CVE-2012-3485
Tunnelblick < 3.3beta20 - Privilege Escalation via argv[0] Pathname Manipulation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-3485.
PoCs published by Metasploit, zx2c4, Jason A. Donenfeld, juan vazquez, including Metasploit module exploits/osx/local/setuid_tunnelblick.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in Tunnelblick 3.2.8 by leveraging insufficient path validation in the setuid openvpnstart binary to execute arbitrary shell scripts as root.
Description
Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.
Exploits (3)
This Metasploit module exploits a privilege escalation vulnerability in Tunnelblick 3.2.8 by leveraging insufficient path validation in the setuid openvpnstart binary to execute arbitrary shell scripts as root.
This exploit leverages a directory traversal vulnerability in Tunnelblick to execute arbitrary code with elevated privileges. It creates a malicious directory structure and symlink to trick the application into executing a payload.
This Metasploit module exploits a privilege escalation vulnerability in Tunnelblick 3.2.8 on macOS. It leverages insufficient path validation in the setuid `openvpnstart` binary to execute arbitrary shell scripts as root.