PT-2019-12866 · London Trust Media+2 · Private Internet Access (Pia) Vpn Client+2

Rich Mirch · Publicado 2019-07-11 · Atualizado 2021-09-08 · CVE-2019-12576

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access (PIA) VPN Client version v82 for macOS

Description A local, authenticated attacker could run arbitrary code with elevated privileges due to a vulnerability in the openvpn launcher binary, which is setuid root and executes several operating system utilities during the connection process. The vulnerability is exploited by creating a trojan networksetup utility, which is executed using relative paths, allowing a local unprivileged user to execute arbitrary commands as root. This is possible because the PATH environment variable is not reset prior to executing the OS utility.

Recommendations For London Trust Media Private Internet Access (PIA) VPN Client version v82 for macOS, consider disabling the execution of the networksetup utility until a patch is available, or restrict the PATH environment variable to prevent the execution of arbitrary commands.

Exploit

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2019-12576

Produtos afetados

Private Internet Access (Pia) Vpn Client

Apple Macos

Openvpn Launcher

Referências · 3

• 🔥 https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12576.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12576 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12576 · Aviso do Fabricante