Tunnel Blick: Multiple Vulnerabilities to Local Root and DoS (OS X)

["Jason A. Donenfeld" <Jason () zx2c4 com>]

Hi,

Tunnel Blick, a popular OpenVPN manager for Macintosh, has several
vulnerabilities in an SUID helper. I'm not sure if this is the place
to report vulnerabilities in Macintosh software, but Tunnel Blick is
open source.

> From the bug report [1] on the vulnerable code [2]:

1. A race condition in file permissions checking can lead to local root.
(PoC: [3])

2. Insufficient checking of merely 0:0 744 can lead to local root on
systems with particular configurations.

3. Insufficient validation of path names can allow for arbitrary
kernel module loading, which can lead to local root.

4. Insufficient validation of path names can allow execution of
arbitrary scripts as root, leading to local root.
(PoC: [4])

5. Insufficient path validation in errorExitIfAttackViaString can lead
to deletion of files as root, leading to DoS.

6. Allowing OpenVPN to run with user given configurations can lead to
local root.

Thanks,
Jason

[1] http://code.google.com/p/tunnelblick/issues/detail?id=212
[2] http://code.google.com/p/tunnelblick/source/browse/trunk/tunnelblick/openvpnstart.m?r=2095
[3] http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker.c
[4] http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh