PT-2018-1166 · Privatevpn+1 · Privatevpn+1

Published 2018-03-05 · Updated 2020-05-04 · CVE-2018-7716

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrivateVPN version 2.0.31 for macOS

Description The issue is related to the com.privat.vpn.helper privileged helper tool, which implements an XPC service. This service allows any installed application to connect and send messages, extracting a config string from the XPC message. The string is expected to point to an internal OpenVPN configuration file. However, an attacker can send a malicious XPC message with a config string pointing to a controlled OpenVPN configuration file. This file can specify a dynamic library plugin to run for every new VPN connection, executing code in the context of the root user. The vulnerability is associated with insufficient access control in the com.privat.vpn.helper component.

Recommendations For PrivateVPN version 2.0.31 for macOS, consider disabling the XPC service implemented by the com.privat.vpn.helper tool until a patch is available to prevent potential exploitation. Restrict access to the com.privat.vpn.helper component to minimize the risk of arbitrary code execution with root privileges. Avoid using the config string in the affected XPC message to prevent specifying a malicious OpenVPN configuration file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00615

CVE-2018-7716

Affected Products

Openvpn

Privatevpn

References · 4

• https://osv.dev/vulnerability/CVE-2018-7716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7716 · Security Note
• https://bdu.fstec.ru/vul/2018-00615 · Security Note
• https://github.com/VerSprite/research/edit/master/advisories/VS-2018-006.md · Note