PT-2024-4883 · Oracle+1 · Virtualbox+1

Published 2024-04-16 · Updated 2024-12-05 · CVE-2024-21109

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16

Description: The issue is related to insufficient protection of service data in the Oracle VM VirtualBox product, allowing an unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability can be exploited by an attacker with network access via the HTTP protocol.

Recommendations: For versions prior to 7.0.16, update to version 7.0.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Oracle VM VirtualBox web service to minimize the risk of exploitation. Avoid using the Oracle VM VirtualBox web service until the issue is resolved.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2024-05407

CVE-2024-21109

MGASA-2024-0232

ZDI-24-408

Affected Products

Virtualbox

Red Os

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2024-21109 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-408 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21109 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05407 · Security Note
• https://ubuntu.com/security/CVE-2024-21109 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0232 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21109 · Security Note
• https://advisories.mageia.org/MGASA-2024-0232.html · Security Note
• https://oracle.com/security-alerts/cpuapr2024.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21109 · Vendor Advisory
• https://virtualbox.org/wiki/Changelog-7.0#v18 · Note
• https://cybersecurity-help.cz/vdb/SB2024041782 · Note
• https://virtualbox.org/wiki/Changelog-7.0#v16 · Note
• https://t.me/cvenotify/103127 · Telegram Post