CVE-2014-0983
published 2014-03-31CVE-2014-0983: Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox…
PriorityP347medium6.9CVSS 2.0
AVLACMAuNCCICAC
EXPLOIT
EPSS
8.20%
94.3th percentile
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | virtualbox | < virtualbox 4.3.10-dfsg-1 (sid) | virtualbox 4.3.10-dfsg-1 (sid) |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| oracle | vm_virtualbox | — | — |
| sun | virtualbox | >= 0 < 4.3.10-dfsg-1 | 4.3.10-dfsg-1 |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_debian6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p4cx-p88v-xqv9: Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch
ghsa_unreviewed·2022-05-14
CVE-2014-0983 [MEDIUM] GHSA-p4cx-p88v-xqv9: Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchV
OSV
CVE-2014-0983: Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch
osv·2014-03-31·CVSS 6.9
CVE-2014-0983 [MEDIUM] CVE-2014-0983: Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchV
Debian
CVE-2014-0983: virtualbox - Multiple array index errors in programs that are automatically generated by VBox...
vendor_debian·2014·CVSS 6.9
CVE-2014-0983 [MEDIUM] CVE-2014-0983: virtualbox - Multiple array index errors in programs that are automatically generated by VBox...
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchV
No detection rules found.
Exploit-DB
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
exploitdb·2014-08-14
CVE-2015-4523 Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rex'
class Metasploit3 'VirtualBox 3D Acceleration Virtual Machine Escape',
'Description' => %q{
This module exploits a vulnerability in the 3D Acceleration support for VirtualBox. The
vulnerability exists in the remote rendering of OpenGL-based 3D graphics. By sending a
sequence of specially crafted of rendering messages, a virtual machine can exploit an out
of bounds array access to corrupt memory and escape to the host. This module has been
tested successfully on Windows 7 SP1 (64 bits) as Host running Virtual Box 4.3.6.
},
'License' => M
Exploit-DB
Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
exploitdb·2014-03-12·CVSS 4.4
CVE-2014-0983 [MEDIUM] Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
---
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities
1. *Advisory Information*
Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption
Vulnerabilities
Advisory ID: CORE-2014-0002
Advisory URL:
http://www.coresecurity.com/content/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities
Date published: 2014-03-11
Date of last update: 2014-03-11
Vendors contacted: Oracle
Release mode: User release
2. *Vulnerability Information*
Class: Improper Validation of Array Index [CWE-129], Improper Validation
of Array Index [CWE-129], Improper Validation of Array Index [CWE-129]
Impact: Code execution
Rem
Metasploit
VirtualBox 3D Acceleration Virtual Machine Escape
metasploit
VirtualBox 3D Acceleration Virtual Machine Escape
VirtualBox 3D Acceleration Virtual Machine Escape
This module exploits a vulnerability in the 3D Acceleration support for VirtualBox. The vulnerability exists in the remote rendering of OpenGL-based 3D graphics. By sending a sequence of specially crafted rendering messages, a virtual machine can exploit an out of bounds array access to corrupt memory and escape to the host. This module has been tested successfully on Windows 7 SP1 (64 bits) as Host running Virtual Box 4.3.6.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2014/Mar/95http://secunia.com/advisories/57384http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilitieshttp://www.debian.org/security/2014/dsa-2904http://www.exploit-db.com/exploits/32208http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlhttp://www.securityfocus.com/archive/1/531418/100/0/threadedhttps://security.gentoo.org/glsa/201612-27https://www.virtualbox.org/changeset/50441/vboxhttp://seclists.org/fulldisclosure/2014/Mar/95http://secunia.com/advisories/57384http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilitieshttp://www.debian.org/security/2014/dsa-2904http://www.exploit-db.com/exploits/32208http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlhttp://www.securityfocus.com/archive/1/531418/100/0/threadedhttps://security.gentoo.org/glsa/201612-27https://www.virtualbox.org/changeset/50441/vbox
2014-03-31
Published