FortiClient for Windows Insecure Temporary File vulnerability

Summary

An Insecure Temporary File (CWE-377) vulnerability in FortiClient for Windows may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.

Affected Products

FortiClient for Windows 6.2.1 and below.
FortiClient for Windows 6.0.9 and below.

Solutions

Please upgrade to FortiClient for Windows version 6.2.2 or above Please upgrade to FortiClient for Windows version 6.0.10 or above.

Acknowledgement

Fortinet is pleased to thank Lasse Trolle Borup of Danish Cyber Defence for reporting this issue under responsible disclosure.