Oracle VM VirtualBox < 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20 Multiple Vulnerabilities (January 2015 CPU)

High Nessus Plugin ID 80915

Synopsis

The remote host has an application installed that is affected by multiple vulnerabilities.

Description

The remote host contains a version of Oracle VM VirtualBox that is prior to 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20. It is, therefore, affected by multiple vulnerabilities in the following subcomponents :
- Core
- OpenSSL
- VMSVGA device

Solution

Upgrade Oracle VM VirtualBox to 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20 or later as referenced in the January 2015 Oracle Critical Patch Update advisory.

See Also

http://www.nessus.org/u?75c6cafb

https://www.virtualbox.org/wiki/Changelog

https://www.openssl.org/news/secadv/20140605.txt

Plugin Details

Severity: High

ID: 80915

File Name: oracle_virtualbox_jan_2015_cpu.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 2015/01/22

Updated: 2018/11/15

Dependencies: 40548

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:vm_virtualbox

Required KB Items: installed_sw/Oracle VM VirtualBox

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2015/01/20

Vulnerability Publication Date: 2015/01/20

Exploitable With

Core Impact

Reference Information

CVE: CVE-2010-5298, CVE-2014-0076, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, CVE-2014-3470, CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, CVE-2014-6595, CVE-2015-0377, CVE-2015-0418, CVE-2015-0427

BID: 66363, 66801, 67193, 67898, 67899, 67900, 67901, 72194, 72196, 72202, 72206, 72213, 72216, 72219

CERT: 978508