CVE-2020-15590

{"id": "CVE-2020-15590", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-09-14T22:15:11.503", "references": [{"url": "https://github.com/sickcodes", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://sick.codes/cve-2020-15590/", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a \u201csplit tunnel\u201d OpenVPN bypass option. The PIA killswitch & associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending & receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically."}, {"lang": "es", "value": "Una vulnerabilidad en el Private Internet Access (PIA) VPN Client para Linux versiones 1.5 hasta 2.3+, permite a atacantes remotos omitir un mecanismo de desconexi\u00f3n autom\u00e1tica de VPN previsto y leer informaci\u00f3n confidencial por medio de la interceptaci\u00f3n del tr\u00e1fico de red. A partir de la versi\u00f3n 1.5, PIA ha admitido una opci\u00f3n de omisi\u00f3n de OpenVPN \u201csplit tunnel\u201d. El firewall PIA killswitch & associated iptables asociado est\u00e1 dise\u00f1ado para protegerle mientras utiliza Internet. Cuando el switch de interrupci\u00f3n est\u00e1 configurado para bloquear todo el tr\u00e1fico de red entrante y saliente, las aplicaciones privilegiadas pueden continuar enviando y recibiendo tr\u00e1fico de red si net.ipv4.ip_forward ha sido habilitado en los par\u00e1metros del kernel del sistema. Por ejemplo, un contenedor Docker que se ejecuta en un host con la VPN apagada y el switch de interrupci\u00f3n encendido puede continuar usando Internet, filtrando la IP del host (CWE 200). En PIA versiones 2.4.0+, El enrutamiento basado en pol\u00edticas est\u00e1 habilitado por defecto y es usado para dirigir todos los paquetes reenviados hacia la interfaz VPN autom\u00e1ticamente"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:privateinternetaccess:private_internet_access_vpn_client:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "EF164CA0-C1B5-4D63-808C-F8840290ED6E", "versionEndExcluding": "2.4.0", "versionStartIncluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}