Multiple vulnerabilities in Oracle VM VirtualBox



Published: 2018-04-18
Risk Low
Patch available YES
Number of vulnerabilities 10
CVE-ID CVE-2018-2830
CVE-2018-2831
CVE-2018-2835
CVE-2018-2836
CVE-2018-2837
CVE-2018-2842
CVE-2018-2843
CVE-2018-2844
CVE-2018-2845
CVE-2018-2860
CWE-ID CWE-264
CWE-200
Exploitation vector Local
Public exploit Public exploit code for vulnerability #8 is available.
Vulnerable software
Subscribe 		Oracle VM VirtualBox
Server applications / Virtualization software

Vendor Oracle

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Privilege escalation

EUVDB-ID: #VU11893

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2830

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU11895

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2831

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper information control. A local attacker can gain access to potentially sensitive information.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Privilege escalation

EUVDB-ID: #VU11896

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2835

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Privilege escalation

EUVDB-ID: #VU11897

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2836

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Privilege escalation

EUVDB-ID: #VU11898

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2837

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Privilege escalation

EUVDB-ID: #VU11899

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2842

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Privilege escalation

EUVDB-ID: #VU11900

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2843

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Privilege escalation

EUVDB-ID: #VU11901

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-2844

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

9) Security restrictions bypass

EUVDB-ID: #VU11902

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2845

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information, write arbitrary files and cause DoS condition on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper information control. A local attacker can partially access data, partially modify data and cause the service to crash.

Mitigation

Update to versions 5.1.36 or 5.2.10.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Privilege escalation

EUVDB-ID: #VU11903

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2860

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper security restrictions. A local attacker can gain root privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle VM VirtualBox: 5.1.30 - 5.2.8

External links

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###