Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

Oracle reports reports :

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

The virtualbox package was updated to version 4.2.36 to fix the following security and non security issues :

  - Version bump tp 4.2.36 (released 2015-11-11 by Oracle)

  - several fixes - Oracle is not more specific

  - Version bump to 4.2.34 (released 2015-10-20 by Oracle)     (bsc#951432)

  - CVE-2015-4813: Only Windows guests are impacted. Windows     guests without VirtualBox Guest Additions installed are     not affected.

  - CVE-2015-4896: Only VMs with Remote Display feature     (RDP) enabled are impacted by CVE-2015-4896.

  - several fixes

  - Linux hosts: Linux 4.2 fix

  - Linux hosts: Linux 4.3 compile fixes

  - Windows hosts: hardening fixes

  - Linux Additions: Linux 4.2 fixes (bug #14227)

VirtualBox was updated to 4.3.32 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-4813: Windows guests with guest additions     installed could cause a hang or crash of VirtualBox.

  - CVE-2015-4896: Remote unauthenticated users could cause     crash (DoS) via the network when the Remote Display     feature (RDP) is enabled.

Two vulnerabilities have been discovered in VirtualBox, an x86 virtualisation solution.

The Oracle VM VirtualBox application installed on the remote host is a version prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, or 5.0.8. It is, therefore, affected by multiple unspecified flaws in the Core subcomponent. A local attacker can exploit these to cause a denial of service.

ID	Name	Product	Family	Severity
93986	FreeBSD : VirtualBox -- undisclosed vulnerabilities (7d40edd1-901e-11e6-a590-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
87116	openSUSE Security Update : virtualbox (openSUSE-2015-839)	Nessus	SuSE Local Security Checks	medium
86694	openSUSE Security Update : VirtualBox (openSUSE-2015-688)	Nessus	SuSE Local Security Checks	medium
86678	Debian DSA-3384-1 : virtualbox - security update	Nessus	Debian Local Security Checks	medium
86568	Oracle VM VirtualBox < 4.0.34 / 4.1.42 / 4.2.34 / 4.3.32 / 5.0.8 Multiple Core DoS (October 2015 CPU)	Nessus	Misc.	medium

Detections

Analytics

CVE-2015-4896

medium

Tenable Plugins

medium

medium

medium

medium

medium