Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.

The remote host is affected by the vulnerability described in GLSA-201612-27 (VirtualBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VirtualBox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Local attackers could cause a Denial of Service condition, execute       arbitrary code, or escalate their privileges.
  Workaround :

    There is no known workaround at this time.

Francisco Falcon discovered that missing input sanitizing in the 3D acceleration code in VirtualBox could lead to the execution of arbitrary code on the host system.

The remote host contains a version of Oracle VM VirtualBox that is 3.2.x prior to 3.2.22, 4.0.24, 4.1.32, 4.2.24 or 4.3.8. It is, therefore, potentially affected by the following vulnerabilities :

  - An input validation error exists in the function     'crNetRecvReadback' in the file     'GuestHost/OpenGL/util/net.c' related to handling     CR_MESSAGE_READBACK and CR_MESSAGE_WRITEBACK messages     that could allow memory corruption leading to     application crashes and possibly arbitrary code     execution. (CVE-2014-0981)

  - An input validation error exists related to the     Chromium server and the handling of     CR_VERTEXATTRIB4NUBARB_OPCODE messages that could allow     memory corruption leading to application crashes and     possibly arbitrary code execution. (CVE-2014-0983)

ID	Name	Product	Family	Type	Severity
95695	GLSA-201612-27 : VirtualBox: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	Local	medium
73534	Debian DSA-2904-1 : virtualbox - security update	Nessus	Debian Local Security Checks	Local	medium
72985	Oracle VM VirtualBox < 3.2.22 / 4.0.24 / 4.1.32 / 4.2.24 / 4.3.8 Multiple Memory Corruption	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2014-0983

high

Tenable Plugins

medium

medium

medium