PT-2018-1403 · Oracle+2 · Virtualbox+2

Published

2018-07-17

·

Updated

2019-10-03

·

CVE-2018-3085

CVSS v3.1

8.5

High

VectorAV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H
Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 5.2.16
Description The issue is related to insufficient access control in the Oracle VM VirtualBox component, specifically in the Core subcomponent. This allows an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data, as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. It can also cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.
Recommendations For versions prior to 5.2.16, update to version 5.2.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core subcomponent of Oracle VM VirtualBox to minimize the risk of exploitation. Avoid using the crServerDispatchMessage function until the issue is resolved. Restrict access to sensitive data and ensure that only authorized personnel have logon access to the infrastructure where Oracle VM VirtualBox executes.

Exploit

Fix

Improper Access Control

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2018-2044
ALT-PU-2018-2045
ALT-PU-2018-2046
BDU:2018-00951
CVE-2018-3085
MGASA-2018-0360
OPENSUSE-SU-2018_2295-1
OPENSUSE-SU-2018_2524-1
ZDI-18-685

Affected Products

Alt Linux
Virtualbox
Suse