Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-3316 — Improper Input Validation in Oracle VM Virtualbox

CWE-20 — Improper Input Validation6 documents6 sources

Severity

8.4HIGHNVD

EPSS

2.8%

top 13.81%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

SUN Virtualbox Oracle VM Virtualbox

Timeline

PublishedJan 27

Latest updateMay 17

Description

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impa…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HExploitability: 1.7 | Impact: 6.0

Affected Packages3 packages

▶CVEListV5oracle/vm_virtualboxprior to 5.0.32, prior to 5.1.14+1

▶NVDoracle/vm_virtualbox5.0.30, 5.1.12+1

▶Ubuntusun/virtualbox< 5.1.38-dfsg-0ubuntu1.16.04.1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-238x-xx54-w2xc: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI)↗2022-05-17

▶

CVEList

CVE-2017-3316: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI)↗2017-01-27

▶

OSV

CVE-2017-3316: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI)↗2017-01-27

▶

💥Exploits & PoCs

Exploit-DB

Oracle VM VirtualBox < 5.0.32 / < 5.1.14 - Local Privilege Escalation↗2017-01-27

▶

📋Vendor Advisories

Debian

CVE-2017-3316: virtualbox - Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (su...↗2017

▶