NVD Vulnerability Detail

CVE-2017-10204

Summary	Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Publication Date	Aug. 9, 2017, 12:29 a.m.
Registration Date	Jan. 26, 2021, 1:11 p.m.
Last Update	Nov. 21, 2024, 12:05 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:oracle:vm_virtualbox::::::::			5.1.22

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/152617/VirtualBox-COM-RPC-Interface-Code-Injection-Privilege-Escalation.html
2	http://packetstormsecurity.com/files/152617/VirtualBox-COM-RPC-Interface-Code-Injection-Privilege-Escalation.html
3	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Patch Vendor Advisory
4	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Patch Vendor Advisory
5	http://www.securityfocus.com/bid/99631	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/99631	Third Party Advisory VDB Entry
7	http://www.securitytracker.com/id/1038929	Third Party Advisory VDB Entry
8	http://www.securitytracker.com/id/1038929	Third Party Advisory VDB Entry
9	https://www.exploit-db.com/exploits/42425/	Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/42425/	Third Party Advisory VDB Entry

Common Vulnerabilities List

JVN Vulnerability Information

Oracle Virtualization の Oracle VM VirtualBox における Core に関する脆弱性

Title	Oracle Virtualization の Oracle VM VirtualBox における Core に関する脆弱性
Summary	Oracle Virtualization の Oracle VM VirtualBox には、Core に関する処理に不備があるため、機密性、完全性、および可用性に影響のある脆弱性が存在します。
Possible impacts	ローカルユーザにより、情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 18, 2017, midnight
Registration Date	Aug. 24, 2017, 5:26 p.m.
Last Update	Aug. 24, 2017, 5:26 p.m.

Affected System

オラクル

Oracle VM VirtualBox 5.1.24 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-10204	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10204
National Vulnerability Database (NVD)
2	CVE-2017-10204	https://nvd.nist.gov/vuln/detail/CVE-2017-10204

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - July 2017	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
2	Text Form of Oracle Critical Patch Update - July 2017 Risk Matrices	http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html

Change Log

No	Changed Details	Date of change
0	[2017年08月24日] 掲載	Feb. 17, 2018, 10:37 a.m.