Fortinet FortiClient Crafted VPN Connection Name Handling Local Format String

High Nessus Plugin ID 56049


The remote Windows host contains a security application that is affected by a local format string vulnerability.


FortiClient, a client-based software solution intended to provide security features for enterprise computers and mobile devices, is installed on the remote Windows host.

The installed version does not properly handle format string specifiers within a VPN connection name. A local user may be able to leverage this issue to read and write arbitrary memory with SYSTEM privileges.


Upgrade to Fortinet FortiClient 3.0 MR7 Patch 6 (3.0.616) or later.

See Also

Plugin Details

Severity: High

ID: 56049

File Name: forticlient_3_0_616.nasl

Version: $Revision: 1.4 $

Type: local

Agent: windows

Family: Windows

Published: 2011/09/08

Modified: 2015/04/23

Dependencies: 76534

Risk Information

Risk Factor: High


Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:fortinet:forticlient

Required KB Items: installed_sw/FortiClient

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2009/03/13

Vulnerability Publication Date: 2009/04/01

Reference Information

CVE: CVE-2009-1262

BID: 34343

OSVDB: 53266

CWE: 134