Fortinet opublikował aktualizacje dla oprogramowania FortiClient o oznaczeniu 6.4.2. Nowa aktualizacja usprawniła wiele procesów jak i zarówno skorygowała wcześniejsze błędy.  Z ważniejszych problemów został usunięty błąd dotyczący rejestracji FortiClienta przez FortiClouda, gdzie system Windows nie był aktualny. Komunikacja pomiędzy FortiClient a EMS została poprawiona, jak i zarówno łączenie za pomocą SSL-VPN. W tunelu VPN występowało wiele problemów, takich jak automatyczne rozłączenie lub błąd z zapisywaniem haseł do tunelu. Problem związany z Windowsem, gdzie ulegał awarii z powodu procesu fortips.sys, został naprawiony i nie ma już problemów z tym. Po więcej informacji, zapraszam do dalszej części artykułu.

Rozwiązane problemy:

GUI

Bug ID	Description
667351	FortiClient (Windows) reports unlicensed VPN access is available until year 2106 after FortiClient free VPN license expires.
668202	Remove application control from GUI.
670848	FortiClient (Windows) hides Remote Access tab if user uses EMS-generated forticlient.msi and forticlient.mst for installation.
681751	Japanese localization update.

Install and deployment

Bug ID	Description
641680	update_task.exe in FortiClient Single Sign On standalone installation folder.
659461	Add support for upgrade to 6.4.2.
672658	Reboot loop when upgrading FortiClient.

Endpoint control

Bug ID	Description
573979	FortiClient does not register to FortiClient Cloud when Windows is outdated.
615280	FortiClient (Windows) shows dynamic IP address first in record list but ultimately changes to PC Ethernet IP address.
635068	FortiClient (Windows) should not send user information in each keepalive (KA).
657208	EMS fails to push assigned on-fabric detection rules to endpoint.
660860	Connection key prompt appears if client reboots before enabling key in EMS.
661056	FortiClient (Windows) does not import registration keys from configuration files.
661107	FortiClient (Windows) sends avatar every KA.
661436	FortiESNAC is stuck syncing.
661436	FortiESNAC gets stuck syncing.
661668	FortiClient does not send correct encoding to EMS.
666649	FortiClient (Windows) stops EMS registration attempts when EMS is unreachable.
667269	FortiClient (Windows) fails to match the exact group with the defined Active Directory (AD) group under Zero Trust tagging rules.
670671	Diacritics show incorrectly in endpoint summary detail in EMS.
672914	FortiClient endpoint control issues affect EMS performance.
674300	Incorrect and duplicate NWIFS values.

Logs

Bug ID	Description
662803	Not normalized AV engine and signature versions separated logs fields.
666410	Some clients do not generate endpoint control log for FortiAnalyzer.
681265	Endpoint does not send updated user information to EMS.

Application Firewall

Bug ID	Description
670029	Firewall alerts are incorrectly formatted.
681606	Actions in Japanese.

Malware Protection and Sandbox

Bug ID	Description
595951	FortiSandbox does not send username to Sandbox server.
643118	fcaptmon crashes when reading certain files.
647960	FortiClient fails to detect AV signature is updated rule with McAfee.
651329	Ransomware uses script to render FortiClient (Windows) unusable.
653714	AntiExploit event shows under antivirus events.
655366	Sandbox inspection does not work with Microsoft Edge.
668098	Antiransomware fails to work after timeout.

Remote Access

Bug ID	Description
522348	IPsec VPN IKEv2 does not disconnect when wi-fi is not connected.
537299	FortiClient (Windows) does not use correct SSL VPN split DNS server.
646886	exclusive-routing in vpn.ssl.settings does not work.
647400	FortiClient does not show username and other information when using certificate authentication.
647645	Password renewal breaks if the new password contains Unicode characters.
648876	When connecting VPN before logon, tunnel that requires certificate and configured with certificate filter fails to connect.
650009	IPv6 route that IPsec VPN pushes has higher metric than wireless interface.
651127	FortiClient fails to connect to SSL VPN when using SAML authentication with PingID as the identity provider.
660902	FortiClient cannot connect to VPN when push tokens are enabled and certificate is untrusted.
660925	EMS-registered FortiClient cannot log in to VPN after enabling sslvpn-ems-sn-check on corporate firewall for remote users with two-factor authentication.
661731	SSL VPN with multiple gateways and two-factor authentication (2FA) fails to work.
663875	FortiClient (Windows) does not honor remoteauthtimeout or login-timeout from FortiOS with SAML authentication.
665426	SAML SSL VPN in tunnel mode is broken when using AD Federation Services and Duo 2FA solution.
665641	FortiClient (Windows) tries to autoconnect when autoconnect is disabled.
667351	FortiClient (Windows) reports unlicensed VPN access is available until year 2106 after free VPN license expires.
672516	SSL VPN host check validation does not work for SAML SSO user.
672662	IPsec VPN tunnel disconnects automatically less than one minute after it is up.
673414	Saving password for an SSL VPN tunnel does not work.
674716	SSL VPN using certificate only does not complete following a reboot with a three to four minute delay.
675703	RSA manual token code entry does not work.
677752	GUI does not show Always Up.
678175	FortiClient (Windows) exports unencrypted SSL VPN passwords.
680885	FortiClient (Windows) fails to connect to FortiSASE VPN due to serial number check failure.

Web Filter and plugin

Bug ID	Description
620169	Installing Web Filter plugin only tries to install Chrome plugin.
644776	Web Filter plugin fails to block file download with exclusion list.
645770	Disabling Client Web Filtering When On-Net disables Safe Search even when off-net.

Vulnerability Scan

Bug ID	Description
598242	FortiClient must provide a way to let user clean up vcm scan log history.

Other

Bug ID	Description
577549	clientfeature=unknown logged for cloud-based malware protection.
631826	FortiDeviceGuard.sys with FortiClient causes blue screen of death (BSOD).
634300	Windows crashes due to fortips.sys process.
639249	FortiClient logs show repeated CBBS Callhome failed entries.
663604	FCDBLog.exe crashes in autotest system.
664323	BSOD occurs on Windows 7 x86.
668086	FortiClient (Windows) reaches a state where FCConfig process keeps starting and stopping.
681644	Change FortiClient (Windows) full version VPN expiry days from 3 to 30.

 

Znane problemy:

Endpoint control

Bug ID	Description
645799	FortiClient (Windows) reports off-fabric status when policy does not include on-fabric detection rules.
648153	FortiClient gets stuck as registered to EMS but in an unreachable state.
648651	FortiClient (Windows) reaches Unable to retrieve EMS Details state after user cancels popup windows for connection key.
658673	No FortiClient IPsec VPN information in Security Fabric logical topology.
667757	Bitlocker Zero Trust tagging rule does not match on endpoint with USB drive attached.
673183	FortiClient must properly handle trying to register to FortiClient Cloud with invitation code with errors.
683097	FortiClient (Windows) shows incorrect connection details.
684714	FortiClient should send full keepalive (KA), not short KA, after registration.

GUI

Bug ID	Description
627338	EMS shows incorrect user information in endpoint summary when Google/LinkedIn option is selected in FortiClient (Windows) About page.
666964	ISDB_map and ISDB_app signatures should be visible on About page.
676405	@ displays in GUI as %40.
683027	FortiClient (Windows) shows quarantine message even if Application Firewall is not installed and quarantine mode will not work.

Install and deployment

Bug ID	Description
622685	FortiClient (Windows) that EMS has uninstalled has many leftover files.
684283	FortiClient (Windows) does not display reboot prompt after manual upgrade.

Malware Protection and Sandbox

Bug ID	Description
598846	FortiClient can open attached file before receiving Sandbox result for the attachment.
623867	Machines cannot connect to FortiSandbox Cloud with port 514 open.
660320	Antivirus AMSI feature crashes Visual Studio project.
663615	Blocked exploit attempts shows as 0 when antiexploit events have been triggered.
667964	Protected files may already have been encrypted and failed to be restored when FortiClient detects and suspends the suspicious process.
668098	Antiransomware fails to work after timeout.
668467	Antiransomware has popup and logging issues.
668719	Realtime protection on Citrix VDA server blocks remote sessions.
673671	fmon.exe locks with writers some files stored in excluded folders.
680888	GUI should show violation counter for ransomware activity.

Remote Access

Bug ID	Description
627339	FortiClient (Windows) fails to establish SAML VPN connection if FortiOS SSL setting Require Client Certificate is enabled.
631751	SAML login does not work for IPv6.
636076	SSL VPN TLS 1.3 does not work.
649688	With per-app VPN split tunnel, websites with HTTP defined in <fqdn> do not work properly.
658548	FortiClient registers all interfaces’ IP addresses to the DNS server when IPsec VPN tunnel is up.
660902	FortiClient (Windows) cannot connect to VPN when push tokens are enabled and certificate is untrusted.
668544	FortiClient (Windows) cannot connect to IPsec VPN if password is saved and certificate required.
669574	FortiClient (Windows) does not automatically restore DNS settings after closing VPN tunnel.
671392	Restarting Windows does not remove SSL VPN tunnel established by VPN before logon.
672744	Application-based split tunnel does not send traffic outside tunnel.
673186	When system level proxy is enabled and certificate is in local machine, SSL VPN fails to work and gets stuck during connection.
681254	IPsec VPN IKEv2 and always-up do not work reliably.
682675	SSL VPN users cannot set new PIN after it expires with RSA RADIUS authentication.

Vulnerability Scan

Bug ID	Description
639107	Vulnerability scan cannot patch Firefox: Error connecting to patch website. Please try again later.
647794	Vulnerability patch status does not change from scheduled to failed if FortiClient cannot autopatch it.
658521	Vulnerability scan reports excluded applications.
663788	FortiClient (Windows) starts Windows update services upon Vulnerability Scan execution.

Web Filter

Bug ID	Description
617526	Web Filter Chrome plugin fails to update block or warning page message.
663084	FortiClient fails to block phishing sites.

Logs

Bug ID	Description
650334	Feature list for log settings are inconsistent between EMS and FortiClient (Windows).
652647	FortiClient fails to upload large diagnostic tool result file to EMS.
665179	Antiransomware event that FortiClient (Windows) sends to FortiAnalyzer has only vague Found suspicious process message.
666410	FortiClient clients do not generate endpoint control log for FortiAnalyzer.
667179	FortiClient (Windows) does not send diagnostic result to EMS.
675451	GUI displays incorrect logs settings compared to logs setting in EMS profile.

Other

Bug ID	Description
582302	FortiClient cannot get signature from FortiManager using HTTPS because failed certificate check

 

Notatki producenta: FortiClient 6.4.2

Pozdrawiamy,

Zespół B&B
Bezpieczeństwo w biznesie

 

 

 

 

 

 

6.4.2 FortiClient FortiClient 6.4.2