Lucene search

Kaspersky LabKLA11028

HistoryApr 24, 2017 - 12:00 a.m.

KLA11028 A read/write local files vulnerability in Oracle VM Virtual Box

2017-04-2400:00:00

Kaspersky Lab

threats.kaspersky.com

101

CVSS2

6.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:C/I:C/A:N

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

20.4%

JSON

An unspecified vulnerability was found in Oracle VM VirtualBox. By exploiting this vulnerability low priveleged malicious users with logon to the infrastructure, where OracleVM VirtualBox is executed, can write to some of Oracle VM VirtualBox accessible data and read a subset of Oracle VM VirtualBox accessible data.

Original advisories

Oracle Critical Patch Update Advisory

Related products

Oracle-VirtualBox

CVE list

CVE-2017-3538 high

Solution

Update to the latest versions

Download Oracle VM VirtualBox

Impacts

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.