NVD

Id
3312  
Name
CVE-2008-3431  
Description
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \.VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-08-05  
Modified Date
2011-03-07  
Seq
2008-3431  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
20852 3312 CVE-2008-3431 4107  View
20853 3312 CVE-2008-3431 1020625  View
20854 3312 CVE-2008-3431 240095  View
20855 3312 CVE-2008-3431 http://virtualbox.org/wiki/Changelog  View
20856 3312 CVE-2008-3431 http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability  View
20857 3312 CVE-2008-3431 6218  View
20858 3312 CVE-2008-3431 20080804 CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability  View
20859 3312 CVE-2008-3431 30481  View
20860 3312 CVE-2008-3431 ADV-2008-2293  View
20861 3312 CVE-2008-3431 sun-xvmvirtualbox-privilege-escalation(44202)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
50781 JVNDB-2008-006091 IOCTL 用の METHOD_NEITHER 通信メソッドで使用されている Sun xVM VirtualBox における権限を取得される脆弱性 IOCTL 用の METHOD_NEITHER 通信メソッドで使用されている Sun xVM VirtualBox の VBoxDrv.sys の VBoxDrvNtDeviceControl 関数は、Irp オブジェクトと関連付けされたバッファを適切に検証しないため、権限を取得される脆弱性が存在します。 CVE-2008-3431 33544 CVE-2008-3431 3312 7.2 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006091.html 2008-08-05 2012-12-20 View