vendor:
Private Tunnel
by:
Gjoko 'LiquidWorm' Krstic
7,2
CVSS
HIGH
Unquoted Service Path Elevation Of Privilege
426
CWE
Product Name: Private Tunnel
Affected Version From: 2.1.28.0
Affected Version To: 2.3.8
Patch Exists: NO
Related CWE: N/A
CPE: a:openvpn_technologies:private_tunnel
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Microsoft Windows 7 Professional SP1 (EN), Microsoft Windows XP Professional SP3 (EN)
2014
OpenVPN Private Tunnel Core Service Unquoted Service Path Elevation Of Privilege
Private Tunnel application suffers from an unquoted search path issue impacting the Core Service 'ptservice' service for Windows deployed as part of PrivateTunnel bundle. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Mitigation:
Ensure that all services are installed with an absolute path and that the path is properly quoted. Additionally, ensure that all services are running with the least privileges necessary.
