Fortinet Rolls Out Critical Security Patches for FortiClientLinux Vulnerability

Fortinet has introduced patches to tackle a critical security flaw impacting FortiClientLinux that could be exploited to realize arbitrary code execution.

Tracked as CVE-2023-45590, the vulnerability carries a CVSS score of 9.4 out of a maximum of 10.

“An Inappropriate Control of Era of Code (‘Code Injection’) vulnerability [CWE-94] in FortiClientLinux may possibly permit an unauthenticated attacker to execute arbitrary code through tricking a FortiClientLinux user into checking out a malicious internet site,” Fortinet reported in an advisory.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The shortcoming, which has been described as a situation of remote code execution thanks to a “risky nodejs configuration,” impacts the pursuing versions –

• FortiClientLinux variations 7..3 by way of 7..4 and 7..6 via 7..10 (Improve to 7..11 or over)
• FortiClientLinux variation 7.2. (Enhance to 7.2.1 or higher than)

Security researcher CataLpa from Dbappsecurity has been credited with finding and reporting the vulnerability.

Fortinet’s security patches for April 2024 also handle an issue with FortiClientMac installer that could also guide to code execution (CVE-2023-45588 and CVE-2024-31492, CVSS scores: 7.8).

Also resolved is a FortiOS and FortiProxy bug that could leak administrator cookies in specific scenarios (CVE-2023-41677, CVSS score: 7.5).

When there is no evidence of any of the flaws being exploited in the wild, it can be suggested that customers preserve their devices up-to-date to mitigate potential threats.

Observed this post interesting? Follow us on Twitter  and LinkedIn to examine more exceptional material we post.