{"uuid": "1c07e2e3-46bb-4d34-97ec-b1b528a7627c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-3485", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/setuid_tunnelblick.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Jason A. Donenfeld\", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in Tunnelblick 3.2.8 on Mac OS X. The\\n            vulnerability exists in the setuid openvpnstart, where an insufficient\\n            validation of path names allows execution of arbitrary shell scripts as root.\\n            This module has been tested successfully on Tunnelblick 3.2.8 build 2891.3099\\n            over Mac OS X 10.7.5.\", \"disclosure_date\": \"2012-08-11\", \"fullname\": \"exploit/osx/local/setuid_tunnelblick\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"Setuid Tunnelblick Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/osx/local/setuid_tunnelblick.rb\", \"platform\": \"OSX\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"osx/local/setuid_tunnelblick\", \"references\": [\"CVE-2012-3485\", \"OSVDB-84706\", \"EDB-20443\", \"URL-http://blog.zx2c4.com/791\"], \"rport\": null, \"session_types\": [\"shell\"], \"targets\": [\"Tunnelblick 3.2.8 / Mac OS X x86\", \"Tunnelblick 3.2.8 / Mac OS X x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:31.839027Z"}