Date: Sat, 11 Aug 2012 17:31:23 +0200 From: "Jason A. Donenfeld" <Jason@...c4.com> To: oss-security <oss-security@...ts.openwall.com> Subject: Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X) Hi, Tunnel Blick, a popular OpenVPN manager for Macintosh, has several vulnerabilities in an SUID helper. I'm not sure if this is the place to report vulnerabilities in Macintosh software, but Tunnel Blick is open source. >From the bug report  on the vulnerable code : 1. A race condition in file permissions checking can lead to local root. (PoC: ) 2. Insufficient checking of merely 0:0 744 can lead to local root on systems with particular configurations. 3. Insufficient validation of path names can allow for arbitrary kernel module loading, which can lead to local root. 4. Insufficient validation of path names can allow execution of arbitrary scripts as root, leading to local root. (PoC: ) 5. Insufficient path validation in errorExitIfAttackViaString can lead to deletion of files as root, leading to DoS. 6. Allowing OpenVPN to run with user given configurations can lead to local root. Thanks, Jason  http://code.google.com/p/tunnelblick/issues/detail?id=212  http://code.google.com/p/tunnelblick/source/browse/trunk/tunnelblick/openvpnstart.m?r=2095  http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker.c  http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.