PT-2014-3996 · Oracle+1 · Virtualbox+1

Published 2014-03-28 · Updated 2018-10-09 · CVE-2014-0983

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle VirtualBox versions 4.2.x through 4.2.20 Oracle VirtualBox versions 4.3.x prior to 4.3.8

Description Multiple array index errors in programs automatically generated by the VBox/HostServices/SharedOpenGL/crserverlib/server dispatch.py library in Oracle VirtualBox, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR MESSAGE OPCODES messages with a crafted index. The issue is related to the handling of specific messages by various functions, including crServerDispatchVertexAttrib4NubARB, crServerDispatchVertexAttrib1dARB, crServerDispatchVertexAttrib1fARB, crServerDispatchVertexAttrib1sARB, crServerDispatchVertexAttrib2dARB, crServerDispatchVertexAttrib2fARB, crServerDispatchVertexAttrib2sARB, crServerDispatchVertexAttrib3dARB, crServerDispatchVertexAttrib3fARB, crServerDispatchVertexAttrib3sARB, crServerDispatchVertexAttrib4dARB, crServerDispatchVertexAttrib4fARB, and crServerDispatchVertexAttrib4sARB.

Recommendations For Oracle VirtualBox versions 4.2.x through 4.2.20, update to a version later than 4.2.20. For Oracle VirtualBox versions 4.3.x prior to 4.3.8, update to version 4.3.8 or later. As a temporary workaround, consider disabling the 3D Acceleration feature until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-2067

ALT-PU-2014-2068

ALT-PU-2014-2069

ALT-PU-2014-2070

CVE-2014-0983

DSA-2904-1

MGASA-2014-0184

MGASA-2014-0185

Affected Products

Alt Linux

Virtualbox

References · 46

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/virtual_box_guest_additions.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/virtual_box_opengl_escape.rb · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Mar/95 · Exploit
• 🔥 https://exploit-db.com/exploits/32208 · Exploit
• 🔥 http://coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/34334 · Exploit
• 🔥 http://exploit-db.com/exploits/32208 · Exploit
• http://debian.org/security/2014/dsa-2904 · Vendor Advisory
• https://security.gentoo.org/glsa/201612-27 · Vendor Advisory
• https://debian.org/security/2014/dsa-2904.en.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4228 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-2067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0983 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2477 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-0983 · Security Note