CVE-2018-3295: High severity Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle VM VirtualBoxto a version that resolves this vulnerability.Fixed in 5.2.20
Event History
Frequently Asked Questions
Which installations are affected?
Supported Oracle VM VirtualBox versions earlier than 5.2.20 are affected.
What access does an attacker need to exploit this issue?
The attacker needs logon access to the infrastructure where Oracle VM VirtualBox is running. The CVSS vector identifies the attack as local and requires no privileges.
Is user interaction required for exploitation?
Yes. Exploitation requires human interaction by someone other than the attacker.
What could happen after successful exploitation?
A successful attack can result in takeover of Oracle VM VirtualBox, with high confidentiality, integrity, and availability impact. The attack may also significantly affect additional products.