CVE-2018-10192 Information

Description

IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The com.ipvanish.osx.vpnhelper LaunchDaemon implements an insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting xpc_object_t types in to NSObject types for sending XPC messages. When IPVanish establishes a new connection the following XPC message is sent to the com.ipvanish.osx.vpnhelper LaunchDaemon. Because the XPC service itself does not validate an incoming connection any application installed on the operating system can send it XPC messages. In the case of the \connect\ message an attacker could manipulate the OpenVPNPath to point at a malicious binary on the system. The com.ipvanish.osx.vpnhelper would receive the VPNHelperConnect command and then execute the malicious binary as the root user.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/VerSprite/research/blob/master/advisories/VS-2018-020.md

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8