Unscored CVE-2012-4676 EUVD-2012-4601GHSA-rvmj-pg73-4rvj

The errorExitIfAttackViaString function in Tunnelblick 3.3beta20 and earlier allows local users to delete arbitrary files by constructing a…

Published Aug 26, 2012 · Updated Sep 16, 2024 · Assigned by mitre

Description

The errorExitIfAttackViaString function in Tunnelblick 3.3beta20 and earlier allows local users to delete arbitrary files by constructing a (1) symlink or (2) hard link, a different vulnerability than CVE-2012-3485.

References

[oss-security] 20120812 Re: Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X) mailing-list
http://code.google.com/p/tunnelblick/issues/detail?id=212
20120811 OS X Local Root: Silly SUID Helper in Tunnel Blick mailing-list