Skip to main content

Vm Virtualbox CVE-2014-0983

MEDIUM
Resource Management Errors (CWE-399)
2014-03-31 cve@mitre.org
RCE Google Oracle Vm Virtualbox
6.9
CVSS 2.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-399
Impact

CVSS score of 6.9 (MEDIUM). Attack characteristics: local attack vector, M complexity. Public proof-of-concept exploit code is available. EPSS exploitation probability: 12.02%.
Exploit ScenarioDerived

Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 12.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before. Rated medium severity (CVSS 6.9). Public exploit code available and EPSS exploitation probability 12.0%.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-399. Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function. Affected products include: Oracle Vm Virtualbox. Version information: through 4.2.20.

Know when Vm Virtualbox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.9 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
M
Confidentiality
C
Integrity
C
Availability
C

DescriptionCVE.org

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.

Threat Intelligence Overview

EPSS Score
12.0%
Top 6% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS POC (1) Exploit-DB VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 12.0%
Patch available No
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Active
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

81
Low Medium High Critical
KEV: 0
EPSS: +12
CVSS: +34
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.18:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.2.20:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:4.3.6:*:*:*:*:*:*:*

More in Vm Virtualbox

View all
CVE-2019-2725 CRITICAL POC
9.8 Apr 26

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2017-3316 HIGH POC
8.4 Jan 27

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Rated high severity (C
CVE-2017-10129 HIGH POC
8.8 Aug 08

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3576 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3561 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3563 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-10204 HIGH POC
8.8 Aug 08

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2019-2721 HIGH POC
8.8 Apr 23

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2018-2698 HIGH POC
8.8 Jan 18

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3558 HIGH POC
8.5 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3587 HIGH POC
8.4 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Rated high s

Same weakness CWE-399 – Resource Management Errors

View all
CVE-2013-3893 HIGH POC
8.8
CVE-2013-0025 CRITICAL POC
9.3
CVE-2015-0064 CRITICAL POC
9.3
CVE-2015-0065 CRITICAL POC
9.3
CVE-2013-3846 CRITICAL POC
9.3
CVE-2016-5427 HIGH
7.5
CVE-2013-0233 MEDIUM POC
6.8
CVE-2013-1305 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY http://secunia.com/advisories/57384 ADVISORY https://vuldb.com/vuln/12603 REF http://www.debian.org/security/2014/dsa-2904 REF http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html REF http://www.securityfocus.com/archive/1/531418/100/0/threaded REF https://security.gentoo.org/glsa/201612-27 REF https://www.virtualbox.org/changeset/50441/vbox

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy