Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2008-3431
HistoryAug 05, 2008 - 7:41 p.m.

CVE-2008-3431

2008-08-0519:41:00
mitre
web.nvd.nist.gov
853
In Wild
vboxdrvntdevicecontrol
vboxdrv.sys
sun xvm virtualbox
nvd
cve-2008-3431
ioctl
buffer validation
local privilege escalation

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

57.8%

JSON

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Affected configurations

Nvd
Node
oraclevirtualboxRange<1.6.4
VendorProductVersionCPE
oraclevirtualbox*cpe:2.3:a:oracle:virtualbox:*:*:*:*:*:*:*:*

Related

prion 1
securityvulns 2
packetstorm 1
ubuntucve 1
nessus 1
openvas 1
seebug 3
cisa_kev 1
carbonblack 1
exploitpack 1
cvelist 1
attackerkb 1
exploitdb 1
nvd 1
zdt 1
threatpost 2
securelist 1
mssecure 2
mmpc 1
rapid7blog 1
prion
prion
Design/Logic Flaw
2008-08-05 19:41:00
securityvulns
securityvulns
CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability
2008-08-07 00:00:00
Sun xVM privilege escalation
2008-08-07 00:00:00
packetstorm
packetstorm
Core Security Technologies Advisory 2008.0716
2008-08-04 00:00:00
ubuntucve
ubuntucve
CVE-2008-3431
2008-08-05 00:00:00
nessus
nessus
Sun xVM VirtualBox < 1.6.4 Local Privilege Escalation
2008-08-05 00:00:00
openvas
openvas
Sun xVM VirtualBox Privilege Escalation Vulnerability - Windows
2023-03-29 00:00:00
seebug
seebug
Sun xVM VirtualBox 'VBoxDrv.sys'本地特权提升漏洞
2008-08-06 00:00:00
Sun xVM VirtualBox &lt; 1.6.4 Privilege Escalation Vulnerability PoC
2008-08-11 00:00:00
Sun xVM VirtualBox < 1.6.4 Privilege Escalation Vulnerability PoC
2014-07-01 00:00:00
cisa_kev
cisa_kev
Oracle VirtualBox Insufficient Input Validation Vulnerability
2022-03-03 00:00:00
carbonblack
carbonblack
Threat Analysis Unit (TAU) Technical Report: The Prospect of Iranian Cyber Retaliation
2020-01-21 18:41:46
exploitpack
exploitpack
Sun xVM VirtualBox 1.6.4 - Privilege Escalation (PoC)
2008-08-10 00:00:00
cvelist
cvelist
CVE-2008-3431
2008-08-05 19:20:00
attackerkb
attackerkb
CVE-2008-3431
2008-08-05 00:00:00
exploitdb
exploitdb
Sun xVM VirtualBox &lt; 1.6.4 - Privilege Escalation (PoC)
2008-08-10 00:00:00
nvd
nvd
CVE-2008-3431
2008-08-05 19:41:00
zdt
zdt
Sun xVM VirtualBox < 1.6.4 Privilege Escalation Vulnerability PoC
2008-08-10 00:00:00
threatpost
threatpost
AcidBox Malware Uncovered Using Repurposed VirtualBox Exploit
2020-06-17 22:12:04
BYO-Bug Tactic Attacks Windows Kernel with Outdated Driver
2020-02-10 21:07:34
securelist
securelist
APT trends report Q2 2020
2020-07-29 10:00:09
mssecure
mssecure
Secured-core PCs: A brief showcase of chip-to-cloud security against kernel attacks
2020-03-17 16:00:49
Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center
2021-12-08 17:00:58
mmpc
mmpc
Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center
2021-12-08 17:00:58
rapid7blog
rapid7blog
Driver-Based Attacks: Past and Present
2021-12-13 14:00:00

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

57.8%

JSON
Related for CVE-2008-3431
prion1securityvulns2packetstorm1ubuntucve1nessus1openvas1seebug3cisa_kev1carbonblack1exploitpack1cvelist1attackerkb1exploitdb1nvd1zdt1threatpost2securelist1mssecure2mmpc1rapid7blog1