Details of VAR-201811-0356

ID

VAR-201811-0356

CVE

CVE-2018-18860

TITLE

macOS for SwitchVPN client Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-012238

DESCRIPTION

A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-permissive configuration settings and a SUID binary, an attacker is able to execute arbitrary binaries as root. macOS for SwitchVPN client Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SwitchVPN for macOS is a VPN software based on the macOS platform. An attacker can exploit this vulnerability to elevate privileges to root

Trust: 1.71

sources: NVD: CVE-2018-18860 // JVNDB: JVNDB-2018-012238 // VULHUB: VHN-129462

AFFECTED PRODUCTS

vendor:

switchvpn

model:

switchvpn

scope:

version:

2.1012.03

Trust: 2.4

sources: JVNDB: JVNDB-2018-012238 // CNNVD: CNNVD-201811-474 // NVD: CVE-2018-18860

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-18860
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-18860
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201811-474
value:	HIGH
Trust: 0.6
VULHUB:	VHN-129462
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-18860
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-129462
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-18860
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-129462 // JVNDB: JVNDB-2018-012238 // CNNVD: CNNVD-201811-474 // NVD: CVE-2018-18860

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-264	Trust: 0.9

sources: VULHUB: VHN-129462 // JVNDB: JVNDB-2018-012238 // NVD: CVE-2018-18860

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201811-474

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201811-474

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-012238

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-129462

PATCH

title:

Top Page

url:

https://switchvpn.net/

Trust: 0.8

sources: JVNDB: JVNDB-2018-012238

EXTERNAL IDS

db:	PACKETSTORM	id:	150323	Trust: 2.5
db:	NVD	id:	CVE-2018-18860	Trust: 2.5
db:	EXPLOIT-DB	id:	45854	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-012238	Trust: 0.8
db:	CNNVD	id:	CNNVD-201811-474	Trust: 0.7
db:	VULHUB	id:	VHN-129462	Trust: 0.1

sources: VULHUB: VHN-129462 // JVNDB: JVNDB-2018-012238 // CNNVD: CNNVD-201811-474 // NVD: CVE-2018-18860

REFERENCES

url:	http://packetstormsecurity.com/files/150323/switchvpn-for-macos-2.1012.03-privilege-escalation.html	Trust: 2.5
url:	https://www.exploit-db.com/exploits/45854/	Trust: 1.7
url:	http://seclists.org/fulldisclosure/2018/nov/38	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18860	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-18860	Trust: 0.8

sources: VULHUB: VHN-129462 // JVNDB: JVNDB-2018-012238 // CNNVD: CNNVD-201811-474 // NVD: CVE-2018-18860

SOURCES

db:	VULHUB	id:	VHN-129462
db:	JVNDB	id:	JVNDB-2018-012238
db:	CNNVD	id:	CNNVD-201811-474
db:	NVD	id:	CVE-2018-18860

LAST UPDATE DATE

2024-11-23T21:52:39.944000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-129462	date:	2020-05-11T00:00:00
db:	JVNDB	id:	JVNDB-2018-012238	date:	2019-01-31T00:00:00
db:	CNNVD	id:	CNNVD-201811-474	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2018-18860	date:	2024-11-21T03:56:45.920

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-129462	date:	2018-11-30T00:00:00
db:	JVNDB	id:	JVNDB-2018-012238	date:	2019-01-31T00:00:00
db:	CNNVD	id:	CNNVD-201811-474	date:	2018-11-15T00:00:00
db:	NVD	id:	CVE-2018-18860	date:	2018-11-30T18:29:00.413