PT-2018-1295 · Ipvanish · Ipvanish

Benjamin Watson + 1 · Published 2018-03-27 · Updated 2019-10-03 · CVE-2018-10192

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPVanish version 3.0.11 for macOS

Description The issue is related to the com.ipvanish.osx.vpnhelper LaunchDaemon, which implements an insecure XPC service. This allows an attacker to execute arbitrary code as the root user by sending specially crafted XPC messages. The XPC service does not validate incoming connections, making it possible for any installed application to send XPC messages to it. Specifically, an attacker could manipulate the OpenVPNPath variable to point to a malicious binary on the system, which would then be executed as the root user when the com.ipvanish.osx.vpnhelper receives the VPNHelperConnect command.

Recommendations For IPVanish version 3.0.11, consider disabling the com.ipvanish.osx.vpnhelper LaunchDaemon as a temporary workaround to prevent exploitation until a patch is available. Restrict access to the XPC service to minimize the risk of malicious XPC messages being sent to it. Avoid using the OpenVPNPath variable in the affected XPC message until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00791

CVE-2018-10192

Affected Products

Ipvanish

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-10192 · Security Note
• https://bdu.fstec.ru/vul/2018-00791 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10192 · Vendor Advisory
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-020.md · Note