CVE-2020-15590 (GCVE-0-2020-15590)

Vulnerability from cvelistv5 – Published: 2020-09-14 21:11 – Updated: 2024-08-04 13:22
VLAI
Summary
A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a “split tunnel” OpenVPN bypass option. The PIA killswitch & associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending & receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:22:29.962Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/sickcodes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sick.codes/cve-2020-15590/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a \u201csplit tunnel\u201d OpenVPN bypass option. The PIA killswitch \u0026 associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending \u0026 receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-14T21:11:35.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sickcodes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sick.codes/cve-2020-15590/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-15590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a \u201csplit tunnel\u201d OpenVPN bypass option. The PIA killswitch \u0026 associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending \u0026 receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/sickcodes",
              "refsource": "MISC",
              "url": "https://github.com/sickcodes"
            },
            {
              "name": "https://sick.codes/cve-2020-15590/",
              "refsource": "MISC",
              "url": "https://sick.codes/cve-2020-15590/"
            },
            {
              "name": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md",
              "refsource": "MISC",
              "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-15590",
    "datePublished": "2020-09-14T21:11:35.000Z",
    "dateReserved": "2020-07-07T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:22:29.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-15590",
      "date": "2026-07-28",
      "epss": "0.02512",
      "percentile": "0.83139"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:privateinternetaccess:private_internet_access_vpn_client:*:*:*:*:*:linux:*:*\", \"versionStartIncluding\": \"1.5.0\", \"versionEndExcluding\": \"2.4.0\", \"matchCriteriaId\": \"EF164CA0-C1B5-4D63-808C-F8840290ED6E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a \\u201csplit tunnel\\u201d OpenVPN bypass option. The PIA killswitch \u0026 associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending \u0026 receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en el Private Internet Access (PIA) VPN Client  para Linux versiones 1.5 hasta 2.3+, permite a atacantes remotos omitir un mecanismo de desconexi\\u00f3n autom\\u00e1tica de VPN previsto y leer informaci\\u00f3n confidencial por medio de la interceptaci\\u00f3n del tr\\u00e1fico de red.\u0026#xa0;A partir de la versi\\u00f3n 1.5, PIA ha admitido una opci\\u00f3n de omisi\\u00f3n de OpenVPN \\u201csplit tunnel\\u201d.\u0026#xa0;El firewall PIA killswitch \u0026amp; associated iptables asociado est\\u00e1 dise\\u00f1ado para protegerle mientras utiliza Internet.\u0026#xa0;Cuando el switch de interrupci\\u00f3n est\\u00e1 configurado para bloquear todo el tr\\u00e1fico de red entrante y saliente, las aplicaciones privilegiadas pueden continuar enviando y recibiendo tr\\u00e1fico de red si net.ipv4.ip_forward ha sido habilitado en los par\\u00e1metros del kernel del sistema.\u0026#xa0;Por ejemplo, un contenedor Docker que se ejecuta en un host con la VPN apagada y el switch de interrupci\\u00f3n encendido puede continuar usando Internet, filtrando la IP del host (CWE 200).\u0026#xa0;En PIA versiones 2.4.0+, El enrutamiento basado en pol\\u00edticas est\\u00e1 habilitado por defecto y es usado para dirigir todos los paquetes reenviados hacia la interfaz VPN autom\\u00e1ticamente\"}]",
      "id": "CVE-2020-15590",
      "lastModified": "2024-11-21T05:05:48.717",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-09-14T22:15:11.503",
      "references": "[{\"url\": \"https://github.com/sickcodes\", \"source\": \"cve@mitre.org\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://sick.codes/cve-2020-15590/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/sickcodes\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://sick.codes/cve-2020-15590/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-15590\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-09-14T22:15:11.503\",\"lastModified\":\"2024-11-21T05:05:48.717\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a \u201csplit tunnel\u201d OpenVPN bypass option. The PIA killswitch \u0026 associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending \u0026 receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en el Private Internet Access (PIA) VPN Client  para Linux versiones 1.5 hasta 2.3+, permite a atacantes remotos omitir un mecanismo de desconexi\u00f3n autom\u00e1tica de VPN previsto y leer informaci\u00f3n confidencial por medio de la interceptaci\u00f3n del tr\u00e1fico de red.\u0026#xa0;A partir de la versi\u00f3n 1.5, PIA ha admitido una opci\u00f3n de omisi\u00f3n de OpenVPN \u201csplit tunnel\u201d.\u0026#xa0;El firewall PIA killswitch \u0026amp; associated iptables asociado est\u00e1 dise\u00f1ado para protegerle mientras utiliza Internet.\u0026#xa0;Cuando el switch de interrupci\u00f3n est\u00e1 configurado para bloquear todo el tr\u00e1fico de red entrante y saliente, las aplicaciones privilegiadas pueden continuar enviando y recibiendo tr\u00e1fico de red si net.ipv4.ip_forward ha sido habilitado en los par\u00e1metros del kernel del sistema.\u0026#xa0;Por ejemplo, un contenedor Docker que se ejecuta en un host con la VPN apagada y el switch de interrupci\u00f3n encendido puede continuar usando Internet, filtrando la IP del host (CWE 200).\u0026#xa0;En PIA versiones 2.4.0+, El enrutamiento basado en pol\u00edticas est\u00e1 habilitado por defecto y es usado para dirigir todos los paquetes reenviados hacia la interfaz VPN autom\u00e1ticamente\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:privateinternetaccess:private_internet_access_vpn_client:*:*:*:*:*:linux:*:*\",\"versionStartIncluding\":\"1.5.0\",\"versionEndExcluding\":\"2.4.0\",\"matchCriteriaId\":\"EF164CA0-C1B5-4D63-808C-F8840290ED6E\"}]}]}],\"references\":[{\"url\":\"https://github.com/sickcodes\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://sick.codes/cve-2020-15590/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/sickcodes\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://sick.codes/cve-2020-15590/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.