Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time

[VS-2018-020] IPVanish for MacOS Root Privilege Escalation Vulnerability

CVE ID

CVE-2018-10192

CVSS Score

Pending

Vendor

IPVanish VPN

Product

IPVanish VPN for macOS

Product Version

3.0.11

Vulnerability Details

IPVanish for MacOS suffers from a root privilege escalation vulnerability. The com.ipvanish.osx.vpnhelper LaunchDaemon implements a insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting xpc_object_t types in to NSObject types for sending XPC messages. When IPVanish establishes a new connection the following XPC message is sent to the com.ipvanish.osx.vpnhelper LaunchDaemon. Because the XPC service itself does not validate incoming connection, this means any application installed on the operation system can send it XPC messages. In the case of the "connect" message, an attacker could manipulate the OpenVPNPath to point at a malicious binary on the system. The com.ipvanish.osx.vpnhelper would receive the VPNHelperConnect command, then execute the malicious binary as the root user.

Vendor Response

Vendor's development team is reviewing

Disclosure Timeline

  • 03-27-2018 - Vendor disclosure via support page
  • 03-27-2018 - Vendor notified via Facebook
  • 03-27-2018 - Vendor response via email
  • 04-09-2018 - VerSprite Security extends advisory release timeline
  • 04-16-2018 - Vendor notified of the advisory release

Credit

Benjamin Watson of VerSprite Security (@rotlogix)