PT-2018-1124 · Cactusvpn · Cactusvpn

Benjamin Watson + 1 · Publicado 2018-02-21 · Atualizado 2021-09-22 · CVE-2018-7493

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CactusVPN versions through 6.0 for macOS

Description The issue is related to the implementation of the XPC interface in the CactusVPN software, which is used to access the VPN service. This implementation has access control weaknesses. Exploitation of the issue can allow a remote attacker to execute system commands with root privileges. The privileged helper tool in CactusVPN implements an XPC interface, enabling arbitrary applications to execute system commands as root.

Recommendations For CactusVPN versions through 6.0 for macOS, consider disabling the privileged helper tool until a patch is available to prevent arbitrary applications from executing system commands as root. Restrict access to the XPC interface to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2018-00549

CVE-2018-7493

Produtos afetados

Cactusvpn

Referências · 6

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-007.md · Nota
• https://t.me/cvenotify/21279 · Publicação no Telegram
• https://cactusvpn.com/downloads · Nota
• https://osv.dev/vulnerability/CVE-2018-7493 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00549 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-7493 · Nota de Segurança