Description
The fortimon.sys device driver in Fortinet FortiClient Host Security 3.0 MR5 Patch 3 and earlier does not properly initialize its DeviceExtension, which allows local users to access kernel memory and execute arbitrary code via a crafted request.
References
- forticlient-fortimon-privilege-escalation(40512) vdb-entry
- ADV-2008-0541 vdb-entry
- 1019415 vdb-entry
- 27776 vdb-entry
- http://www.reversemode.com/index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=47&Itemid=15
- http://kc.forticare.com/default.asp?id=3618
- 20080213 [Reversemode Advisory] February Advisories : Microsoft Word 2003 + Fortinet Forticlient mailing-list
- 3660 third-party-advisory
- 28975 third-party-advisory