ID CVE-2017-3332
Summary Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VirtualBox SVGA Emulation). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Integrity and Availability impacts).
References
Vulnerable Configurations
  • Oracle VM VirtualBox 5.0.30
    cpe:2.3:a:oracle:vm_virtualbox:5.0.30
  • Oracle VM VirtualBox 5.1.12
    cpe:2.3:a:oracle:vm_virtualbox:5.1.12
CVSS
Base: 3.6 (as of 30-01-2017 - 23:18)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL PARTIAL
nessus via4
  • NASL family Misc.
    NASL id VIRTUALBOX_5_1_14.NASL
    description The version of Oracle VM VirtualBox installed on the remote host is 5.0.x prior to 5.0.32 or 5.1.x prior to 5.1.14. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the GUI subcomponent that allows an unauthenticated, remote attacker to impact confidentiality, integrity, and availability. (CVE-2016-5545) - An unspecified flaw exists in the Shared Folder subcomponent that allows a local attacker to impact integrity and availability. (CVE-2017-3290) - An unspecified flaw exists in the GUI subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2017-3316) - An unspecified flaw exists in the VirtualBox SVGA Emulation subcomponent that allows a local attacker to impact integrity and availability. (CVE-2017-3332) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-08
    plugin id 96609
    published 2017-01-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96609
    title Oracle VM VirtualBox 5.0.x < 5.0.32 / 5.1.x < 5.1.14 Multiple Vulnerabilities (January 2017 CPU)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-203.NASL
    description This update for virtualbox to version 5.1.14 fixes the following issues : These security issues were fixed : - CVE-2016-5545: Vulnerability in the GUI subcomponent of virtualbox allows unauthenticated attacker unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of VirtualBox accessible data and unauthorized ability to cause a partial denial of service (bsc#1020856). - CVE-2017-3290: Vulnerability in the Shared Folder subcomponent of virtualbox allows high privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). - CVE-2017-3316: Vulnerability in the GUI subcomponent of virtualbox allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox (bsc#1020856). - CVE-2017-3332: Vulnerability in the SVGA Emulation subcomponent of virtualbox allows low privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). For other changes please read the changelog.
    last seen 2019-02-21
    modified 2017-04-21
    plugin id 97003
    published 2017-02-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97003
    title openSUSE Security Update : virtualbox (openSUSE-2017-203)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201702-08.NASL
    description The remote host is affected by the vulnerability described in GLSA-201702-08 (VirtualBox: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in VirtualBox. Please review the CVE identifiers referenced below for details. Impact : An attacker could cause a Denial of Service condition. Additionally, an attacker could create, delete or modify critical or all accessible data. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2017-04-21
    plugin id 97184
    published 2017-02-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97184
    title GLSA-201702-08 : VirtualBox: Multiple vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-178.NASL
    description This update for virtualbox to version 5.0.32 fixes the following issues : These security issues were fixed : - CVE-2016-5545: Vulnerability in the GUI subcomponent of virtualbox allows unauthenticated attacker unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of VirtualBox accessible data and unauthorized ability to cause a partial denial of service (bsc#1020856). - CVE-2017-3290: Vulnerability in the Shared Folder subcomponent of virtualbox allows high privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). - CVE-2017-3316: Vulnerability in the GUI subcomponent of virtualbox allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox (bsc#1020856). - CVE-2017-3332: Vulnerability in the SVGA Emulation subcomponent of virtualbox allows low privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). For other changes please read the changelog.
    last seen 2019-02-21
    modified 2017-04-21
    plugin id 96900
    published 2017-01-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96900
    title openSUSE Security Update : virtualbox (openSUSE-2017-178)
refmap via4
bid 95599
confirm http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
gentoo GLSA-201702-08
sectrack 1037638
Last major update 10-02-2017 - 21:59
Published 27-01-2017 - 17:59
Last modified 30-06-2017 - 21:30
Back to Top