PT-2004-1009 · Oracle · Vbox3

Publicado 2004-02-03 · Atualizado 2017-10-10 · CVE-2004-0015

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vbox3 versions 0.1.8 and earlier

Description The issue allows local users to gain privileges due to improper privilege dropping before executing a user-provided TCL script. Additionally, multiple vulnerabilities in the vbox3 package may lead to breaches of confidentiality, integrity, and availability of protected information, potentially exploitable by local attackers.

Recommendations For versions 0.1.8 and earlier, consider disabling the execution of user-provided TCL scripts until a proper fix is applied to ensure privilege dropping. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-02017

CVE-2004-0015

DSA-418

Produtos afetados

Vbox3

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0015 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0015 · Nota de Segurança
• http://debian.org/security/2004/dsa-418 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14170 · Nota
• https://bdu.fstec.ru/vul/2015-02017 · Nota de Segurança
• http://securityfocus.com/bid/9381 · Aviso do Fabricante
• http://debian.org/security/dsa-418 · Nota