PT-2012-5544 · Tunnelblick · Tunnelblick

Published 2012-08-26 · Updated 2012-08-27 · CVE-2012-4677

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tunnelblick versions 3.3beta20 and earlier

Description The issue allows local users to gain privileges by using a crafted Info.plist file to control the gOkIfNotSecure value.

Recommendations For Tunnelblick versions 3.3beta20 and earlier, update to a version later than 3.3beta20 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4677

Affected Products

Tunnelblick

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2012-4677 · Security Note
• http://code.google.com/p/tunnelblick/issues/detail?id=212 · Note