PT-2019-5065 · Google+4 · Android+5

Beau Kujath + 2 · Published 2019-12-05 · Updated 2026-04-20 · CVE-2019-14899

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux (affected versions not specified) FreeBSD (affected versions not specified) OpenBSD (affected versions not specified) MacOS (affected versions not specified) iOS (affected versions not specified) Android (affected versions not specified)

Description A vulnerability was discovered that allows a malicious access point or an adjacent user to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel. The issue affects Linux, FreeBSD, OpenBSD, Android, macOS, and iOS, among other Unix-like systems. Enabling the reverse path filtering mechanism (rp filter) in strict mode for IPv4 can neutralize the problem.

Recommendations For Linux, consider enabling the rp filter mechanism in strict mode for IPv4 to mitigate the issue. For other affected systems, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-300

Related Identifiers

BDU:2020-01707

CVE-2019-14899

Affected Products

Android

Freebsd

Linux

Apple Macos

Openbsd

Ios

References · 40

• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2019-14899 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14899 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01707 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14899 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14899 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-14899 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2019-14899 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14899 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14899 · Vendor Advisory
• https://t.me/thehackernews/553 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Jul/24 · Note
• https://openvpn.net/security-advisory/no-flaws-found-in-openvpn-software · Note
• https://support.apple.com/kb/HT211288 · Note