TunnelBear for Windows
Privilege Escalation
CVE ID
Vendor
McAfee
Product
TunnelBear
Product Version
3.2.0.6
Vulnerability Details
TunnelBear for Windows suffers from a SYSTEM privilege escalation vulnerability through the TunnelBearMaintenanceservice. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The OpenVPNConnect method accepts a server list argument that provides attacker control of the OpenVpn command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.
Vendor Response
The vendor has released an update
Disclosure Timeline
-
Vendor disclosure via email
-
Vendor disclosure via email
-
Vendor notified via Facebook
-
Vendor response and follow up via Facebook
-
Vendor submits update and requests additional exploitation details
-
VerSprite verifies vulnerability unresolved and submits detailed exploitation documentation
-
Vendor response "Team reviewing documentation"
-
Vendor submits an update for testing and requests testing data
-
VerSprite verifies vulnerability resolution and submits testing data
-
Vendor response and followup
-
Vendor notified of the advisory release
-
Vendor follow up
