Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

CVSS (http://www.first.org/cvss/) provides the keyword local in the base vector. The definition given by FIRST is somehow not so clear for me: Local: Exploiting the vulnerability requires either physical access to the target or a local (shell) account on the target. Can anyone provide me with clear definition for it? I mean is it localhost? is it desktop application that are not available through HTTP?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Simply put a local vulnerability means the attacker has prior access to the target. That may mean already having an account on the machine. With an account already on the machine an attacker could raise their level of privileges with an exploit.

A good example of this being the latest Linux kernel exploit CVE-2010-3081. The exploit allows for a local, unprivileged user to escalate their privileges to that of root.

share|improve this answer
    
Does local here means in my Local Area Network or physically Local on the machine? –  Phoenician-Eagle Nov 17 '10 at 15:18
    
Physical Local on the machine or via SSH to the machine. –  Mark Davidson Nov 17 '10 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.