Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).

The remote host is affected by the vulnerability described in GLSA-201702-08 (VirtualBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VirtualBox. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a Denial of Service condition. Additionally, an       attacker could create, delete or modify critical or all accessible data.
  Workaround :

    There is no known workaround at this time.

This update for virtualbox to version 5.1.14 fixes the following issues :

These security issues were fixed :

  - CVE-2016-5545: Vulnerability in the GUI subcomponent of     virtualbox allows unauthenticated attacker unauthorized     update, insert or delete access to some data as well as     unauthorized read access to a subset of VirtualBox     accessible data and unauthorized ability to cause a     partial denial of service (bsc#1020856).

  - CVE-2017-3290: Vulnerability in the Shared Folder     subcomponent of virtualbox allows high privileged     attacker unauthorized creation, deletion or modification     access to critical data and unauthorized ability to     cause a hang or frequently repeatable crash     (bsc#1020856).

  - CVE-2017-3316: Vulnerability in the GUI subcomponent of     virtualbox allows high privileged attacker with network     access via multiple protocols to compromise Oracle VM     VirtualBox (bsc#1020856).

  - CVE-2017-3332: Vulnerability in the SVGA Emulation     subcomponent of virtualbox allows low privileged     attacker unauthorized creation, deletion or modification     access to critical data and unauthorized ability to     cause a hang or frequently repeatable crash     (bsc#1020856).

For other changes please read the changelog.

This update for virtualbox to version 5.0.32 fixes the following issues :

These security issues were fixed :

  - CVE-2016-5545: Vulnerability in the GUI subcomponent of     virtualbox allows unauthenticated attacker unauthorized     update, insert or delete access to some data as well as     unauthorized read access to a subset of VirtualBox     accessible data and unauthorized ability to cause a     partial denial of service (bsc#1020856).

  - CVE-2017-3290: Vulnerability in the Shared Folder     subcomponent of virtualbox allows high privileged     attacker unauthorized creation, deletion or modification     access to critical data and unauthorized ability to     cause a hang or frequently repeatable crash     (bsc#1020856).

  - CVE-2017-3316: Vulnerability in the GUI subcomponent of     virtualbox allows high privileged attacker with network     access via multiple protocols to compromise Oracle VM     VirtualBox (bsc#1020856).

  - CVE-2017-3332: Vulnerability in the SVGA Emulation     subcomponent of virtualbox allows low privileged     attacker unauthorized creation, deletion or modification     access to critical data and unauthorized ability to     cause a hang or frequently repeatable crash     (bsc#1020856).

For other changes please read the changelog.

The version of Oracle VM VirtualBox installed on the remote host is 5.0.x prior to 5.0.32 or 5.1.x prior to 5.1.14. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the GUI subcomponent that     allows an unauthenticated, remote attacker to impact     confidentiality, integrity, and availability.
    (CVE-2016-5545)

  - An unspecified flaw exists in the Shared Folder     subcomponent that allows a local attacker to impact     integrity and availability. (CVE-2017-3290)

  - An unspecified flaw exists in the GUI subcomponent that     allows an authenticated, remote attacker to execute     arbitrary code. (CVE-2017-3316)

  - An unspecified flaw exists in the VirtualBox SVGA     Emulation subcomponent that allows a local attacker to     impact integrity and availability. (CVE-2017-3332)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
97184	GLSA-201702-08 : VirtualBox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
97003	openSUSE Security Update : virtualbox (openSUSE-2017-203)	Nessus	SuSE Local Security Checks	high
96900	openSUSE Security Update : virtualbox (openSUSE-2017-178)	Nessus	SuSE Local Security Checks	high
96609	Oracle VM VirtualBox 5.0.x < 5.0.32 / 5.1.x < 5.1.14 Multiple Vulnerabilities (January 2017 CPU)	Nessus	Misc.	medium

Detections

Analytics

CVE-2016-5545

medium

Tenable Plugins

high

high

high

medium