Oracle VM VirtualBox CVE-2014-2477 Local Privilege Escalation Vulnerability

Bugtraq ID:	68613
Class:	Unknown
CVE:	CVE-2014-2477
Remote:	No
Local:	Yes
Published:	Jul 15 2014 12:00AM
Updated:	Aug 27 2014 12:23AM
Credit:	Oracle
Vulnerable:
Not Vulnerable:

Oracle VM VirtualBox CVE-2014-2477 Local Privilege Escalation Vulnerability

Oracle VM VirtualBox is prone to a local privilege-escalation vulnerability.

The 'Core' sub component is affected.

A local attacker can exploit this issue to execute arbitrary code with elevated privileges.

This vulnerability affects the following supported versions:
VirtualBox prior to 4.0.26, 4.1.34, 4.2.26, 4.3.12

Oracle VM VirtualBox CVE-2014-2477 Local Privilege Escalation Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following metasploit exploit code is available:

• /data/vulnerabilities/exploits/68613.rb

Oracle VM VirtualBox CVE-2014-2477 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle VM VirtualBox CVE-2014-2477 Local Privilege Escalation Vulnerability

References: