Kaspersky Threats

Erkennungsdatum

?

01/18/2018

Schweregrad

?

Kritisch

Beschreibung

Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to obtain sensitive information and gain privileges.

Below is a complete list of vulnerabilities:

Multiple unspecified vulnerabilities in Core subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
An unspecified vulnerability in Guest Additions subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
Vulnerability in OpenSSL component of Oracle VM VirtualBox can be exploited remotely via using a carry propagation flaw in the x86_64 Montgomery squaring function to obtain sensitive information about the SSL private keys.

Technical details

Vulnerability (3) affects only OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g on the processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

Beeinträchtigte Produkte

Oracle VM VirtualBox 5.1.x earlier than 5.1.32
Oracle VM VirtualBox 5.2.x earlier than 5.2.6

Lösung

Update to the latest version
Oracle software downloads

Ursprüngliche Informationshinweise

Oracle Critical Patch Update Advisory – January 2018

Folgen

?

OSI

[?]

PE

[?]

CVE-IDS

?

CVE-2017-57154.7Critical
CVE-2018-26764.3Critical
CVE-2017-37364.0Critical
CVE-2018-26854.4Critical
CVE-2018-26864.4Critical
CVE-2018-26874.4Critical
CVE-2018-26884.4Critical
CVE-2018-26894.4Critical
CVE-2018-26904.4Critical
CVE-2018-26934.1Critical
CVE-2018-26944.1Critical
CVE-2018-26984.1Critical

Link zum Original

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken

Erkennungsdatum ?	01/18/2018
Schweregrad ?	Kritisch
Beschreibung	Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to obtain sensitive information and gain privileges. Below is a complete list of vulnerabilities: Multiple unspecified vulnerabilities in Core subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information; An unspecified vulnerability in Guest Additions subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information; Vulnerability in OpenSSL component of Oracle VM VirtualBox can be exploited remotely via using a carry propagation flaw in the x86_64 Montgomery squaring function to obtain sensitive information about the SSL private keys. Technical details Vulnerability (3) affects only OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g on the processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
Beeinträchtigte Produkte	Oracle VM VirtualBox 5.1.x earlier than 5.1.32 Oracle VM VirtualBox 5.2.x earlier than 5.2.6
Lösung	Update to the latest version Oracle software downloads
Ursprüngliche Informationshinweise	Oracle Critical Patch Update Advisory – January 2018
Folgen ?	OSI [?] PE [?]
CVE-IDS ?	CVE-2017-57154.7Critical CVE-2018-26764.3Critical CVE-2017-37364.0Critical CVE-2018-26854.4Critical CVE-2018-26864.4Critical CVE-2018-26874.4Critical CVE-2018-26884.4Critical CVE-2018-26894.4Critical CVE-2018-26904.4Critical CVE-2018-26934.1Critical CVE-2018-26944.1Critical CVE-2018-26984.1Critical
	Link zum Original
	Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken

KLA11179Multiple vulnerabilities in Oracle VM VirtualBox

KLA11179
Multiple vulnerabilities in Oracle VM VirtualBox