PT-2019-12869 · London Trust Media · Private Internet Access (Pia) Vpn Client

Rich Mirch · Publicado 2019-07-11 · Atualizado 2021-09-08 · CVE-2019-12579

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access (PIA) VPN Client version v82

Description A vulnerability could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn launcher.64 binary is setuid root and accepts several parameters to update the system configuration. These parameters are passed to operating system commands using a "here" document and are not sanitized, allowing for arbitrary commands to be injected using shell metacharacters.

Recommendations For London Trust Media Private Internet Access (PIA) VPN Client version v82, consider restricting access to the openvpn launcher.64 binary until a patch is available. As a temporary workaround, avoid using the binary with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-12579

Produtos afetados

Private Internet Access (Pia) Vpn Client

Referências · 3

• 🔥 https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12579.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12579 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12579 · Aviso do Fabricante