CVE-2012-3485: google tunnelblick Improper Input Validation
Vulnerability summary
CVE-2012-3485 is a high (CVSS 7.2) Improper Input Validation vulnerability in google tunnelblick. EPSS estimates a 3.78% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 26-08-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.78%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.78% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundTunnelblick - Local Privilege Escalation (2)
Maturity: weaponized
Tunnelblick - Setuid Privilege Escalation (Metasploit)
Maturity: weaponized
Setuid Tunnelblick Privilege Escalation
exploit/osx/local/setuid_tunnelblick
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Google1 product
- tunnelblick≤ 3.3beta20
1 vendor · 1 product
References
5 links- git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.shX Refsource MISC
- code.google.com/p/tunnelblick/issues/detail?id=212X Refsource CONFIRM