PT-2018-1296 · Nordvpn+1 · Nordvpn+1

Fabius Watson + 1 · Published 2018-04-16 · Updated 2019-10-03 · CVE-2018-10170

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NordVPN version 6.12.7.0

Description The issue is related to the "nordvpn-service" service, which establishes a NetNamedPipe endpoint. This allows arbitrary installed applications to connect and call publicly exposed methods, including the "Connect" method. The "Connect" method accepts a class instance argument, providing attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin to run for every new VPN connection attempt, executing code in the context of the SYSTEM user. The vulnerability is associated with inadequate access control in the nordvpn-service.

Recommendations For NordVPN version 6.12.7.0, consider disabling the "nordvpn-service" service as a temporary workaround to minimize the risk of exploitation. Restrict access to the NetNamedPipe endpoint to prevent arbitrary applications from connecting and calling publicly exposed methods. Avoid using the dynamic library plugin feature in the OpenVPN command line until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-264

Related Identifiers

BDU:2018-00792

CVE-2018-10170

Affected Products

Nordvpn

Openvpn

References · 4

• https://bdu.fstec.ru/vul/2018-00792 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10170 · Security Note
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-018.md · Note