oss-sec mailing list archives
Re: CVE-2009-0876 (VirtualBox) references
From: Nico Golde <oss-security+ml () ngolde de>
Date: Tue, 17 Mar 2009 16:23:20 +0100
Hi, * Robert Buchholz <rbu () gentoo org> [2009-03-16 01:57]:
Sun released an advisory for VirtualBox referenced for CVE-2009-0876 recently: http://sunsolve.sun.com/search/document.do?assetkey=1-66-254568-1 However, details are missing and patch information is (unintentionally) obfuscated due to inconsistent revision numbers in the public svn vs. internal build revisions. The original bug report for Gentoo and upstream were here: https://bugs.gentoo.org/show_bug.cgi?id=260331
[...] Any reason the CVE description says "Unspecified vulnerability...via unknown vectors"? Looking at the Gentoo bug report[0] it seems obvious to me that this is caused by insecurely loading shared libraries so you can inject your own shared lib code. [0] https://bugs.gentoo.org/show_bug.cgi?id=260331#c0 Cheers Nico -- Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
Attachment:
_bin
Description:
Current thread:
- CVE-2009-0876 (VirtualBox) references Robert Buchholz (Mar 15)
- Re: CVE-2009-0876 (VirtualBox) references Nico Golde (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Steven M. Christey (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Nico Golde (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Steven M. Christey (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Nico Golde (Mar 17)