Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-3575: Oracle VM VirtualBox allows local admin to take control

CVE-2017-3575 · published 9 years ago

Summary

Versions of Oracle VM VirtualBox earlier than 5.0.38 and 5.1.20 let a user who already has high-level access to the host machine gain full control of the VirtualBox software. This can lead to unauthorized changes, data loss, or causing the program to crash repeatedly. Upgrade to the latest VirtualBox release or apply the vendor's patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	vm_virtualbox	>= 5.0.0, < 5.0.38 >= 5.1.0, < 5.1.20 `cpe:2.3:a:oracle:vm_virtualbox::::::::`

Original advisory text

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H).

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html Patch Vendor Advisory
http://www.securityfocus.com/bid/97755 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038288 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/41906/ Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

1% chance of attack within 30 days

Timeline

Published24 Apr 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-3575 · NVD

Track software like this

Free during beta