Benjamin Watson

The issue is related to the `com.ipvanish.osx.vpnhelper` LaunchDaemon, which implements an insecure XPC service. This allows an attacker to execute arbitrary code as the root user by sending specially crafted XPC messages. The XPC service does not validate incoming connections, making it possible for any installed application to send XPC messages to it. Specifically, an attacker could manipulate the `OpenVPNPath` variable to point to a malicious binary on the system, which would then be executed as the root user when the `com.ipvanish.osx.vpnhelper` receives the VPNHelperConnect command.

The issue arises from the privileged helper tool's implemented XPC service, which is responsible for receiving and processing new OpenVPN connection requests. This XPC service is not protected, allowing arbitrary applications to connect and send XPC messages. An attacker can send a crafted XPC message to the privileged helper tool, requesting a new OpenVPN connection and specifying the location of the openvpn executable, potentially pointing to a malicious executable. This could result in code execution in the context of the privileged helper tool.

The issue concerns a root privilege escalation in the privileged helper tool of VPN Unlimited. This tool implements an XPC interface, allowing arbitrary applications to execute system commands as root.

Name of the Vulnerable Software and Affected Versions: ZenMate version 1.5.4 for macOS Description: The issue is related to a type confusion problem within the com.zenmate.chron-xpc LaunchDaemon component. This component implements an XPC service that uses an insecure XPC API, potentially allowing an attacker to pass an XPC object of the wrong type to the xpc connection create from endpoint function. However, due to internal checks implemented by Apple in recent macOS and OS X versions, exploitation of this issue would likely result in a denial of service. Recommendations: For ZenMate version 1.5.4, consider disabling the com.zenmate.chron-xpc LaunchDaemon component as a temporary workaround to minimize the risk of exploitation.

The issue is related to the implementation of the XPC interface in the CactusVPN software, which is used to access the VPN service. This implementation has access control weaknesses. Exploitation of the issue can allow a remote attacker to execute system commands with root privileges. The privileged helper tool in CactusVPN implements an XPC interface, enabling arbitrary applications to execute system commands as root.

The software installs a privileged helper tool that runs as the root user, which is installed as a LaunchDaemon and implements an XPC service. This XPC service handles new VPN connection operations via the main PrivateVPN application. The privileged helper tool creates new VPN connections by executing the `openvpn` binary located in the `/Applications/PrivateVPN.app/Contents/Resources` directory. The `openvpn` binary can be overwritten by the default user, allowing an attacker that has already installed malicious software as the default user to replace the binary. When a new VPN connection is established, the privileged helper tool will launch this malicious binary, thus allowing an attacker to execute code as the root user.

The issue concerns a root privilege escalation through a setuid root binary called `runme`. This binary accepts a command line argument and passes it to a `system()` call, allowing low-privileged users to execute commands as root.

The issue concerns an unprotected XPC service in the com.feingeist.shimo.helper tool LaunchDaemon, which can be exploited to execute scripts as root.

The issue concerns an unprotected XPC service in the HelperTool LaunchDaemon of PureVPN on macOS. This unprotected service can be exploited to execute system commands with root privileges.

The issue concerns an unprotected XPC service in the vyprvpnservice launch daemon, which allows attackers to modify the OpenVPN configuration and arguments passed to the OpenVPN binary. This can be exploited by forcing the VyprVPN application to load a malicious dynamic library when a new connection is established.

The issue is related to an insecure parsing implementation of the Intent URI scheme. This could allow attackers to invoke private Activities within the Dolphin Browser by using a malicious Intent URI.

The issue arises from an arbitrary file write vulnerability in the Backup and Restore feature when restoring browser settings from a malicious backup file. This allows an attacker to overwrite a specific executable in the browser's data directory with a crafted malicious executable, which is then executed every time the browser is launched.