PT-2004-1009 · Oracle · Vbox3

Published 2004-02-03 · Updated 2017-10-10 · CVE-2004-0015

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vbox3 versions 0.1.8 and earlier

Description The issue allows local users to gain privileges due to improper privilege dropping before executing a user-provided TCL script. Additionally, multiple vulnerabilities in the vbox3 package may lead to breaches of confidentiality, integrity, and availability of protected information, potentially exploitable by local attackers.

Recommendations For versions 0.1.8 and earlier, consider disabling the execution of user-provided TCL scripts until a proper fix is applied to ensure privilege dropping. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02017

CVE-2004-0015

DSA-418

Affected Products

Vbox3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0015 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0015 · Security Note
• http://debian.org/security/2004/dsa-418 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02017 · Security Note
• http://securityfocus.com/bid/9381 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14170 · Note
• http://debian.org/security/dsa-418 · Note