Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-3485

CWE-20 — Improper Input Validation5 documents4 sources
Severity
7.2HIGH
EPSS
27.8%
top 3.55%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Google Tunnelblick
Timeline
PublishedAug 26
Latest updateMay 17

Description

Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

▶NVDgoogle/tunnelblick3.3beta20

🔴Vulnerability Details

2
GHSA
GHSA-5x92-v869-v38r: Tunnelblick 3↗2022-05-17
▶
CVEList
CVE-2012-3485: Tunnelblick 3↗2012-08-26
▶

💥Exploits & PoCs

2
Exploit-DB
Tunnelblick - Setuid Privilege Escalation (Metasploit)↗2013-03-05
▶
Exploit-DB
Tunnelblick - Local Privilege Escalation (2)↗2012-08-11
▶
CVE-2012-3485 (HIGH CVSS 7.2) | Tunnelblick 3.3beta20 and earlier r | cvebase.io