CVE-2012-4284: 
Viscosity vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2012-4284) was discovered in Viscosity version 1.4.1 on Mac OS X. The vulnerability exists in the setuid-set ViscosityHelper binary, where insufficient validation of path names could allow a remote malicious user to execute arbitrary code with elevated privileges (Exploit DB, SparkLabs).

The vulnerability exists in the setuid ViscosityHelper component, where inadequate path name validation allows execution of arbitrary python code as root. The issue affects Viscosity version 1.4.1 running on Mac OS X 10.7.5. The vulnerability has been assigned a high severity rating due to its potential for privilege escalation (Exploit DB).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code with root privileges on the affected system. This could lead to complete system compromise, as the attacker would gain the highest level of access privileges on the targeted Mac OS X system (Exploit DB).

A proof-of-concept exploit has been developed and is publicly available. The vulnerability can be exploited by a local user to escalate privileges to root level access. A Metasploit module has been created to exploit this vulnerability, demonstrating its practical exploitability (Exploit DB).

The vulnerability was addressed in subsequent versions of Viscosity. Users should upgrade to a version newer than 1.4.1 to protect against this vulnerability (SparkLabs).