Oracle VM VirtualBox 'crServerDispatchVertexAttrib4NubAR()' Function Memory Corruption Vulnerability

Bugtraq ID:	66133
Class:	Design Error
CVE:	CVE-2014-0983
Remote:	Yes
Local:	No
Published:	Mar 11 2014 12:00AM
Updated:	Aug 14 2014 11:34AM
Credit:	CoreLabs
Vulnerable:	Oracle VM VirtualBox 4.1 Oracle VM VirtualBox 4.0 Oracle VM VirtualBox 3.2 Oracle VM VirtualBox 3.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Oracle VM VirtualBox 'crServerDispatchVertexAttrib4NubAR()' Function Memory Corruption Vulnerability

Oracle VM VirtualBox is prone to a memory-corruption vulnerability.

Attackers may exploit this issue to execute arbitrary code in the context of the hypervisor running in host operating system. Failed exploits may result in a denial-of-service condition.

Oracle VM VirtualBox 'crServerDispatchVertexAttrib4NubAR()' Function Memory Corruption Vulnerability

The following exploit codes are available:

• /data/vulnerabilities/exploits/66133.rb
• /data/vulnerabilities/exploits/66133.c

Oracle VM VirtualBox 'crServerDispatchVertexAttrib4NubAR()' Function Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle VM VirtualBox 'crServerDispatchVertexAttrib4NubAR()' Function Memory Corruption Vulnerability

References:

• VirtualBox Homepage (Sun Microsystems)