Vulnerabilities > CVE-2017-10408 - Unspecified vulnerability in Oracle VM Virtualbox
Summary
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).
Vulnerable Configurations
Nessus
NASL family Misc. NASL id VIRTUALBOX_5_1_30.NASL description The version of Oracle VM VirtualBox running on the remote host is 5.1.x prior to 5.1.30. It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 103930 published 2017-10-18 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/103930 title Oracle VM VirtualBox 5.1.x < 5.1.30 (October 2017 CPU) NASL family SuSE Local Security Checks NASL id OPENSUSE-2017-1267.NASL description This update for virtualbox fixes the following issues : - CVE-2017-10392: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10407: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10408: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10428: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and partially deny service The following packaging changes are included : - Further to usage of vboxdrv if virtualbox-qt is not installed: updates to vboxdrv.sh (boo#1060072) - The virtualbox package no longer requires libX11, an library module files were moved to virtualbox-qt This update also contains all upstream improvements in the 5.1.30 release, including : - Fix for double mouse cursor when using mouse integration without Guest Additions. - Translation updates last seen 2020-06-05 modified 2017-11-13 plugin id 104525 published 2017-11-13 reporter This script is Copyright (C) 2017-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/104525 title openSUSE Security Update : virtualbox (openSUSE-2017-1267)
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/101371
- http://www.securityfocus.com/bid/101371
- http://www.securitytracker.com/id/1039599
- http://www.securitytracker.com/id/1039599