Fortinet Rolls Out Critical Security Patches for FortiClientLinux Vulnerability

Fortinet has launched patches to handle a critical security flaw impacting FortiClientLinux that could be exploited to obtain arbitrary code execution.

Tracked as CVE-2023-45590, the vulnerability carries a CVSS rating of 9.4 out of a maximum of 10.

“An Inappropriate Manage of Era of Code (‘Code Injection’) vulnerability [CWE-94] in FortiClientLinux may perhaps allow for an unauthenticated attacker to execute arbitrary code by way of tricking a FortiClientLinux user into visiting a destructive website,” Fortinet reported in an advisory.

The shortcoming, which has been explained as a circumstance of distant code execution due to a “hazardous nodejs configuration,” impacts the following variations –

• FortiClientLinux versions 7..3 by way of 7..4 and 7..6 as a result of 7..10 (Upgrade to 7..11 or previously mentioned)
• FortiClientLinux variation 7.2. (Update to 7.2.1 or previously mentioned)

Security researcher CataLpa from Dbappsecurity has been credited with discovering and reporting the vulnerability.

Fortinet’s security patches for April 2024 also deal with an issue with FortiClientMac installer that could also direct to code execution (CVE-2023-45588 and CVE-2024-31492, CVSS scores: 7.8).

Also resolved is a FortiOS and FortiProxy bug that could leak administrator cookies in sure situations (CVE-2023-41677, CVSS score: 7.5).

Though there is no proof of any of the flaws being exploited in the wild, it can be advised that people continue to keep their programs up-to-date to mitigate prospective threats.

Found this post interesting? Comply with us on Twitter  and LinkedIn to study more special content we put up.

Some parts of this article are sourced from:
thehackernews.com