Vulnerabilities > CVE-2018-18860 - Unspecified vulnerability in Switchvpn 2.1012.03

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
switchvpn
exploit available
NVD
Published: 2018-11-30
Updated: 2020-05-11

Summary

A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-permissive configuration settings and a SUID binary, an attacker is able to execute arbitrary binaries as root.

Vulnerable Configurations

Part Description Count
Application
Switchvpn
1

Exploit-Db

fileexploits/macos/local/45854.txt
idEDB-ID:45854
last seen2018-11-30
modified2018-11-14
platformmacos
port
published2018-11-14
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/45854
titleSwitchVPN for macOS 2.1012.03 - Privilege Escalation
typelocal

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/150323/switchvpnmacos2101203-escalate.txt
idPACKETSTORM:150323
last seen2018-11-14
published2018-11-14
reporterBernd Leitner
sourcehttps://packetstormsecurity.com/files/150323/SwitchVPN-For-MacOS-2.1012.03-Privilege-Escalation.html
titleSwitchVPN For MacOS 2.1012.03 Privilege Escalation

References