TunnelBear for Windows | Security Research Advisory

CVE ID

CVE-2018-10381

VENDOR

McAfee

PRODUCT

TunnelBear

Product version

3.2.0.6

Vulnerability Details

TunnelBear for Windows suffers from a SYSTEM privilege escalation vulnerability through the TunnelBearMaintenanceservice. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The OpenVPNConnect method accepts a server list argument that provides attacker control of the OpenVpn command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.

Vendor response

The vendor has released an update

Disclosure timeline

04-17-2018 - Vendor disclosure via email
04-17-2018 - Vendor disclosure via email
04-17-2018 - Vendor notified via Facebook
04-18-2018 - Vendor response and follow up via Facebook
04-18-2018 - Vendor submits update and requests additional exploitation details
04-18-2018 - VerSprite verifies vulnerability unresolved and submits detailed exploitation documentation
04-19-2018 - Vendor response "Team reviewing documentation"
04-19-2018 - Vendor submits an update for testing and requests testing data
04-20-2018 - VerSprite verifies vulnerability resolution and submits testing data
04-23-2018 - Vendor response and followup
04-25-2018 - Vendor notified of the advisory release
04-25-2018 - Vendor follow up