Local Privilege Escalation in Tunnelblick by OpenVPN

CVE-2012-3485

Summary

Tunnelblick versions 3.3beta20 and earlier use argv[0] to determine the appropriate kernel module and executable file paths. This insecure reliance allows local users to exploit this behavior through an execl system call, potentially gaining elevated privileges on the system. Proper validation and handling of input parameters are critical to mitigate this vulnerability.

References