[CORE-2015-0013] - FortiClient Antivirus Multiple Vulnerabilities

[CORE Advisories Team <advisories () coresecurity com>]

1. Advisory Information

Title: FortiClient Antivirus Multiple Vulnerabilities
Advisory ID: CORE-2015-0013
Advisory URL: http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities
Date published: 2015-09-01
Date of last update: 2015-09-01
Vendors contacted: Fortinet
Release mode: Coordinated release


2. Vulnerability Information

Class: Information Exposure [CWE-200], Write-what-where Condition [CWE-123], Exposed Dangerous Method or Function 
[CWE-749], Exposed IOCTL with Insufficient Access Control [CWE-782]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2015-4077, CVE-2015-5735, CVE-2015-5736, CVE-2015-5737



3. Vulnerability Description

Fortinet FortiClient [1] extends the power of FortiGate's Unified threat management to endpoints on your network. 
Desktops, laptops, tablets and smartphones, FortiClient enables every device - local or remote, stationary or mobile - 
to integrate with your FortiGate. With no per-seat license fees, FortiClient takes the headaches out of managing 
multiple endpoints so your users and guests can work efficiently anywhere, without compromising your security.

FortiClient drivers are prone to multiple attacks and expose a wide surface that allows users to easily get SYSTEM 
privileges.


4. Vulnerable packages

FortiClient 5.2.3.633
Other versions may probably be affected too, but they were not checked.


5. Vendor Information, Solutions and Workarounds

Fortinet released an updated version of FortiClient 5.2.4.0650 [2] that fixes the reported issues.


6. Credits

These vulnerabilities were discovered and researched by Enrique Nissim from Core Security's Consulting Team. The 
publication of this advisory was coordinated by Joaquín Rodríguez Varela from Core Security's Advisories Team.



7. Technical Description / Proof of Concept Code

[CVE-2015-4077] The vulnerability lies in the drivers "mdare64_48.sys", "mdare32_48.sys", "mdare32_52.sys" and 
"mdare64_52.sys". By using the IOCTL 0x22608C with the proper parameters, an attacker is able to read arbitrary memory 
content from kernelspace.

[CVE-2015-5735] The vulnerability lies in the drivers "mdare64_48.sys", "mdare32_48.sys", "mdare32_52.sys" and 
"mdare64_52.sys". By using the IOCTL 0x226108, the attacker is able to call ZwEnumerateValueKey and write its output to 
an arbitrary memory location.

[CVE-2015-5736] The vulnerability lies in "Fortishield.sys", which is a minifilter filesystem driver that hooks 
filesystem operations. IOCTL 0x220024 and 0x220028 both allow establishing callbacks that will be called during any 
IRP_MJ_WRITE and IRP_MJ_SET_INFORMATION, respectively. Consequently, any user in the system can set an arbitrary 
function as a callback and execute code with kernel privileges.

[CVE-2015-5737] The vulnerability lies in the drivers "mdare64_48.sys", "mdare32_48.sys", "mdare32_52.sys", 
"mdare64_52.sys" and "Fortishield.sys". All of these drivers expose an API to manage processes and the Windows 
registry. For instance, the IOCTL 0x2220c8 of the "mdareXX_XX.sys" driver returns a full privileged handle to a given 
process PID. This same function is replicated inside "Fortishield.sys".



8. Report Timeline

2015-06-25: Core Security notified Fortinet of the vulnerabilities. Publication date set for July 27th, 2015.
2015-06-30: Fortinet replied that they received Core Security's email and that they would like to receive the draft 
version of the advisory.
2015-07-01: Core Security sent Fortinet the draft version of the advisory and requested a tentative schedule for 
releasing the updates.
2015-07-01: Fortinet replied that they received the draft version of the advisory and that they would review it.
2015-07-15: Core Security requested an update from Fortinet regarding the reported vulnerabilities and a tentative 
schedule.
2015-07-19: Fortinet replied and confirmed the reported bugs, but stated that they were only able to trigger them with 
administrative privileges. They requested a PoC from Core Security.
2015-07-20: Core Security replied, explaining to Fortinet that they were able to trigger the vulnerabilities as a 
non-privileged user. They sent Fortinet a PoC code that opens a handle with read/write permissions to LSASS process and 
then uses it to allocate memory in its virtual address space.
2015-07-20: Fortinet replied that they would review the PoC.
2015-07-20: Fortinet asked if Core Security researchers could review an interim build when available.
2015-07-21: Core Security confirmed that they would be willing to review an interim build when available.
2015-08-03: Core Security requested an update from Fortinet regarding the availability of the interim build, and asked 
if there was a specific date Fortinet was planning to release the fix.
2015-08-04: Fortinet replied that their current release date was August 17.
2015-08-05: Fortinet updated the schedule, explaining that the interim build wouldn't include the MDARE fixes therefore 
delaying the release until the end of August.
2015-08-07: Core Security asked Fortinet if the interim build was going to be published by Fortinet, because if so, 
that would force Core Security to publish their findings as well. If that wasn't the case, Core Security recommended 
publishing everything together later that month.
2015-08-07: Fortinet replied that the interim build was private and therefore there wasn't a need to publish ahead of 
schedule.
2015-08-10: Fortinet sent Core Security a link to download the interim build and requested feedback.
2015-08-10: Core Security replied that they received and downloaded the interim build and would send feedback. 
Additionally, Core Security requested an updated ETA.
2015-08-18: Core Security requested the specific date Fortinet would release the patched version of their product so 
they could schedule their security advisory publication accordingly.
2015-08-20: Core Security again requested for a specific date for the publication of the updates and informed Fortinet 
them that if they didn't receive and answer in the following days they would be forced to schedule the advisory 
publication.
2015-08-20: Fortinet replied that the scheduled release date for the updated version of FortiClient was August 31. They 
asked if they had an opportunity to review the interim build andif they had any feedback.
2015-08-24: Core Security replied that they were able to review the interim build and that they could confirm that 
those bugs were no longer exploitable.Core Security requested and updated ETA of the updated version.
2015-08-24: Fortinet replied that the scheduled release seemed to be confirmed and that the estimated time of 
availability would be roughly 5 p.m. Pacific Time.
9. References

[1] http://www.forticlient.com/.
[2] http://docs.fortinet.com/d/forticlient-5.2.4-windows-release-notes.pdf. 


10. About CoreLabs

CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for 
information security technologies. We conduct our research in several important areas of computer security including 
system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results 
include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. 
CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for 
public use at: http://corelabs.coresecurity.com.


11. About Core Security

Core Security enables organizations to get ahead of threats with security test and measurement solutions that 
continuously identify and demonstrate real-world exposures to their most critical assets. Our customers gain real 
visibility into their security standing, real validation of their security controls, and real metrics to more 
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading threat expertise from the 
company's Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 
399-6980 or on the Web at: http://www.coresecurity.com.


12. Disclaimer

The contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a 
Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: 
http://creativecommons.org/licenses/by-nc-sa/3.0/us/


13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at 
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/