PT-2017-1987 · Oracle+2 · Virtualbox+2
Publicado
2017-04-24
·
Atualizado
2019-10-03
·
CVE-2017-3575
CVSS v3.1
7.9
Alta
| Vetor | AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Oracle VM VirtualBox versions prior to 5.0.38
Oracle VM VirtualBox versions prior to 5.1.20
Description
The issue is related to insufficient access control in the Oracle VM VirtualBox component, specifically in the Core subcomponent. It allows a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized access to critical data, including creation, deletion, or modification of data, as well as the ability to cause a hang or crash of Oracle VM VirtualBox. This vulnerability may significantly impact additional products.
Recommendations
For Oracle VM VirtualBox versions prior to 5.0.38, update to version 5.0.38 or later.
For Oracle VM VirtualBox versions prior to 5.1.20, update to version 5.1.20 or later.
As a temporary workaround, consider restricting access to the Oracle VM VirtualBox component to minimize the risk of exploitation.
Exploit
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Virtualbox
Suse