Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

This update for VirtualBox 5.2.20 fixes security issues and bugs.

A number of vulnerabilities were fixed a affecting multiple components of VirtualBox bsc#1112097: CVE-2018-0732, CVE-2018-2909, CVE-2018-3287, CVE-2018-3288, CVE-2018-3289, CVE-2018-3290, CVE-2018-3291, CVE-2018-3292, CVE-2018-3293, CVE-2018-3294, CVE-2018-3295, CVE-2018-3296, CVE-2018-3297, and CVE-2018-3298. 

This update also contains various bug fixes in the 5.2.20 release :

  - VMM: fixed task switches triggered by INTn instruction

  - Storage: fixed connecting to certain iSCSI targets

  - Storage: fixed handling of flush requests when     configured to be ignored when the host I/O cache is used

  - Drag and drop fixes

  - Video recording: fixed starting video recording on VM     power up

  - Various fixes to Linux Additions

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.20. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory : 

  - An unspecified vulnerability in the Oracle VM     VirtualBox component of Oracle Virtualization in the     Core subcomponent could allow an unauthenticated,     remote attacker with logon to the infrastructure where     Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. (CVE-2018-2909, CVE-2018-3287,     CVE-2018-3288, CVE-2018-3289, CVE-2018-3290,     CVE-2018-3291, CVE-2018-3292, CVE-2018-3293,     CVE-2018-3294, CVE-2018-3295, CVE-2018-3296,     CVE-2018-3297, CVE-2018-3298)

  - An unspecified vulnerability in the Oracle VM     VirtualBox component of Oracle Virtualization in the     OpenSSL subcomponent could allow an unauthenticated,     remote attacker with network access via TLS to     compromise Oracle VM VirtualBox. (CVE-2018-0732)

Please consult the CVRF details for the applicable CVEs for additional information.

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
123360	openSUSE Security Update : VirtualBox (openSUSE-2019-863)	Nessus	SuSE Local Security Checks	critical
118562	openSUSE Security Update : VirtualBox (openSUSE-2018-1330)	Nessus	SuSE Local Security Checks	critical
118204	Oracle VM VirtualBox < 5.2.20 Multiple Vulnerabilities (Oct 2018 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2018-3287

high

Tenable Plugins

critical

critical

critical