Vulnerabilities > CVE-2008-3431 - Unspecified vulnerability in Oracle Virtualbox 1.6.0/1.6.2

047910
CVSS 8.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
oracle
nessus
exploit available
NVD
Published: 2008-08-05
Updated: 2024-07-16

Summary

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Vulnerable Configurations

Part Description Count
Application
Oracle
3

Exploit-Db

descriptionSun xVM VirtualBox < 1.6.4 Privilege Escalation Vulnerability PoC. CVE-2008-3431. Dos exploits for multiple platform
fileexploits/multiple/dos/6218.txt
idEDB-ID:6218
last seen2016-02-01
modified2008-08-10
platformmultiple
port
published2008-08-10
reporterCore Security
sourcehttps://www.exploit-db.com/download/6218/
titleSun xVM VirtualBox < 1.6.4 - Privilege Escalation Vulnerability PoC
typedos

Nessus

NASL familyWindows
NASL idVIRTUALBOX_1_6_4.NASL
descriptionThe remote host contains a version of Sun xVM VirtualBox, an open source virtualization platform, before 1.6.4. Such versions reportedly include a kernel driver,
last seen2020-06-01
modified2020-06-02
plugin id33819
published2008-08-05
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/33819
titleSun xVM VirtualBox < 1.6.4 Local Privilege Escalation

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/68826/CORE-2008-0716.txt
idPACKETSTORM:68826
last seen2016-12-05
published2008-08-04
reporterCore Security Technologies
sourcehttps://packetstormsecurity.com/files/68826/Core-Security-Technologies-Advisory-2008.0716.html
titleCore Security Technologies Advisory 2008.0716

Seebug

  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:65642
    last seen2017-11-19
    modified2014-07-01
    published2014-07-01
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-65642
    titleSun xVM VirtualBox < 1.6.4 Privilege Escalation Vulnerability PoC
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:9270
    last seen2017-11-19
    modified2008-08-11
    published2008-08-11
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-9270
    titleSun xVM VirtualBox &lt; 1.6.4 Privilege Escalation Vulnerability PoC
  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 30481 CVE ID:CVE-2008-3431 CNCVE ID：CNCVE-20083431 Sun xVM VirtualBox是一款功能强大的虚拟机程序。 Sun xVM VirtualBox存在设计错误，本地攻击者可以利用漏洞提升特权。 当处理部分IOCTLs时VBoxDrv.sys驱动中存在错误，可导致在受影响宿主上以内核进程权限执行任意指令。 当VirtualBox安装在主机上时将装载VBoxDrv.sys驱动，驱动允许非特权用户打开设备\\.\VBoxDrv，并在没有任何验证的情况下使用METHOD_NEITHER缓冲模式提交IOCTLs。这允许不可信用户模式代码传递任意内核地址作为参数给驱动处理。构建特殊的输入，恶意用户可以以内核进程权限执行任意指令。 Sun xVM VirtualBox 1.6.2 Sun xVM VirtualBox 1.6 可升级到Sun xVM VirtualBox 1.6.4： <a href=http://virtualbox.org/wiki/Changelog target=_blank>http://virtualbox.org/wiki/Changelog</a>
    idSSV:3793
    last seen2017-11-19
    modified2008-08-06
    published2008-08-06
    reporterRoot
    titleSun xVM VirtualBox 'VBoxDrv.sys'本地特权提升漏洞

References