Skip to content

Latest commit

 

History

History
42 lines (31 loc) · 1.75 KB

VS-2018-022.md

File metadata and controls

42 lines (31 loc) · 1.75 KB

[VS-2018-022] TunnelBear for Windows Privilege Escalation Vulnerability

CVE ID

CVE-2018-10381

CVSS Score

Pending

Vendor

TunnelBear

Product

TunnelBear

Product Version

3.2.0.6

Vulnerability Details

TunnelBear for Windows suffers from a SYSTEM privilege escalation vulnerability through the TunnelBearMaintenance service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The OpenVPNConnect method accepts a server list argument that provides attacker control of the OpenVpn command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.

Vendor Response

Vendor has released an update.

Disclosure Timeline

  • 04-17-2018 - Vendor disclosure via email
  • 04-17-2018 - Vendor disclosure via email
  • 04-17-2018 - Vendor notified via Facebook
  • 04-18-2018 - Vendor response and follow up via Facebook
  • 04-18-2018 - Vendor submits update and requests additional exploitation details
  • 04-18-2018 - VerSprite verifies vulnerability unresolved and submits detailed exploitation documentation
  • 04-19-2018 - Vendor response "Team reviewing documentation"
  • 04-19-2018 - Vendor submits update for testing and requests testing data
  • 04-20-2018 - VerSprite verifies vulnerability resolution and submits testing data
  • 04-23-2018 - Vendor response and followup
  • 04-25-2018 - Vendor notified of the advisory release
  • 04-25-2018 - Vendor follow up

Credit

Fabius Watson of VerSprite Security (@FabiusArtrel)