Vulnerability Description
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openvpn | Openvpn | 2.1.28.0 |
| Privatetunnel | Privatetunnel | 2.3.8 |
Related Weaknesses (CWE)
References
- http://osvdb.org/show/osvdb/109007Broken Link
- http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-EscExploit
- http://www.exploit-db.com/exploits/34037Exploit
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.phpExploit
- https://github.com/CVEProject/cvelist/pull/3909
- https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb
- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c0Third Party Advisory
- http://osvdb.org/show/osvdb/109007Broken Link
- http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-EscExploit
- http://www.exploit-db.com/exploits/34037Exploit
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.phpExploit
- https://github.com/CVEProject/cvelist/pull/3909
- https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb
- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c0Third Party Advisory
FAQ
What is CVE-2014-5455?
CVE-2014-5455 is a vulnerability with a CVSS score of 6.9 (MEDIUM). Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a c...
How severe is CVE-2014-5455?
CVE-2014-5455 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-5455?
Check the references section above for vendor advisories and patch information. Affected products include: Openvpn Openvpn, Privatetunnel Privatetunnel.