CVE-2023-36673
📋 TL;DR
This vulnerability in Avira Phantom VPN for macOS allows attackers to bypass VPN encryption and redirect traffic to arbitrary IP addresses in plaintext. It affects users of Avira Phantom VPN on macOS through version 2.23.1. The attack combines DNS spoofing with improper routing configuration to leak traffic outside the VPN tunnel.
💻 Affected Systems
- Avira Phantom VPN
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
All VPN-protected traffic is intercepted and redirected to attacker-controlled servers, exposing sensitive data like credentials, financial information, and private communications.
Likely Case
Targeted attacks against specific users to intercept their VPN traffic, potentially exposing login credentials and sensitive browsing activity.
If Mitigated
Limited exposure if using updated software, network monitoring detects unusual traffic patterns, and users avoid untrusted networks.
🎯 Exploit Status
Exploitation requires DNS spoofing capability and network access to intercept/modify traffic. The TunnelCrack research website provides technical details and demonstration of the attack pattern.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.23.1
Vendor Advisory: https://www.avira.com/en/free-vpn
Restart Required: Yes
Instructions:
1. Open Avira Phantom VPN application. 2. Check for updates in settings/preferences. 3. Install any available updates. 4. Restart the VPN client. 5. Verify you're running a version newer than 2.23.1.
🔧 Temporary Workarounds
Use alternative VPN client
allSwitch to a different VPN provider that is not vulnerable to ServerIP attacks
Configure DNS manually
macOSUse secure DNS servers (like Cloudflare 1.1.1.1 or Google 8.8.8.8) and disable automatic DNS configuration
sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1
🧯 If You Can't Patch
- Discontinue use of Avira Phantom VPN on macOS until patched
- Use only on trusted networks and avoid public Wi-Fi while VPN is active
🔍 How to Verify
Check if Vulnerable:
Check Avira Phantom VPN version in application settings. If version is 2.23.1 or earlier, you are vulnerable.Check Version:
Open Avira Phantom VPN → Settings/Preferences → About or check application version in macOS Applications folderVerify Fix Applied:
Verify version is newer than 2.23.1. Test VPN connection and verify all traffic is routed through VPN tunnel using tools like Wireshark or tcpdump.📡 Detection & Monitoring
Log Indicators:
- Unusual DNS queries for VPN server domains
- VPN client connection failures followed by plaintext connections
Network Indicators:
- Traffic to VPN server IP outside encrypted tunnel
- DNS responses with unusual TTL values for VPN domains
- Plaintext traffic to IP addresses that should be tunneled
SIEM Query:
source="vpn_client.log" AND ("connection reset" OR "dns failure") OR dest_ip="vpn_server_ip" AND NOT protocol="ESP" AND NOT protocol="IKE"