: 2015-09-01\nDate of last update: 2015-09-01\nVendors contacted: Fortinet\nRelease mode: Coordinated release\n\n\n2. Vulnerability Information\n\nClass: Information Exposure [CWE-200], Write-what-where Condition [CWE-123], Exposed Dangerous Method or Function [CWE-749], Exposed IOCTL with Insufficient Access Control [CWE-782]\nImpact: Code execution\nRemotely Exploitable: No\nLocally Exploitable: Yes\nCVE Name: CVE-2015-4077, CVE-2015-5735, CVE-2015-5736, CVE-2015-5737\n\n\n\n3. Vulnerability Description\n\nFortinet FortiClient [1] extends the power of FortiGate\u0027s Unified threat management to endpoints on your network. Desktops, laptops, tablets and smartphones, FortiClient enables every device - local or remote, stationary or mobile - to integrate with your FortiGate. With no per-seat license fees, FortiClient takes the headaches out of managing multiple endpoints so your users and guests can work efficiently anywhere, without compromising your security. \n\nFortiClient drivers are prone to multiple attacks and expose a wide surface that allows users to easily get SYSTEM privileges. \n\n\n4. Vulnerable packages\n\nFortiClient 5.2.3.633\nOther versions may probably be affected too, but they were not checked. \n\n\n5. Vendor Information, Solutions and Workarounds\n\nFortinet released an updated version of FortiClient 5.2.4.0650 [2] that fixes the reported issues. \n\n\n6. Credits\n\nThese vulnerabilities were discovered and researched by Enrique Nissim from Core Security\u0027s Consulting Team. The publication of this advisory was coordinated by Joaqu\u00edn Rodr\u00edguez Varela from Core Security\u0027s Advisories Team. \n\n\n\n7. Technical Description / Proof of Concept Code\n\n[CVE-2015-4077] The vulnerability lies in the drivers \"mdare64_48.sys\", \"mdare32_48.sys\", \"mdare32_52.sys\" and \"mdare64_52.sys\". By using the IOCTL 0x22608C with the proper parameters, an attacker is able to read arbitrary memory content from kernelspace. By using the IOCTL 0x226108, the attacker is able to call ZwEnumerateValueKey and write its output to an arbitrary memory location. \n\n[CVE-2015-5736] The vulnerability lies in \"Fortishield.sys\", which is a minifilter filesystem driver that hooks filesystem operations. IOCTL 0x220024 and 0x220028 both allow establishing callbacks that will be called during any IRP_MJ_WRITE and IRP_MJ_SET_INFORMATION, respectively. All of these drivers expose an API to manage processes and the Windows registry. For instance, the IOCTL 0x2220c8 of the \"mdareXX_XX.sys\" driver returns a full privileged handle to a given process PID. This same function is replicated inside \"Fortishield.sys\". \n\n\n\n8. Report Timeline\n\n2015-06-25: Core Security notified Fortinet of the vulnerabilities. Publication date set for July 27th, 2015. \n2015-06-30: Fortinet replied that they received Core Security\u0027s email and that they would like to receive the draft version of the advisory. \n2015-07-01: Core Security sent Fortinet the draft version of the advisory and requested a tentative schedule for releasing the updates. \n2015-07-01: Fortinet replied that they received the draft version of the advisory and that they would review it. \n2015-07-15: Core Security requested an update from Fortinet regarding the reported vulnerabilities and a tentative schedule. \n2015-07-19: Fortinet replied and confirmed the reported bugs, but stated that they were only able to trigger them with administrative privileges. They requested a PoC from Core Security. \n2015-07-20: Core Security replied, explaining to Fortinet that they were able to trigger the vulnerabilities as a non-privileged user. They sent Fortinet a PoC code that opens a handle with read/write permissions to LSASS process and then uses it to allocate memory in its virtual address space. \n2015-07-20: Fortinet replied that they would review the PoC. \n2015-07-20: Fortinet asked if Core Security researchers could review an interim build when available. \n2015-07-21: Core Security confirmed that they would be willing to review an interim build when available. \n2015-08-03: Core Security requested an update from Fortinet regarding the availability of the interim build, and asked if there was a specific date Fortinet was planning to release the fix. \n2015-08-04: Fortinet replied that their current release date was August 17. \n2015-08-05: Fortinet updated the schedule, explaining that the interim build wouldn\u0027t include the MDARE fixes therefore delaying the release until the end of August. \n2015-08-07: Core Security asked Fortinet if the interim build was going to be published by Fortinet, because if so, that would force Core Security to publish their findings as well. If that wasn\u0027t the case, Core Security recommended publishing everything together later that month. \n2015-08-07: Fortinet replied that the interim build was private and therefore there wasn\u0027t a need to publish ahead of schedule. \n2015-08-10: Fortinet sent Core Security a link to download the interim build and requested feedback. \n2015-08-10: Core Security replied that they received and downloaded the interim build and would send feedback. Additionally, Core Security requested an updated ETA. \n2015-08-18: Core Security requested the specific date Fortinet would release the patched version of their product so they could schedule their security advisory publication accordingly. \n2015-08-20: Core Security again requested for a specific date for the publication of the updates and informed Fortinet them that if they didn\u0027t receive and answer in the following days they would be forced to schedule the advisory publication. \n2015-08-20: Fortinet replied that the scheduled release date for the updated version of FortiClient was August 31. They asked if they had an opportunity to review the interim build andif they had any feedback. \n2015-08-24: Core Security replied that they were able to review the interim build and that they could confirm that those bugs were no longer exploitable.Core Security requested and updated ETA of the updated version. \n2015-08-24: Fortinet replied that the scheduled release seemed to be confirmed and that the estimated time of availability would be roughly 5 p.m. Pacific Time. \n9. References\n\n[1] http://www.forticlient.com/. \n[2] http://docs.fortinet.com/d/forticlient-5.2.4-windows-release-notes.pdf. \n\n\n10. About CoreLabs\n\nCoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. \n\n\n11. About Core Security\n\nCore Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted research and leading threat expertise from the company\u0027s Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. \n\n\n12. Disclaimer\n\nThe contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n13. PGP/GPG Keys\n\nThis advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "BID",
        "id": "76542"
      },
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "db": "PACKETSTORM",
        "id": "133398"
      }
    ],
    "trust": 2.16
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=41722",
        "trust": 0.3,
        "type": "exploit"
      },
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-83697",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-5736",
        "trust": 3.0
      },
      {
        "db": "SECTRACK",
        "id": "1033439",
        "trust": 1.8
      },
      {
        "db": "PACKETSTORM",
        "id": "133398",
        "trust": 1.3
      },
      {
        "db": "EXPLOIT-DB",
        "id": "41722",
        "trust": 1.2
      },
      {
        "db": "EXPLOIT-DB",
        "id": "45149",
        "trust": 1.2
      },
      {
        "db": "EXPLOIT-DB",
        "id": "41721",
        "trust": 1.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021",
        "trust": 0.7
      },
      {
        "db": "BID",
        "id": "76542",
        "trust": 0.4
      },
      {
        "db": "VULHUB",
        "id": "VHN-83697",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "db": "BID",
        "id": "76542"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "PACKETSTORM",
        "id": "133398"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "id": "VAR-201509-0287",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:43:56.165000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Mulitple Vulnerabilities in FortiClient",
        "trust": 0.8,
        "url": "http://www.fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient"
      },
      {
        "title": "Fortinet FortiClient Fixes for permission permissions and access control vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61028"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Ministrex/osee "
      },
      {
        "title": "OSEE",
        "trust": 0.1,
        "url": "https://github.com/gscamelo/OSEE "
      },
      {
        "title": "IT-O",
        "trust": 0.1,
        "url": "https://github.com/buddyeatsbugs/IT-O "
      },
      {
        "title": "EXP-401-Preparation",
        "trust": 0.1,
        "url": "https://github.com/Exploitables/EXP-401-Preparation "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities"
      },
      {
        "trust": 1.8,
        "url": "http://www.fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1033439"
      },
      {
        "trust": 1.3,
        "url": "https://www.exploit-db.com/exploits/41722/"
      },
      {
        "trust": 1.2,
        "url": "http://www.securityfocus.com/archive/1/536369/100/0/threaded"
      },
      {
        "trust": 1.2,
        "url": "http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient"
      },
      {
        "trust": 1.2,
        "url": "https://www.exploit-db.com/exploits/41721/"
      },
      {
        "trust": 1.2,
        "url": "https://www.exploit-db.com/exploits/45149/"
      },
      {
        "trust": 1.2,
        "url": "http://seclists.org/fulldisclosure/2015/sep/0"
      },
      {
        "trust": 1.2,
        "url": "http://packetstormsecurity.com/files/133398/forticlient-antivirus-information-exposure-access-control.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5736"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5736"
      },
      {
        "trust": 0.3,
        "url": "http://www.forticlient.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.fortinet.com/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/264.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/gscamelo/osee"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-4077"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
      },
      {
        "trust": 0.1,
        "url": "http://www.forticlient.com/."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5735"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5737"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5736"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "http://docs.fortinet.com/d/forticlient-5.2.4-windows-release-notes.pdf."
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "db": "BID",
        "id": "76542"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "PACKETSTORM",
        "id": "133398"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "db": "BID",
        "id": "76542"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "db": "PACKETSTORM",
        "id": "133398"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-09-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "date": "2015-09-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "date": "2015-09-01T00:00:00",
        "db": "BID",
        "id": "76542"
      },
      {
        "date": "2015-09-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "date": "2015-09-02T06:55:53",
        "db": "PACKETSTORM",
        "id": "133398"
      },
      {
        "date": "2015-09-07T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "date": "2015-09-03T14:59:06.647000",
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-83697"
      },
      {
        "date": "2018-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-5736"
      },
      {
        "date": "2015-09-01T00:00:00",
        "db": "BID",
        "id": "76542"
      },
      {
        "date": "2015-09-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      },
      {
        "date": "2015-09-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      },
      {
        "date": "2024-11-21T02:33:44.527000",
        "db": "NVD",
        "id": "CVE-2015-5736"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "BID",
        "id": "76542"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      }
    ],
    "trust": 0.9
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Fortinet FortiClient of  Fortishield.sys Vulnerability to execute arbitrary code in driver",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004585"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-021"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.