Fortinet FortiClient SSLVPN CVE-2016-8496 Remote Code Execution Vulnerability

Bugtraq ID:	98738
Class:	Unknown
CVE:	CVE-2016-8496
Remote:	Yes
Local:	No
Published:	Apr 05 2017 12:00AM
Updated:	Apr 05 2017 12:00AM
Credit:	Grzegorz Wrobel of STMSolutions.
Vulnerable:	Fortinet Fortios 5.4.2 Fortinet Fortios 5.4.1 Fortinet Fortios 5.2.11 Fortinet Fortios 5.2.8 Fortinet Fortios 5.2.6 Fortinet Fortios 5.2.5 Fortinet Fortios 5.2.4 Fortinet Fortios 5.2.3 Fortinet Fortios 5.2.2 Fortinet Fortios 5.2.1 Fortinet Fortios 5.0.13 Fortinet Fortios 5.0.9 Fortinet Fortios 5.0.8 Fortinet Fortios 5.0.7 Fortinet FortiOS 5.0.3 Fortinet FortiOS 5.0.2 Fortinet FortiOS 5.0.1 Fortinet Fortios 4.7.7 Fortinet Fortios 4.3.19 Fortinet Fortios 4.3.17 Fortinet Fortios 4.3.15 Fortinet FortiOS 4.3.10 Fortinet Fortios 4.3.9 Fortinet FortiOS 4.3.8 Fortinet Fortios 4.3 Fortinet Fortios 4.2.13 Fortinet Fortios 4.2.12 Fortinet Fortios 4.1.11 Fortinet Fortios 4.1.10 Fortinet FortiOS 3.0 Fortinet FortiOS 2.80 Fortinet FortiOS 2.50 Fortinet FortiOS 2.36 Fortinet Fortios 5.4.0 Fortinet Fortios 5.2.9 Fortinet Fortios 5.2.10 Fortinet Fortios 5.2.0 Fortinet Fortios 5.0.6 Fortinet FortiOS 5.0.5 Fortinet Fortios 5.0.4 Fortinet Fortios 5.0.12 Fortinet Fortios 5.0.11 Fortinet Fortios 5.0.0 Fortinet Fortios 4.3.18 Fortinet Fortios 4.3.16 Fortinet FortiOS 4.3.14 Fortinet FortiOS 4.3.13 Fortinet FortiOS 4.3.12
Not Vulnerable:	Fortinet Fortios 5.4.3

Fortinet FortiClient SSLVPN CVE-2016-8496 Remote Code Execution Vulnerability

Fortinet FortiClient SSLVPN is prone to a remote code-execution vulnerability.

An attacker can leverage this issue to execute arbitrary code in the context of affected application. Failed attempts may lead to denial-of-service conditions.

Versions prior to FortiClient SSLVPN with FortiOS 5.4.3 are vulnerable.

Fortinet FortiClient SSLVPN CVE-2016-8496 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Fortinet FortiClient SSLVPN CVE-2016-8496 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Fortinet FortiClient SSLVPN CVE-2016-8496 Remote Code Execution Vulnerability

References:

• Fortinet Homepage (Fortinet)
  
• FG-IR-16-069: FortiClient SSLVPN Linux - Arbitrary write to log file (Fortinet)