{"id":12101,"date":"2019-12-11T12:07:08","date_gmt":"2019-12-11T20:07:08","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=12101"},"modified":"2021-07-20T13:09:43","modified_gmt":"2021-07-20T20:09:43","slug":"private-internet-access-updates-linux-desktop-client-to-prevent-against-cve-2019-14899","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/private-internet-access-updates-linux-desktop-client-to-prevent-against-cve-2019-14899\/","title":{"rendered":"Private Internet Access updates Linux desktop client to prevent against [CVE-2019-14899]"},"content":{"rendered":"

The Breakpointing Bad team at the University of New Mexico recently reported a VPN vulnerability that affects Linux, MacOS, iOS, Android, and more. The vulnerability allows malicious actors to not only see your VPN IP address, but also identify sites you are visiting and inject data into connections. The team consists of William J. Tolley, Beau Kujath, and Jedidiah R. Crandall and the public was notified on December 4th, 2019. Designated [CVE-2019-14899], the vulnerability shook the VPN industry due to the breadth of affected systems. [CVE-2019-14899] affects many different types of VPN protocols including OpenVPN, WireGuard, and IKEv2\/IPSec.\u00a0<\/span><\/p>\n

Private Internet Access has released an update to its Linux client<\/a> that mitigates [CVE-2019-14899] from being used to infer any information about our users\u2019 VPN connections. To our knowledge, Private Internet Access is the first commercial VPN to release a new client that prevents this ongoing security vulnerability.<\/span><\/p>\n

Private Internet Access patches for [CVE-2019-14899] VPN vulnerability on Linux<\/span><\/h2>\n

The researchers summarized the vulnerability in their disclosure that was sent to affected parties:<\/span><\/p>\n

\u201cWe have discovered a vulnerability in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android which allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.\u201d<\/span><\/p>\n

Essentially, the vulnerability allows attackers such as your internet service provider or even anyone on your network to inject data into the VPN connection using a three step process.\u00a0<\/span><\/p>\n

When the researchers tested the vulnerability on Linux, they found that most Linux distros were vulnerable. The vulnerability also affects IPv6. Confirmed affected systems include the following, though the list is in no way exhaustive:<\/span><\/p>\n