Ruben Santamarta has reported a vulnerability in Fortinet FortiClient, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to an error in the fortimon.sys filter driver and can be exploited to execute arbitrary code with kernel privileges via a specially crafted request to the device driver.

The vulnerability affects versions 3.0 MR5 Patch3 and prior.

Solution
Update to version 3.0 MR5 Patch 4 or version 3.0 MR6.

Provided and/or discovered by
Ruben Santamarta, Reverse Mode

Changelog
Further details available in Customer Area

Original Advisory
Fortinet:
http://kc.forticare.com/default.asp?id=3618

Reverse Mode:
http://www.reversemode.com/index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=47&Itemid=15

Deep Links
Links available in Customer Area