The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local...

Vulnerability Description

The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.

References

• http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities
• https://www.exploit-db.com/exploits/41722/
• http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html
• https://www.exploit-db.com/exploits/45149/
• http://www.securitytracker.com/id/1033439
• http://www.fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient
• https://www.exploit-db.com/exploits/41721/
• http://www.securityfocus.com/archive/1/536369/100/0/threaded
• http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient
• http://seclists.org/fulldisclosure/2015/Sep/0