Sun xVM VirtualBox Privilege Escalation Vulnerability

1. Advisory Information Title: Sun xVM VirtualBox Privilege Escalation Vulnerability Advisory ID: CORE-2008-0716 Advisory URL:http://www.coresecurity.com/core-labs/advisories/virtualbox-privilege-escalation-vulnerability Date published: 2008-08-04 Date of last update: 2008-08-04 Vendors contacted...

Solaris 10 (sparc) : 119725-06 (deprecated)

Sun JavaTM System LDAP Java Development Kit 4.21: patch for Sola. Date this patch was last updated by Sun : Sep/19/08 This plugin has been deprecated and either replaced with individual 119725 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security,...

Solaris 10 (sparc) : 138536-01 (deprecated)

Service Provisioning System 6.0: N1 SPS Webserver 7 Plug-in Patch. Date this patch was last updated by Sun : Jul/18/08 This plugin has been deprecated and either replaced with individual 138536 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security,...

Solaris 8 (sparc) : 119725-06

Sun JavaTM System LDAP Java Development Kit 4.21: patch for Sola. Date this patch was last updated by Sun : Sep/19/08 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 8 (sparc) : 138536-01

Service Provisioning System 6.0: N1 SPS Webserver 7 Plug-in Patch. Date this patch was last updated by Sun : Jul/18/08 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Core Security Technologies Advisory 2008.0716

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Sun xVM VirtualBox Privilege Escalation Vulnerability Advisory Information Title: Sun xVM VirtualBox Privilege Escalation Vulnerability Advisory ID: CORE-2008-0716...

Solaris 9 (x86) : 138536-01

Service Provisioning System 6.0: N1 SPS Webserver 7 Plug-in Patch. Date this patch was last updated by Sun : Jul/18/08 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 8 (sparc) : 112169-07

SunOS 5.8: platmod patch for Volume System H/W Series Products. Date this patch was last updated by Sun : Jul/23/08 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Design/Logic Flaw

Sun Java 1.6.003 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

Sun Java 1.6.003 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

Sun Java 1.6.003 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

Sun Java 1.6.003 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

CVE-2008-3440 affects Sun Java 1.6.0_03 and earlier (potentially later versions) where updater authenticity is not properly verified, enabling a man-in-the-middle attacker to run arbitrary code via a Trojan horse update (as demonstrated by evilgrade and DNS cache poisoning). The connected sources...

CVE-2008-3426

Unspecified vulnerability in the Solaris Platform Information and Control Library daemon picld in Sun Solaris 8 through 10, and OpenSolaris builds snv01 through snv95, allows local users to cause a denial of service via unknown vectors that prevent operation of utilities such as prtdiag, prtpicl,...

CVE-2008-3425

Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System SPS 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors...

Code injection

Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System SPS 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors...

CVE-2008-3425

Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System SPS 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors...

CVE-2008-3425

The vulnerability described in CVE-2008-3425 affects the Sun Java System Web Server 7.0 plugin within Sun N1 Service Provisioning System (SPS) versions 5.2 and 6.0. The issue allows remote authenticated SPS users to gain administrative access to the web server via unspecified attack vectors. The ...

security flaw

Unspecified vulnerability in Sun Java Runtime Environment JRE in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted 1 application or 2 applet, a different...

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077...