PT-2018-18096 · Purevpn · Purevpn

Published 2018-02-26 · Updated 2018-03-17 · CVE-2018-7484

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PureVPN versions through 5.19.4.0

Description An issue was discovered where the client installation grants the Everyone group Full Control permission to the installation directory. The PureVPNService.exe service, which runs under NT AuthoritySYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. This makes the application susceptible to privilege escalation through DLL hijacking.

Recommendations For PureVPN versions through 5.19.4.0, consider restricting write access to the installation directory to prevent DLL hijacking. As a temporary workaround, ensure that all dynamic-link libraries are loaded using absolute paths to prevent privilege escalation.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2018-7484

Affected Products

Purevpn

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-7484 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7484 · Vendor Advisory
• http://defensecode.com/advisories/DC-2018-02-001-PureVPN-Windows-Privilege-Escalation.pdf · Note
• https://securityfocus.com/archive/1/541803 · Note