Vulnerability in Oracle VM VirtualBox Component of Oracle Virtualization
CVE-2017-10235

6.7MEDIUM

Key Information:

Vendor
Oracle
Status
Oracle Vm Virtualbox
Vendor
CVE Published:
8 August 2017

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability exists in the Oracle VM VirtualBox component of Oracle Virtualization that allows an attacker with privileged access to compromise the application. If exploited, this flaw can result in significant disruptions, such as complete denial of service through frequent crashes, as well as unauthorized modifications to critical data accessed by Oracle VM VirtualBox. The vulnerability primarily impacts users running versions prior to 5.1.24 and poses serious risks that may affect various additional products leveraging this virtualization technology.

Affected Version(s)

Oracle VM VirtualBox < 5.1.24

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

vbox_cve_2017_10235
Created by fundacion-sadosky

References

http://www.securityfocus.com/bid/99705
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1038929
vdb-entryx_refsource_SECTRACK
http://www.oracle.com/technetwork/security-advisory/cpuju...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.