Sun xVM VirtualBox < 1.6.4 Local Privilege Escalation

High Nessus Plugin ID 33819


The remote Windows host has an application that is affected by a local privilege escalation vulnerability.


The remote host contains a version of Sun xVM VirtualBox, an open source virtualization platform, before 1.6.4. Such versions reportedly include a kernel driver, 'VBoxDrv.sys', that allows a local user to open the device '\\.\VBoxDrv' and issue IOCTLs with a buffering method of 'METHOD_NEITHER' without any validation. Using specially crafted input, an unprivileged user can leverage this issue to execute arbitrary code in kernel mode.


Upgrade to Sun xVM VirtualBox 1.6.4 or later.

See Also

Plugin Details

Severity: High

ID: 33819

File Name: virtualbox_1_6_4.nasl

Version: $Revision: 1.11 $

Type: local

Agent: windows

Family: Windows

Published: 2008/08/05

Modified: 2017/06/12

Dependencies: 13855

Risk Information

Risk Factor: High


Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:sun:xvm_virtualbox

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information

CVE: CVE-2008-3431

BID: 30481

OSVDB: 47424

Secunia: 31361

CWE: 264