Lucene search

[email protected]CVE-2009-0876

HistoryMar 12, 2009 - 3:20 p.m.

CVE-2009-0876

2009-03-1215:20:49

CWE-59

[email protected]

web.nvd.nist.gov

cve-2009-0876

sun xvm virtualbox

linux

privileges

hardlink attack

setuid

setgid

dt_rpath

nvd

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.8%

JSON

Sun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux allows local users to gain privileges via a hardlink attack, which preserves setuid/setgid bits on Linux, related to DT_RPATH:$ORIGIN.

Affected configurations

NVD

Node

sunxvm_virtualboxMatch2.0.0

sunxvm_virtualboxMatch2.0.2

sunxvm_virtualboxMatch2.0.4

sunxvm_virtualboxMatch2.0.6r39760

sunxvm_virtualboxMatch2.1.0

sunxvm_virtualboxMatch2.1.2

sunxvm_virtualboxMatch2.1.4r42893

AND

linuxlinux_kernel

CPENameOperatorVersion
sun:xvm_virtualboxsun xvm virtualboxeq2.0.0
sun:xvm_virtualboxsun xvm virtualboxeq2.0.2
sun:xvm_virtualboxsun xvm virtualboxeq2.0.4
sun:xvm_virtualboxsun xvm virtualboxeq2.0.6r39760
sun:xvm_virtualboxsun xvm virtualboxeq2.1.0
sun:xvm_virtualboxsun xvm virtualboxeq2.1.2
sun:xvm_virtualboxsun xvm virtualboxeq2.1.4r42893

CPE	Name	Operator	Version
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.0.0
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.0.2
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.0.4
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.0.6r39760
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.1.0
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.1.2
sun:xvm_virtualbox	sun xvm virtualbox	eq	2.1.4r42893

References

osvdb.org/52580

secunia.com/advisories/34232

sunsolve.sun.com/search/document.do?assetkey=1-66-254568-1

www.openwall.com/lists/oss-security/2009/03/15/1

www.openwall.com/lists/oss-security/2009/03/17/2

www.securityfocus.com/bid/34080

www.securitytracker.com/id?1021841

www.virtualbox.org/ticket/3444

www.vupen.com/english/advisories/2009/0674

bugs.gentoo.org/show_bug.cgi?id=260331

exchange.xforce.ibmcloud.com/vulnerabilities/49193

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.8%

JSON

Related for CVE-2009-0876

prion1 nvd1 cvelist1