[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] DefenseCode Security Advisory: PureVPN Windows Privilege Escalation Vulnerability
- From: Defense Code <defensecode AT defensecode.com>
- Subject: [FD] DefenseCode Security Advisory: PureVPN Windows Privilege Escalation Vulnerability
- Date: Wed, 21 Feb 2018 20:36:56 +0100
- Arc-authentication-results: i=1; mx.google.com; dkim=neutral (body hash did not verify) firstname.lastname@example.org header.s=20150623 header.b=wBvq2UaT; spf=pass (google.com: domain of fulldisclosure-bounces AT seclists.org designates 22.214.171.124 as permitted sender) smtp.mailfrom=fulldisclosure-bounces AT seclists.org
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-unsubscribe:list-id:precedence:subject:to:message-id :date:from:mime-version:dkim-signature:delivered-to :arc-authentication-results; bh=zjSl0VxjFfXsnd3DwsbBFNYUS2sQLR0pgdiSUrvhiEg=; b=zIpmuy3HL5phCxTo9YgKbLMu6uk+XeaakDajY0CEpqv9x8Re29cWpsBXOpVS1tB4C7 +O6kOvZIrqpge9Ci5iyg8V7o/R8y7lKIAZguTBNAtboromHftQU9VjS4kIeIJYv7pkrR 7cHyI5S1M4wXvhu7dsy543YeWUCmuGi2LeB+p78yF9mvoYa5TtjZDruUXU8qrFmqAiAM RNDxOd4zVyhhuyIAAB9G0hHpLOYWCKx4MtipNtuGBuycWAZfLAINl6CwgAhNLhs1Q8KM UHEyQpbvlZjoTmjfsFaKbOsoHmGow9erT219MZMKmUydvZQdr5dfmnq/PluCZQOM6h8P 54Cw==
- Arc-seal: i=1; a=rsa-sha256; t=1519578290; cv=none; d=google.com; s=arc-20160816; b=klWg0I6DTnYpEffNuiFXThdK35InOgh0phZR/M6HKzI0bcIL2ok+QWty2ZJk8kbG9D y/1qg/wK7rcyk8QmdJSUAVrVGHtse2OjmvyVD3vRcoeIW3fMEPqFMvyfPVxRCYpSKAFc iHg640CZvQWTh3steAovrWrNuIXFTRgr0/pgeNPchKEXZbUUu0rcxPqWsHVYQG7/R/Qu aWydBcGVy2ZDeMKcuKXgsYKUjDQUTi+096dGy7KC5oNvgQ+wsT/yob9cevHOu+4QZnHI XYP8YRhPQvwDPNEnqxATw+FVRoRI1vFJeDYKxCgI64zcHM5Pacmj4PKaeJgia4X6z+Op gEvA==
- Sender: "Fulldisclosure" <fulldisclosure-bounces AT seclists.org>
- To: undisclosed-recipients:;
DefenseCode Security Advisory
PureVPN Windows Privilege Escalation Vulnerability
Advisory ID: DC-2018-02-001
Advisory Title: PureVPN Windows Privilege Escalation Vulnerability
Advisory URL: http://www.defensecode.com/advisories.php
Version: 126.96.36.199 and below (Windows Build Version: 6)
Vendor Status: Vendor contacted, vulnerability fixed
Release Date: 21/02/2018
1. General Overview
During the security analysis of PureVPN's Windows client software it
has been discovered that the software contains a vulnerability that
could allow a local user to escalate their privileges on the system.
2. Software Overview
PureVPN is a paid VPN service provider which claims to provide online
privacy and security to its users. The product is equipped with
different tunneling protocols to offer end-to-end encryption to its
users. According to their website, PureVPN's network of 550+ servers
is spread across more than 145 countries, serving over 1 million users
from all over the world.
PureVPN provides client software for Windows, Mac, Android, and iOS.
3. Vulnerability Description
During the security analysis of PureVPN Windows client software it
has been determined that the software installation grants Everyone
group (i.e all users) full control permission to the software's
installation directory (C:\Program Files (x86)\PureVPN by default).
In addition, it has been determined that the PureVPNService.exe,
which runs under NT Authority\SYSTEM privileges, tries to load
several dynamic-link libraries using relative paths instead of
the absolute path. When not using a fully qualified path, the
application will first try to load the library from a directory
from which the application is started. As the residing directory
of PureVPNService.exe is writable to all users, this makes the
application susceptible to privilege escalation through DLL hijacking.
DLL hijacking proof of concept was done by placing a malicious
cryptbase.dll inside the software's installation directory,
resulting in privilege escalation to NT Authority\SYSTEM when
the PureVPNService.exe service is started.
Vendor fixed the reported security issues and released a new version.
All users are strongly advised to update to the latest available
Discovered by Bosko Stankovic (bosko AT defensecode.com).
6. Disclosure Timeline
02/02/2018 Vendor contacted
13/02/2018 Vendor responded
20/02/2018 Vulnerability fixed
7. About DefenseCode
DefenseCode L.L.C. delivers products and services designed to analyze
and test web, desktop and mobile applications for security
DefenseCode ThunderScan is a SAST (Static Application Security
Testing, WhiteBox Testing) solution for performing extensive security
audits of application source code. ThunderScan SAST performs fast and
accurate analyses of large and complex source code projects delivering
precise results and low false positive rate.
DefenseCode WebScanner is a DAST (Dynamic Application Security
Testing, BlackBox Testing) solution for comprehensive security audits
of active web applications. WebScanner will test a website's security
by carrying out a large number of attacks using the most advanced
techniques, just as a real attacker would.
Subscribe for free software trial on our website
Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/