PT-2024-13665 · Purevpn · Purevpn Linux Client

Muhammad Samaak + 1 · Published 2024-08-25 · Updated 2024-09-11 · CVE-2023-48957

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PureVPN Linux client version 2.0.2

Description The PureVPN Linux client fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default DNS servers. This issue is related to improper access controls in the DNS query handler.

Recommendations For PureVPN Linux client version 2.0.2, upgrade to version 2.0.3 to remediate the issue. As a temporary workaround, consider restricting access to the DNS query handler until the patch is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-48957

Affected Products

Purevpn Linux Client

References · 12

• 🔥 https://rafaybaloch.com/2023/11/Multiple%20Critical-Vulnerabilities-in-PureVPN.html?m=1 · Exploit
• 🔥 https://latesthackingnews.com/2023/11/13/multiple-vulnerabilities-found-in-purevpn-one-remains-unpatched · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48957 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48957 · Vendor Advisory
• https://twitter.com/transilienceai/status/1829198084133277828 · Twitter Post
• https://twitter.com/transilienceai/status/1829198076201849274 · Twitter Post
• https://t.me/cvenotify/94246 · Telegram Post
• https://twitter.com/CVEnew/status/1827750613050065112 · Twitter Post
• https://t.me/cvenotify/92080 · Telegram Post
• https://twitter.com/oktsec/status/1827771471982121423 · Twitter Post
• https://t.me/cvedetector/4089 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1827778235515469837 · Twitter Post