Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The com.ipvanish.osx.vpnhelper LaunchDaemon implements an insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting xpc_object_t types in to NSObject types for sending XPC messages. When IPVanish establishes a new connection, the following XPC message is sent to the com.ipvanish.osx.vpnhelper LaunchDaemon. Because the XPC service itself does not validate an incoming connection, any application installed on the operating system can send it XPC messages. In the case of the "connect" message, an attacker could manipulate the OpenVPNPath to point at a malicious binary on the system. The com.ipvanish.osx.vpnhelper would receive the VPNHelperConnect command, and then execute the malicious binary as the root user.
AnalysisAI
IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The com.ipvanish.osx.vpnhelper LaunchDaemon implements an insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting xpc_object_t types in to NSObject types for sending XPC messages. When IPVanish establishes a new connection, the following XPC message is sent to the com.ipvanish.osx.vpnhelper LaunchDaemon. Because the XPC service itself does not validate an incoming connection, any application installed on the operating system can send it XPC messages. In the case of the "connect" message, an attacker could manipulate the OpenVPNPath to point at a malicious binary on the system. The com.ipvanish.osx.vpnhelper would receive the VPNHelperConnect command, and then execute the malicious binary as the root user. Affected products include: Ipvanish.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today