ID de Prueba:	1.3.6.1.4.1.25623.1.0.826955
Categoría:	Privilege escalation
Título:	Sun xVM VirtualBox Privilege Escalation Vulnerability - Windows
Resumen:	Sun xVM VirtualBox is prone to a privilege; escalation vulnerability.
Descripción:	Summary: Sun xVM VirtualBox is prone to a privilege escalation vulnerability. Vulnerability Insight: The flaw exists due to VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object. Vulnerability Impact: Successful exploitation will allow an attacker, with local but un-privileged access to a host where VirtualBox is installed, to execute arbitrary code within the kernel of the Windows host operating system and to gain complete control of a vulnerable computer system. Affected Software/OS: Sun xVM VirtualBox prior to 1.6.4 on Windows. Solution: Upgrade Sun xVM VirtualBox to version 1.6.4 or later. Please see the references for more information. CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-3431 BugTraq ID: 30481 http://www.securityfocus.com/bid/30481 Bugtraq: 20080804 CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability (Google Search) http://www.securityfocus.com/archive/1/495095/100/0/threaded https://www.exploit-db.com/exploits/6218 http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability http://securitytracker.com/id?1020625 http://secunia.com/advisories/31361 http://securityreason.com/securityalert/4107 http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1 http://www.vupen.com/english/advisories/2008/2293 XForce ISS Database: sun-xvmvirtualbox-privilege-escalation(44202) https://exchange.xforce.ibmcloud.com/vulnerabilities/44202
Copyright	Copyright (C) 2023 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.