CVE-2012-3485

Published: Aug 26, 2012Modified: Apr 29, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.

Affected (1)

Products: Google: Tunnelblick

Google

1 product

Tunnelblick

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Tunnelblick	Up to 3.3beta20

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html

Source: secalert@redhat.com

http://code.google.com/p/tunnelblick/issues/detail?id=212

Source: secalert@redhat.com

http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh

Source: secalert@redhat.com

http://www.exploit-db.com/exploits/24578

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/08/14/1

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html