CVE-2019-12577

A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpn_launcher.64 is setuid root. This binary creates /tmp/pia_upscript.sh when executed. Because the file creation mask (umask) is not reset, the umask value is inherited from the calling process. This value can be manipulated to cause the privileged binary to create files with world writable permissions. A local unprivileged user can modify /tmp/pia_upscript.sh during the connect process to execute arbitrary code as the root user.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt	Exploit Third Party Advisory
https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:londontrustmedia:private_internet_access_vpn_client:82:*:*:*:*:*:*:*

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:23

Type	Values Removed	Values Added
References	~~() https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt - Exploit, Third Party Advisory~~	() https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt - Exploit, Third Party Advisory

Information

Published : 2019-07-11 20:15

Updated : 2024-11-21 04:23

NVD link : CVE-2019-12577

Mitre link : CVE-2019-12577

CVE.ORG link : CVE-2019-12577

JSON object : View

Products Affected

londontrustmedia

private_internet_access_vpn_client

apple

macos

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2019-12577", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-07-11T20:15:13.117", "references": [{"url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpn_launcher.64 is setuid root. This binary creates /tmp/pia_upscript.sh when executed. Because the file creation mask (umask) is not reset, the umask value is inherited from the calling process. This value can be manipulated to cause the privileged binary to create files with world writable permissions. A local unprivileged user can modify /tmp/pia_upscript.sh during the connect process to execute arbitrary code as the root user."}, {"lang": "es", "value": "Una vulnerabilidad en el cliente VPN de Private Internet Access (PIA) de London Trust Media para macOS, podr\u00eda permitir a un atacante local autenticado ejecutar c\u00f3digo arbitrario con privilegios elevados. El binario de macOS openvpn_launcher.64 es root setuid. Este binario crea el archivo /tmp/pia_upscript.sh cuando es ejecutado. Dado que la m\u00e1scara de creaci\u00f3n de archivos (umask) no se restablece, el valor umask se hereda del proceso de llamada. Este valor se puede manipular para causar que el binario con privilegios cree archivos con permisos de escritura mundial. Un usuario local sin privilegios puede modificar el archivo /tmp/pia_upscript.sh durante el proceso de conexi\u00f3n para ejecutar c\u00f3digo arbitrario como el usuario root."}], "lastModified": "2024-11-21T04:23:07.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:londontrustmedia:private_internet_access_vpn_client:82:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23845C1B-3AC7-426E-92C5-9EE5CAC42B68"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}