CVE-2018-18857 : Multiple local privilege escalation vulnerabilities have been identified in the

Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "command_line" parameter as a shell command.

Published 2018-11-20 19:29:02

Updated 2020-05-11 18:38:30

Source MITRE

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2018-18857

Liquidvpn » Liquidvpn » For Macos
Versions up to, including, (<=) 1.37
cpe:2.3:a:liquidvpn:liquidvpn:*:*:*:*:*:macos:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-18857

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-18857

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-18857

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-18857

https://www.exploit-db.com/exploits/45782/

LiquidVPN 1.36 / 1.37 - Privilege Escalation
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html

LiquidVPN For macOS 1.3.7 Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
http://seclists.org/fulldisclosure/2018/Nov/1

Full Disclosure: Multiple Privilege Escalation Vulnerabilities in LiquidVPN for MacOS (CVE-2018-18856, CVE-2018-18857, CVE-2018-18858, CVE-2018-18859)
Exploit;Mailing List;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-18857

Products affected by CVE-2018-18857

Exploit prediction scoring system (EPSS) score for CVE-2018-18857

CVSS scores for CVE-2018-18857

CWE ids for CVE-2018-18857

References for CVE-2018-18857