CVE-2018-7716

{"id": "CVE-2018-7716", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-03-05T23:29:00.410", "references": [{"url": "https://github.com/VerSprite/research/edit/master/advisories/VS-2018-006.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/VerSprite/research/edit/master/advisories/VS-2018-006.md", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the config string from the corresponding XPC message. This string is supposed to point to an internal OpenVPN configuration file. If a new connection has not already been established, an attacker can send the XPC service a malicious XPC message with the config string pointing at an OpenVPN configuration file that he or she controls. In the configuration file, an attacker can specify a dynamic library plugin that should run for every new VPN connection. This plugin will execute code in the context of the root user."}, {"lang": "es", "value": "PrivateVPN 2.0.31 para macOS sufre de una vulnerabilidad de escalado de privilegios root con su herramienta helper privilegiada com.privat.vpn.helper. La herramienta helper privilegiada implementa un servicio XPC que permite que las aplicaciones instaladas se conecten y env\u00eden mensajes. El servicio XPC extrae la cadena config del mensaje XPC correspondiente. Se supone que la cadena debe se\u00f1alar a un archivo de configuraci\u00f3n interna de OpenVPN. Si no se ha establecido ya una nueva conexi\u00f3n, un atacante puede enviar al servicio XPC un mensaje XPC malicioso con la cadena de config se\u00f1alando a un archivo de configuraci\u00f3n de OpenVPN que \u00e9l o ella controla. En el archivo de configuraci\u00f3n, un atacante puede especificar un plugin de biblioteca din\u00e1mica que deber\u00eda ejecutarse para cada nueva conexi\u00f3n de VPN. Este plugin ejecutar\u00e1 c\u00f3digo en el contexto del usuario root."}], "lastModified": "2024-11-21T04:12:35.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:privatevpn:privatevpn:2.0.31:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "0FC93FC6-FB64-461C-9FF5-87F2DBC671E0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}