mailing list archives
Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X)
From: "Jason A. Donenfeld" <Jason () zx2c4 com>
Date: Sat, 11 Aug 2012 17:31:23 +0200
Tunnel Blick, a popular OpenVPN manager for Macintosh, has several
vulnerabilities in an SUID helper. I'm not sure if this is the place
to report vulnerabilities in Macintosh software, but Tunnel Blick is
From the bug report  on the vulnerable code :
1. A race condition in file permissions checking can lead to local root.
2. Insufficient checking of merely 0:0 744 can lead to local root on
systems with particular configurations.
3. Insufficient validation of path names can allow for arbitrary
kernel module loading, which can lead to local root.
4. Insufficient validation of path names can allow execution of
arbitrary scripts as root, leading to local root.
5. Insufficient path validation in errorExitIfAttackViaString can lead
to deletion of files as root, leading to DoS.
6. Allowing OpenVPN to run with user given configurations can lead to
- Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X) Jason A. Donenfeld (Aug 11)