CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12574
https://notcve.org/view.php?id=CVE-2019-12574
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The updater loads several libraries from a folder that authenticated users have write access to. A low privileged user can leverage this vulnerability to execute arbitrary code as SYSTEM. Una vulnerabilidad en el cliente ... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12574.txt • CWE-426: Untrusted Search Path •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12578
https://notcve.org/view.php?id=CVE-2019-12578
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher.64 binary is setuid root. This binary executes /opt/pia/openvpn-64/openvpn, passing the parameters provided from the command line. Care was taken to programmatically disable potentially dangerous openvpn parameters; however, the --route-pre-down parameter can be used. This parameter accepts an arbitr... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12578.txt • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12571
https://notcve.org/view.php?id=CVE-2019-12571
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists, it will be truncated and the contents completely overwritten. This file is removed on disconnect. An unprivileged user can create a hard or soft link to arbitrary files owned by any user on the system, includin... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12571.txt • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12576
https://notcve.org/view.php?id=CVE-2019-12576
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher binary is setuid root. This program is called during the connection process and executes several operating system utilities to configure the system. The networksetup utility is called using relative paths. A local unprivileged user can execute arbitrary commands as root by creating a networksetup tro... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12576.txt • CWE-426: Untrusted Search Path •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1CVE-2019-12573
https://notcve.org/view.php?id=CVE-2019-12573
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpn_launcher binary is setuid root. This binary supports the --log option, which accepts a path as an argument. This parameter is not sanitized, which allows a local unprivileged user to overwrite arbitrary files owned by any user on the system, including root. This creates a denial of service condition and possible data... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12573.txt • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12577
https://notcve.org/view.php?id=CVE-2019-12577
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpn_launcher.64 is setuid root. This binary creates /tmp/pia_upscript.sh when executed. Because the file creation mask (umask) is not reset, the umask value is inherited from the calling process. This value can be manipulated to cause the privileged binary to create files with world writable permissi... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2019-12579
https://notcve.org/view.php?id=CVE-2019-12579
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpn_launcher.64 binary is setuid root. This binary accepts several parameters to update the system configuration. These parameters are passed to operating system commands using a "here" document. The parameters are not sanitized, which allow for arbitrary commands to be injected u... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12579.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12575
https://notcve.org/view.php?id=CVE-2019-12575
11 Jul 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The root_runner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts to load several libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can create a malicious library under this path to execute arbitrary code as the root user. Una vulnerabilidad en el cliente VPN d... • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12575.txt • CWE-427: Uncontrolled Search Path Element •