cnvd - cnvd-2016-09613

cnvd-2016-09613

Vulnerability from cnvd

Title: NVIDIA权限提升漏洞

Description:

NVIDIA（全称为NVIDIA Corporation，NASDAQ：NVDA，官方中文名称英伟达），创立于1993年1月，是一家以设计智核芯片组为主的无晶圆（Fabless）IC半导体公司。

NVIDIA中存在权限提升漏洞，攻击者可利用该漏洞系统用户权限执行任意代码。

Severity: 中

Patch Name: NVIDIA权限提升漏洞的补丁

Patch Description:

NVIDIA（全称为NVIDIA Corporation，NASDAQ：NVDA，官方中文名称英伟达），创立于1993年1月，是一家以设计智核芯片组为主的无晶圆（Fabless）IC半导体公司。

NVIDIA中存在权限提升漏洞，攻击者可利用该漏洞系统用户权限执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布更新，详情请关注厂商主页或有关网址： http://www.nvidia.com/content/global/global.php

Reference: http://nvidia.custhelp.com/app/answers/detail/a_id/4213/~/security-bulletin%3A-multiple-vulnerabilities-affect-quadro,-nvs,-and-geforce

Impacted products

Name
['NVIDIA Quadro', 'NVIDIA NVS', 'NVIDIA GeForce']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5852"
    }
  },
  "description": "NVIDIA\uff08\u5168\u79f0\u4e3aNVIDIA Corporation\uff0cNASDAQ\uff1aNVDA\uff0c\u5b98\u65b9\u4e2d\u6587\u540d\u79f0\u82f1\u4f1f\u8fbe\uff09\uff0c\u521b\u7acb\u4e8e1993\u5e741\u6708\uff0c\u662f\u4e00\u5bb6\u4ee5\u8bbe\u8ba1\u667a\u6838\u82af\u7247\u7ec4\u4e3a\u4e3b\u7684\u65e0\u6676\u5706\uff08Fabless\uff09IC\u534a\u5bfc\u4f53\u516c\u53f8\u3002\r\n\r\nNVIDIA\u4e2d\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7cfb\u7edf\u7528\u6237\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "NVIDIA",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u66f4\u65b0\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u6709\u5173\u7f51\u5740\uff1a\r\nhttp://www.nvidia.com/content/global/global.php",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-09613",
  "openTime": "2016-10-20",
  "patchDescription": "NVIDIA\uff08\u5168\u79f0\u4e3aNVIDIA Corporation\uff0cNASDAQ\uff1aNVDA\uff0c\u5b98\u65b9\u4e2d\u6587\u540d\u79f0\u82f1\u4f1f\u8fbe\uff09\uff0c\u521b\u7acb\u4e8e1993\u5e741\u6708\uff0c\u662f\u4e00\u5bb6\u4ee5\u8bbe\u8ba1\u667a\u6838\u82af\u7247\u7ec4\u4e3a\u4e3b\u7684\u65e0\u6676\u5706\uff08Fabless\uff09IC\u534a\u5bfc\u4f53\u516c\u53f8\u3002\r\n\r\nNVIDIA\u4e2d\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7cfb\u7edf\u7528\u6237\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "NVIDIA\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NVIDIA Quadro",
      "NVIDIA NVS",
      "NVIDIA GeForce"
    ]
  },
  "referenceLink": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213/~/security-bulletin%3A-multiple-vulnerabilities-affect-quadro,-nvs,-and-geforce",
  "serverity": "\u4e2d",
  "submitTime": "2016-10-13",
  "title": "NVIDIA\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2016-5852 (GCVE-0-2016-5852)

Vulnerability from cvelistv5

Published

2016-11-08 20:37

Modified

2024-08-06 01:15

Severity ?

CWE

Escalation of Privileges

Summary

For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-5852 ID is for the NVTray Plugin unquoted service path.

References

▼	URL	Tags
	http://nvidia.custhelp.com/app/answers/detail/a_id/4213	x_refsource_CONFIRM
	https://support.lenovo.com/us/en/product_security/ps500070	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/93251	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	Quadro, NVS, GeForce (all versions)	Version: Quadro, NVS, GeForce (all versions)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:15:10.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/ps500070"
          },
          {
            "name": "93251",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93251"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Quadro, NVS, GeForce (all versions)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Quadro, NVS, GeForce (all versions)"
            }
          ]
        }
      ],
      "datePublic": "2016-11-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-5852 ID is for the NVTray Plugin unquoted service path."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privileges",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-13T17:57:01",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/ps500070"
        },
        {
          "name": "93251",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93251"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@nvidia.com",
          "ID": "CVE-2016-5852",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Quadro, NVS, GeForce (all versions)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Quadro, NVS, GeForce (all versions)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-5852 ID is for the NVTray Plugin unquoted service path."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213",
              "refsource": "CONFIRM",
              "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213"
            },
            {
              "name": "https://support.lenovo.com/us/en/product_security/ps500070",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/product_security/ps500070"
            },
            {
              "name": "93251",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93251"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2016-5852",
    "datePublished": "2016-11-08T20:37:00",
    "dateReserved": "2016-06-28T00:00:00",
    "dateUpdated": "2024-08-06T01:15:10.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted