FortiClientEMS v7.2.6 - CVE-2024-11236 Out of Bounds Write Vulnerability

[Andrzej_PL]

Hi,

I'm testing the FortiClient EMS solution on a trial license. After updating to version 7.2.6, the system detected the PHP CVE-2024-11236 Out of Bounds Write Vulnerability. Is there a way to report this to have the vulnerable application version updated?

[sjoshi]

Hi,

Please refer:-

https://www.fortiguard.com/encyclopedia/endpoint-vuln/82436

I do not see forticlient ems is affected

[Andrzej_PL]

ok but it is scan result on ems server - version 7.2.6 is windows platform

[sjoshi]

This Forticlient is install in the wins server where EMS server is setup?

[Andrzej_PL]

exactly

[Andrzej_PL]

so... any ideas?

[dingjerry_FTNT · Accepted solution]

Hi @Andrzej_PL ,

Thanks for reporting this vulnerability.

We have this Mantis 1089768 tracking this issue.  The fix will be included in FortiClient EMS 7.2.7 GA.

[Andrzej_PL]

Hi,

unfortunately, the problem remains in the new client version 7.2.7 - the version of the php application with the given vulnerability is still used. php.exe must be in version 8.3.14, and it is in 8.3.13

[CARCAL]

Hi,

Unfortunately, the problem still remains in the new client version 7.2.11.1241 - The version of the php application with the given vulnerability is 8.3.14, as you can see below.

In the same machine with Windows Server 2022 I also have installed FortiClient EMS Console 7.2.10 build 1222 version.

[funkylicious]

maybe its time for EMS 7.4.x which runs on Ubuntu