Oracle VM VirtualBox up to 5.2.31/prior to 6.0.9 Core access control

Summaryinfo

A vulnerability described as problematic has been identified in Oracle VM VirtualBox up to 5.2.31/prior to 6.0.9. The impacted element is an unknown function of the component Core. Executing a manipulation can lead to access control. This vulnerability appears as CVE-2019-2875. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Oracle VM VirtualBox up to 5.2.31/prior to 6.0.9 (Virtualization Software). This vulnerability affects an unknown code block of the component Core. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect availability. CVE summarizes:

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

The weakness was presented 07/16/2019 as Oracle Critical Patch Update Advisory - Juli 2019 as confirmed advisory (Website). The advisory is available at oracle.com. This vulnerability was named CVE-2019-2875 since 12/14/2018. Local access is required to approach this attack. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

See VDB-137972, VDB-137963, VDB-137964 and VDB-137965 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Oracle

Name

• VM VirtualBox

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9
• 5.2.10
• 5.2.11
• 5.2.12
• 5.2.13
• 5.2.14
• 5.2.15
• 5.2.16
• 5.2.17
• 5.2.18
• 5.2.19
• 5.2.20
• 5.2.21
• 5.2.22
• 5.2.23
• 5.2.24
• 5.2.25
• 5.2.26
• 5.2.27
• 5.2.28
• 5.2.29
• 5.2.30
• 5.2.31
• prior to 6.0.0
• prior to 6.0.1
• prior to 6.0.2
• prior to 6.0.3
• prior to 6.0.4
• prior to 6.0.5
• prior to 6.0.6
• prior to 6.0.7
• prior to 6.0.8
• prior to 6.0.9

License

• open-source (GNU GPLv3)

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion