oss-security - Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHmME9rSFPhj_GizgrpeS2mXX9bpyX0yE7vWWK+mgDrxk2UXrA@mail.gmail.com>
Date: Sat, 11 Aug 2012 17:31:23 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X)

Hi,

Tunnel Blick, a popular OpenVPN manager for Macintosh, has several
vulnerabilities in an SUID helper. I'm not sure if this is the place
to report vulnerabilities in Macintosh software, but Tunnel Blick is
open source.

>From the bug report [1] on the vulnerable code [2]:

1. A race condition in file permissions checking can lead to local root.
(PoC: [3])

2. Insufficient checking of merely 0:0 744 can lead to local root on
systems with particular configurations.

3. Insufficient validation of path names can allow for arbitrary
kernel module loading, which can lead to local root.

4. Insufficient validation of path names can allow execution of
arbitrary scripts as root, leading to local root.
(PoC: [4])

5. Insufficient path validation in errorExitIfAttackViaString can lead
to deletion of files as root, leading to DoS.

6. Allowing OpenVPN to run with user given configurations can lead to
local root.

Thanks,
Jason

[1] http://code.google.com/p/tunnelblick/issues/detail?id=212
[2] http://code.google.com/p/tunnelblick/source/browse/trunk/tunnelblick/openvpnstart.m?r=2095
[3] http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker.c
[4] http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.