|
|
| |
| A local format string vulnerability was discovered within FortiClient version 3.0.614 VPN .The vulnerability is due to improper processing of format strings specifiers within the VPN connection name. When special crafted format strings are entered as the VPN connection name and the connection is initiated the format string vulnerability is triggered. Making it possible to read and write arbitrary memory at System level. |
| |
Credit:
The information has been provided by Deral Heiland.
|
| |
Vulnerable Systems:
* FortiClient version 3.0.61
Immune Systems:
* FortiClient version 3.0 MR7 Patch Release 6
Disclosure Timeline:
02/02/2009 - Reported Vulnerability to Vendor.
02/03/2009 - Vendor acknowledged the vulnerability
03/13/2009 - Vendor published fix
|
|
|
