CVE-2012-3485

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Tunnelblick - Setuid Privilege Escalation (Metasploit)2013-03-05 · local · osx · Verified
• Tunnelblick - Local Privilege Escalation (2)2012-08-11 · local · osx · Verified

Impact

Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html
• http://code.google.com/p/tunnelblick/issues/detail?id=212
• http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh
• http://www.exploit-db.com/exploits/24578
• http://www.openwall.com/lists/oss-security/2012/08/14/1
• http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html
• http://code.google.com/p/tunnelblick/issues/detail?id=212
• http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh
• http://www.exploit-db.com/exploits/24578
• http://www.openwall.com/lists/oss-security/2012/08/14/1