Vulnerabilities > CVE-2013-5987

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
nvidia
apple
nessus

Summary

Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restrictions for the GPU and gain privileges via unknown vectors.

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201402-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201402-02 (NVIDIA Drivers: Privilege Escalation) The vulnerability is caused due to the driver allowing unprivileged user-mode software to access the GPU. Impact : A local attacker could gain escalated privileges. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id72255
    published2014-02-03
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72255
    titleGLSA-201402-02 : NVIDIA Drivers: Privilege Escalation
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201402-02.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(72255);
      script_version("1.12");
      script_cvs_date("Date: 2018/07/12 19:01:15");
    
      script_cve_id("CVE-2013-5986", "CVE-2013-5987");
      script_bugtraq_id(64525, 65208);
      script_xref(name:"GLSA", value:"201402-02");
    
      script_name(english:"GLSA-201402-02 : NVIDIA Drivers: Privilege Escalation");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201402-02
    (NVIDIA Drivers: Privilege Escalation)
    
        The vulnerability is caused due to the driver allowing unprivileged
          user-mode software to access the GPU.
      
    Impact :
    
        A local attacker could gain escalated privileges.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201402-02"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All NVIDIA Drivers users using the 331 branch should upgrade to the
          latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=x11-drivers/nvidia-drivers-331.20'
        All NVIDIA Drivers users using the 319 branch  should upgrade to the
          latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=x11-drivers/nvidia-drivers-319.76'
        All NVIDIA Drivers users using the 304 branch should upgrade to the
          latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=x11-drivers/nvidia-drivers-304.116'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:nvidia-drivers");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/02/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/03");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"x11-drivers/nvidia-drivers", unaffected:make_list("ge 331.20", "rge 319.76", "rge 304.116", "rge 304.119", "rge 304.121"), vulnerable:make_list("lt 331.20"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NVIDIA Drivers");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_9_2.NASL
    descriptionThe remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.2. This update contains several security-related fixes for the following components : - Apache - ATS - Certificate Trust Policy - CoreAnimation - CoreText - curl - Data Security - Date and Time - File Bookmark - Finder - ImageIO - NVIDIA Drivers - PHP - QuickLook - QuickTime Note that successful exploitation of the most serious issues could result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id72687
    published2014-02-25
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72687
    titleMac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities
  • NASL familyMisc.
    NASL idNVIDIA_UNIX_CVE_2013_5987.NASL
    descriptionThe remote host has a driver installed that is affected by an unspecified, local privilege escalation vulnerability. Using the vulnerability, it may be possible for a local attacker to gain complete control of the system.
    last seen2020-06-01
    modified2020-06-02
    plugin id72484
    published2014-02-13
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72484
    titleNVIDIA Graphics Driver Unspecified Privilege Escalation (Unix / Linux)
  • NASL familyWindows
    NASL idNVIDIA_CVE_2013_5987.NASL
    descriptionThe remote host has a driver installed that is affected by an unspecified, local privilege escalation vulnerability. Using the vulnerability, it may be possible for a local attacker to gain complete control of the system.
    last seen2020-06-01
    modified2020-06-02
    plugin id72483
    published2014-02-13
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72483
    titleNVIDIA Graphics Driver Unspecified Privilege Escalation (Windows)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2014-001.NASL
    descriptionThe remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-001 applied. This update contains several security-related fixes for the following components : - Apache - App Sandbox - ATS - Certificate Trust Policy - CFNetwork Cookies - CoreAnimation - Date and Time - File Bookmark - ImageIO - IOSerialFamily - LaunchServices - NVIDIA Drivers - PHP - QuickLook - QuickTime - Secure Transport Note that successful exploitation of the most serious issues could result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id72688
    published2014-02-25
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72688
    titleMac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)