Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The     supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle VM VirtualBox accessible data. (CVE-2018-3091)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for virtualbox to version 5.2.16 fixes the following issues :

The following security vulnerabilities were fixed (boo#1101667) :

  - CVE-2018-3005: Fixed an easily exploitable vulnerability     that allowed unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks of     this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of     Oracle VM VirtualBox.

  - CVE-2018-3055: Fixed an easily exploitable vulnerability     that allowed unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle VM     VirtualBox and unauthorized read access to a subset of     Oracle VM VirtualBox accessible data.

  - CVE-2018-3085: Fixed an easily exploitable vulnerability     that allowed unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or     modification access to critical data or all Oracle VM     VirtualBox accessible data as well as unauthorized read     access to a subset of Oracle VM VirtualBox accessible     data and unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle VM     VirtualBox.

  - CVE-2018-3086: Fixed an easily exploitable vulnerability     that allowed unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox.

  - CVE-2018-3087: Fixed an easily exploitable vulnerability     that allowed unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox.

  - CVE-2018-3088: Fixed an easily exploitable vulnerability     allows unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox.

  - CVE-2018-3089: Fixed an easily exploitable vulnerability     allows unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox.

  - CVE-2018-3090: Fixed an easily exploitable vulnerability     allows unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox.

  - CVE-2018-3091: Fixed an easily exploitable vulnerability     allows unauthenticated attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle VM     VirtualBox, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized access to critical data or     complete access to all Oracle VM VirtualBox accessible     data.

The following bugs were fixed :

  - OVF: case insensitive comparison of manifest attribute     values, to improve compatibility

This update for kbuild, virtualbox fixes the following issues :

kbuild changes :

  - Update to version 0.1.9998svn3110

  - Do not assume glibc glob internals

  - Support GLIBC glob interface version 2

  - Fix build failure (boo#1079838)

  - Fix build with GCC7 (boo#1039375)

  - Fix build by disabling vboxvideo_drv.so

virtualbox security fixes (boo#1101667, boo#1076372) :

  - CVE-2018-3005

  - CVE-2018-3055

  - CVE-2018-3085

  - CVE-2018-3086

  - CVE-2018-3087

  - CVE-2018-3088

  - CVE-2018-3089

  - CVE-2018-3090

  - CVE-2018-3091

  - CVE-2018-2694

  - CVE-2018-2698

  - CVE-2018-2685

  - CVE-2018-2686

  - CVE-2018-2687

  - CVE-2018-2688

  - CVE-2018-2689

  - CVE-2018-2690

  - CVE-2018-2676

  - CVE-2018-2693

  - CVE-2017-5715

virtualbox other changes :

  - Version bump to 5.2.16

  - Use %(?linux_make_arch) when building kernel modules     (boo#1098050)

  - Fixed vboxguestconfig.sh script

  - Update warning regarding the security hole in USB     passthrough. (boo#1097248)

  - Fixed include for build with Qt 5.11 (boo#1093731)

  - You can find a detailed list of changes     [here](https://www.virtualbox.org/wiki/Changelog#v16)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.16. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory : 

  - An unspecified vulnerability in the Oracle VM VirtualBox     component of Oracle Virtualization in the Core     subcomponent could allow an unauthenticated, remote     attacker with logon to the infrastructure where Oracle     VM VirtualBox executes to compromise Oracle VM     VirtualBox. (CVE-2018-3005, CVE-2018-3085, CVE-2018-3086     CVE-2018-3087, CVE-2018-3088, CVE-2018-3089,     CVE-2018-3090, CVE-2018-3091, CVE-2018-3055)

Please consult the CVRF details for the applicable CVEs for additional information.

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
254946	Linux Distros Unpatched Vulnerability : CVE-2018-3091	Nessus	Misc.	medium
123254	openSUSE Security Update : virtualbox (openSUSE-2019-586)	Nessus	SuSE Local Security Checks	high
112143	openSUSE Security Update : kbuild / virtualbox (openSUSE-2018-938) (Spectre)	Nessus	SuSE Local Security Checks	high
111634	openSUSE Security Update : virtualbox (openSUSE-2018-853)	Nessus	SuSE Local Security Checks	high
111208	Oracle VM VirtualBox < 5.2.16 Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2018-3091

medium

Tenable Plugins

medium

high

high

high

high