PT-2018-1403 · Oracle+2 · Virtualbox+2
Published
2018-07-17
·
Updated
2019-10-03
·
CVE-2018-3085
CVSS v3.1
8.5
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Oracle VM VirtualBox versions prior to 5.2.16
Description
The issue is related to insufficient access control in the Oracle VM VirtualBox component, specifically in the Core subcomponent. This allows an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data, as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. It can also cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.
Recommendations
For versions prior to 5.2.16, update to version 5.2.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core subcomponent of Oracle VM VirtualBox to minimize the risk of exploitation. Avoid using the
crServerDispatchMessage function until the issue is resolved. Restrict access to sensitive data and ensure that only authorized personnel have logon access to the infrastructure where Oracle VM VirtualBox executes.Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Virtualbox
Suse