Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.0.20 and prior to 6.1.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

The remote host is affected by the vulnerability described in GLSA-202101-09 (VirtualBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VirtualBox. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker could take control of VirtualBox resulting in the execution       of arbitrary code with the privileges of the process, a Denial of Service       condition, or other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

Virtualbox was updated to 6.0.22 (released May 15 2020 by Oracle)

This is a maintenance release. The following items were fixed and/or added :

Guest Additions: Build problems fix with Oracle Linux 8.2 (Red Hat compatible kernel) / Red Hat Enterprise Linux 8.2 / CentOS 8.2 (bug #19391) Guest Control/VBoxManage: fix handling of multiple environment variables supplied to 'VBoxManage guestcontrol VM run' (6.1.6/6.0.20 regression; bug #19518)

Version bump to 6.0.20 (released April 14 2020 by Oracle)

This is a maintenance release. The following items were fixed and/or added :

  - USB: Multiple enhancements improving prformance and     stability

  - VBoxManage: Multiple fixes for guestcontrol command

  - Graphics: Enhancements in 2D and 3D acceleration and     rendering

  - API: Fix for exception handling bug in Python bindings

  - Linux host and guest: Support Linux kernel 5.6 (bug     #19312)

This update fixes the following security issues: CVE-2020-2741, CVE-2020-2742, CVE-2020-2743, CVE-2020-2748, CVE-2020-2758, CVE-2020-2894, CVE-2020-2902, CVE-2020-2905, CVE-2020-2907, CVE-2020-2908, CVE-2020-2909, CVE-2020-2910, CVE-2020-2911, CVE-2020-2913, CVE-2020-2914, CVE-2020-2929, CVE-2020-2951, CVE-2020-2958, CVE-2020-2959 (bsc#1169628)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.40, 6.0.x prior to 6.0.20 or 6.1.x prior to 6.1.6. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory. Note that Nessus has not tested for this issue buthas instead relied only on the application's self-reported version number:

  - An input-validation flaw exists within the processing of     data sent to OHCI endpoints that could allow privilege     escalation. (CVE-2020-2575)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated,     local attacker can exploit this issue, to compromise     and takeover the Oracle VM VirtualBox. (CVE-2020-2742,     CVE-2020-2758, CVE-2020-2894, CVE-2020-2905,     CVE-2020-2908, CVE-2020-2902, CVE-2020-2907,     CVE-2020-2911, CVE-2020-2913, CVE-2020-2914,     CVE-2020-2929, CVE-2020-2958)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized access     to critical data or complete access to all  Oracle VM     VirtualBox accessible data. (CVE-2020-2741,     CVE-2020-2743)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized read     access to a subset of Oracle VM VirtualBox  accessible     data. (CVE-2020-2748)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized     creation, deletion or modification access to critical     data or all Oracle VM VirtualBox accessible data.
    (CVE-2020-2910)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized     ability to cause a partial denial of service (partial     DOS) of Oracle VM VirtualBox. (CVE-2020-2909)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized     ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle VM VirtualBox. (CVE-2020-2959,     CVE-2020-2951)

ID	Name	Product	Family	Severity
144923	GLSA-202101-09 : VirtualBox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138722	openSUSE Security Update : Virtualbox (openSUSE-2020-925)	Nessus	SuSE Local Security Checks	high
135586	Oracle VM VirtualBox (Apr 2020 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2020-2913

high

Tenable Plugins

high

high

high