Jump to content

This popular VPN was hit by a major security vulnerability


aum

Recommended Posts

SaferVPN vulnerability could have allowed local privilege escalation on Windows

 

 

sAuFRENhYJZEMCPYhA3JXe-1024-80.jpg.webp

(Image credit: OpturaDesign / Shutterstock.com)

 

UPDATE: SaferVPN has told TechRadar Pro that the company has now released version 5.0.5.0 for Windows, which addresses CVE-2020-26050 and includes an update of the OpenSSL library.

 

ORIGINAL: A security researcher has discovered a new vulnerability in the VPN service SaferVPN that could allow for local privilege escalation on Windows systems.

 

The local privilege escalation vulnerability was discovered by a researcher known as nmht3t who previously disclosed the fact that SaferVPN silently fixed a DoS vulnerability in its VPN client last September. In a new blog post on Medium, mmht3t revealed why he chose to publicly disclose his latest discovery, saying:

 

“SaferVPN does not fix this vulnerability even after a 90-day disclosure deadline. Therefore, there is no patch available at the moment for this product. In order to inform the users of the vulnerability, I decided to publicly disclose the vulnerability.”

 

Security researchers often give companies a 90-day deadline to fix any vulnerabilities before they disclose them publicly. As SaferVPN failed to patch this latest vulnerability in a timely manner, mmht3t felt it was in the best interest of the company's users to warn them about it.

Local privilege escalation flaw

According to mmht3t's vulnerability summary, when SaferVPN attempts to connect to a VPN server it spawns the OpenVPN executable in the context of NT AUTHORITY\SYSTEM. The service's VPN client then tries to load an openssl.cnf configuration file from a non-existing folder (C:\etc\ssl\openssl.cnf).

 

However, as a low-privileged users is able to create folders under C:\ on Windows, it's possible for them to create the appropriate path and place a crafted openssl.cnf file in it. Once OpenVPN starts in SaferVPN, this file can load a malicious OpenSSL engine library which results in arbitrary code execution as SYSTEM.

 

SaferVPN versions 5.0.3.3 to 5.04.15 are vulnerable to this local privilege escalation flaw tracked as CVE-2020–26050.

Mmht3t first discovered this vulnerability earlier this year and they sent the details of the vulnerability to SaferVPN in July. After a follow up with no response from the company and informing them that the 90-day disclosure deadline was approaching, mmht3t decided to make their findings public in January.

 

Source

Link to comment
Share on other sites


  • Views 264
  • Created
  • Last Reply

Archived

This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...