CVE-2019-12579 Command injection in n/a
A local attacker can inject shell commands into the setuid root openvpn_launcher binary to execute arbitrary code with elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12579?
CVE-2019-12579 is a high-severity command injection vulnerability in n/a, published on 11 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpn_launcher.64 binary is setuid root. This binary accepts several parameters to update the system configuration. These parameters are passed to operating system commands using a "here" document. The parameters are not sanitized, which allow for arbitrary commands to be injected using shell metacharacters. A local unprivileged user can pass special crafted parameters that will be interpolated by the operating system calls.
Weakness: CWE-78
Which versions are affected by CVE-2019-12579?
It affects 1 product.
Products include Londontrustmedia Private Internet Access Vpn Client.
How do I fix CVE-2019-12579?
No fix has been published for CVE-2019-12579 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-12579 being exploited?
There is no known exploitation of CVE-2019-12579 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w74p-ff9j-9p68.