Privilege Escalation in Tunnelblick by OpenVPN Technology
CVE-2012-3484

Currently unrated

Key Information:

Vendor
Google
Status
Tunnelblick
Vendor
CVE Published:
26 August 2012

Summary

Tunnelblick versions 3.3beta20 and earlier allow local users to bypass intended access restrictions due to insufficient checks on ownership and permissions for executables. This vulnerability enables users to execute arbitrary programs via a user-mountable image or a network share, potentially compromising system integrity and security.

References

http://www.openwall.com/lists/oss-security/2012/08/14/1
mailing-listx_refsource_MLIST
http://code.google.com/p/tunnelblick/issues/detail?id=212
x_refsource_CONFIRM
http://archives.neohapsis.com/archives/fulldisclosure/201...
mailing-listx_refsource_FULLDISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.