SB2018041817 - Incorrect permission assignment for critical resource in PureVPN

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018041817

SB2018041817 - Incorrect permission assignment for critical resource in PureVPN

Published: April 18, 2018 Updated: August 8, 2020

Security Bulletin ID SB2018041817
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2018-10204)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the OpenVPN protocol, the "sevpnclient" service executes "openvpn.exe" using the OpenVPN config file located at %PROGRAMDATA%purevpnconfigconfig.ovpn. This file allows "Write" permissions to users in the "Everyone" group. An authenticated attacker may modify this file to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM account.


Remediation

Install update from vendor's website.

References