PT-2019-12861 · London Trust Media · Private Internet Access (Pia) Vpn Client

Rich Mirch · Publicado 2019-07-11 · Atualizado 2021-09-08 · CVE-2019-12571

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access (PIA) VPN Client version 0.9.8 beta (build 02099)

Description A local attacker could overwrite arbitrary files on the system. When the client initiates a connection, it creates an XML file /tmp/pia-watcher.plist. If this file already exists, its contents are completely overwritten. An unprivileged user can create a hard or soft link to arbitrary files, including those owned by root, potentially leading to a denial of service condition and possible data loss.

Recommendations For London Trust Media Private Internet Access (PIA) VPN Client version 0.9.8 beta (build 02099), consider restricting access to the /tmp/pia-watcher.plist file to prevent unauthorized modifications. As a temporary workaround, avoid using the VPN client until a patch is available.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2019-12571

Produtos afetados

Private Internet Access (Pia) Vpn Client

Referências · 3

• 🔥 https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12571.txt · Exploit
• https://osv.dev/vulnerability/CVE-2019-12571 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12571 · Nota de Segurança