NSS AEP: FortiClient Service or Process Tampering Disclosure

Summary

FortiClient for Windows could be subject to the following shut down or tampering attempts:
a) User Interface or Command Line shut down
By default a privileged user can close the FortiClient for Windows program
b) Service or Process shut down
Malicious privileged programs can stop the FortiClient for Windows process via the taskkill command
c) Uninstall
By default a privileged user can unintall the FortiClient for Windows program
d) Code Injection
A component of FortiClient for Windows will search for a specific un-existing Windows Dynamic Link library when starting. A malicious and privileged program can forge that DLL, leading to arbitrary code execution.

Affected Products

a) User Interface or Command Line shut down
FortiClient for Windows all versions under default configurations.
b) Service or Process shut down
FortiClient for Windows 6.2.1 and below versions.
c) Uninstall
FortiClient for Windows all versions under default configurations.
d) Code Injection
FortiClient for Windows 6.2.0 and below versions.
All of the above require the malicious program or attacker to have the same or higher level of privilege as FortiClient.

Solutions

a) User Interface or Command Line Tampering FortiClient for Windows supports disabling program-closing under both managed mode and standalone mode: o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS o Standalone mode: Enablethe "Lock Settings" setting in FortiClient console b) Service or Process shut down Upgrade to FortiClient for Windows 6.2.2 c) Uninstall FortiClient for Windows supports disabling program uninstall under both managed mode and standalone mode: o Managed mode: Enable the "Disable Unregister" setting in FortiClient EMS o Standalone mode: Enable the "Lock Settings" setting in FortiClient console d) Code Injection Upgrade to FortiClient for Windows 6.2.1 Revision History: 2019-07-25 Initial release 2019-10-17 FortiClient for Windows 6.2.2 released to address issue b)

Acknowledgement

Fortinet is pleased to thank Edsel Valle - security researcher from NSS Labs for reporting this vulnerability under responsible disclosure.

References

• https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself