VBox Communications Satellite Express Protocol 2.3.17.3 ndvbs 0x00000ffd Memory privileges management

Summaryinfo

A vulnerability has been found in VBox Communications Satellite Express Protocol 2.3.17.3 and classified as problematic. This issue affects some unknown processing of the component ndvbs Module. This manipulation of the argument 0x00000ffd as part of IOCTL Call causes privileges management (Memory). This vulnerability appears as CVE-2015-6923. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in VBox Communications Satellite Express Protocol 2.3.17.3. It has been declared as problematic. Affected by this vulnerability is an unknown part of the component ndvbs Module. The manipulation of the argument 0x00000ffd as part of a IOCTL Call leads to a privileges management vulnerability (Memory). The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x00000ffd ioctl call.

The weakness was presented 09/21/2015 (Website). It is possible to read the advisory at korelogic.com. This vulnerability is known as CVE-2015-6923 since 09/12/2015. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A public exploit has been developed by KoreLogic and been published even before and not after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (38225). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• VBox Communications Satellite Express Protocol

Version

• 2.3.17.3

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion