CVE-2019-12575

Published: Jul 11, 2019Modified: Nov 21, 2024

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The root_runner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts to load several libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can create a malicious library under this path to execute arbitrary code as the root user.

Affected (1)

Products: Londontrustmedia: Private Internet Access Vpn Client

Londontrustmedia

1 product

Private Internet Access Vpn Client

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Londontrustmedia Private Internet Access Vpn Client	Version 82

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (2)

https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12575.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12575.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.