Detections
Analytics
Fortinet FortiClient Host Security fortimon.sys Crafted Request Local Privilege Escalation
high Nessus Plugin ID 31347
Synopsis
The remote Windows host contains a device driver that is affected by a local privilege escalation vulnerability.Description
FortiClient is installed on the remote host, providing it with a range of security-related functionality.The version of the fortimon.sys device driver installed on the remote host as part of FortiClient allows a local user to escalate his privileges by issuing a special request to the driver's device.
Solution
Upgrade to Fortinet FortiClient 3.0 MR5 Patch 4 (build 474) / 3.0 MR6 (build 534) or later.See Also
http://www.nessus.org/u?00934d7b
https://www.securityfocus.com/archive/1/archive/1/488071/100/0/threaded
Plugin Details
Severity: High
ID: 31347
File Name: forticlient_fortimon_priv_escalation.nasl
Version: 1.13
Type: local
Agent: windows
Family: Windows
Published: 3/4/2008
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:fortinet:forticlient
Required KB Items: installed_sw/FortiClient
Exploit Ease: No known exploits are available
Reference Information
CVE: CVE-2008-0779
BID: 27776