VyprVPN for MacOS
Privilege Escalation
CVE ID
Vendor
Golden Frog
Product
VyprVPN
Product Version
VyperVPN for MacOS < 2.15.0.5828
Vulnerability Details
The VyprVPN for MacOS’s vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.
Vendor Response
Golden Frog accepted and remediated the vulnerability
Disclosure Timeline
-
Contacted Gold Frog Support and asked to be put in touch with a security resource for the disclosure process
-
Golden Frog Supported responded requesting details about the vulnerability
-
Responded to Gold Frog Support with the requested details
-
Golden Frog Support asked that the details be forwarded to [email protected], I complied
-
A Golden Frog technical representative asked for the vulnerability details again, I complied
-
The Golden Frog technical representative informed me they had a fix and asked for a proof of concept
-
The Golden Frog technical representative apprised me they would be scheduling a product update for the following week
-
The VyprVPN for MacOS update is made available
-
Advisory is released
