CVE-2019-14899
HIGH
7,4
Source: [email protected]
Attack Vector: adjacent_network
Attack Complexity: low
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
MEDIUM
4,9
Source: [email protected]
Access Vector: adjacent_network
Access Complexity: medium
Authentication: single
Confidentiality: partial
Integrity: partial
Availability: partial
Description
AI Translation Available
A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0005
Percentile
0,2th
Updated
EPSS Score Trend (Last 90 Days)
300
Channel Accessible by Non-Endpoint
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Potential Impacts:
Read Application Data
Modify Application Data
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
Operating System
Iphone Os by Apple
Version Range Affected
To
13.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Freebsd by Freebsd
CPE Identifier
View Detailed Analysis
cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Openbsd by Openbsd
CPE Identifier
View Detailed Analysis
cpe:2.3:o:openbsd:openbsd:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ipados by Apple
Version Range Affected
To
13.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Tvos by Apple
Version Range Affected
To
13.4.8
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Macos by Apple
CPE Identifier
View Detailed Analysis
cpe:2.3:o:apple:macos:11.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Mac Os X by Apple
Version Range Affected
To
10.15.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14899
http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2020/Jul/23
http://seclists.org/fulldisclosure/2020/Jul/24
http://seclists.org/fulldisclosure/2020/Jul/25
http://seclists.org/fulldisclosure/2020/Nov/20
https://openvpn.net/security-advisory/no-flaws-found-in-openvpn-software/
https://support.apple.com/kb/HT211288
https://support.apple.com/kb/HT211289
https://support.apple.com/kb/HT211290
https://support.apple.com/kb/HT211850
https://support.apple.com/kb/HT211931
http://www.openwall.com/lists/oss-security/2020/08/13/2
http://www.openwall.com/lists/oss-security/2020/10/07/3
http://www.openwall.com/lists/oss-security/2021/07/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14899
http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2020/Jul/23
http://seclists.org/fulldisclosure/2020/Jul/24
http://seclists.org/fulldisclosure/2020/Jul/25
http://seclists.org/fulldisclosure/2020/Nov/20
https://openvpn.net/security-advisory/no-flaws-found-in-openvpn-software/
https://support.apple.com/kb/HT211288
https://support.apple.com/kb/HT211289
https://support.apple.com/kb/HT211290
https://support.apple.com/kb/HT211850
https://support.apple.com/kb/HT211931
http://www.openwall.com/lists/oss-security/2020/08/13/2
http://www.openwall.com/lists/oss-security/2020/10/07/3
http://www.openwall.com/lists/oss-security/2021/07/05/1