PT-2023-4963 · Clario · Clario Vpn Client

Christina Pöpper + 4 · Published 2023-08-09 · Updated 2024-05-13 · CVE-2023-36672

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Clario VPN client versions 5.9.1.1662 and earlier

Description The issue concerns the insecure configuration of the operating system by the Clario VPN client, which results in traffic to the local network being sent in plaintext outside the VPN tunnel, even when the local network uses a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. The problem is related to the lack of protection for transmitted data.

Recommendations For Clario VPN client versions 5.9.1.1662 and earlier, update to a version that fixes the insecure configuration issue to prevent traffic from being sent in plaintext outside the VPN tunnel. As a temporary workaround, consider restricting access to the local network to minimize the risk of exploitation.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2023-05501

CVE-2023-36672

Affected Products

Clario Vpn Client

References · 19

• 🔥 https://tunnelcrack.mathyvanhoef.com/details.html · Exploit
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-leak-Sew6g2kd?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Bypassing%20Tunnels:%20Leaking%20VPN%20Client%20Traffic%20by%20Abusing%20Routing%20Tables%20Affecting%20Cisco%20AnyConnect%20Secure%20Mobility%20Client%20and%20Cisco%20Secure%20Client&vs_k=1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-36672 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36672 · Security Note
• https://bdu.fstec.ru/vul/2023-05501 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36672 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-36672 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-leak-Sew6g2kd?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Bypassing%20Tunnels:%20Leaking%20VPN%20Client%20Traffic%20by%20Abusing%20Routing%20Tables%20Affecting%20Cisco%20AnyConnect%20Secure%20Mobility%20Client%20and%20Cisco%20Secure%20Client&vs_k=1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36672 · Vendor Advisory
• https://papers.mathyvanhoef.com/usenix2023-tunnelcrack.pdf · Note
• https://twitter.com/mullvadnet/status/1787877221652111663 · Twitter Post
• https://openvpn.net/security-advisory/statement-regarding-tunnelcrack-vulnerabilities · Note
• https://mullvad.net/de/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure · Note
• https://twitter.com/HunterMapping/status/1789929337958866970 · Twitter Post
• https://clario.co/vpn-for-mac · Note