Vulnerability Name:

CVE-2014-0407 (CCN-90369)

Assigned:2013-12-12
Published:2014-01-14
Updated:2017-08-29
Summary:Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.
CVSS v3 Severity:4.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P)
2.6 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
3.5 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Unknown
References:Source: MITRE
Type: CNA
CVE-2014-0407

Source: OSVDB
Type: UNKNOWN
102058

Source: SECUNIA
Type: UNKNOWN
56490

Source: DEBIAN
Type: UNKNOWN
DSA-2878

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update Advisory - January 2014

Source: CONFIRM
Type: Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Source: BID
Type: UNKNOWN
64758

Source: CCN
Type: BID-64758
RETIRED: Oracle January 2014 Critical Patch Update Multiple Vulnerabilities

Source: BID
Type: UNKNOWN
64913

Source: CCN
Type: BID-64913
Oracle VM VirtualBox CVE-2014-0407 Local Security Vulnerability

Source: SECTRACK
Type: UNKNOWN
1029610

Source: XF
Type: UNKNOWN
oracle-cpujan2014-cve20140407(90369)

Source: XF
Type: UNKNOWN
oracle-cpujan2014-cve20140407(90369)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-0407

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:vm_virtualbox:4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.18:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.20:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.22:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.24:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.26:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:*:*:*:*:*:*:*:* (Version <= 4.1.28)

    • Configuration 2:
  • cpe:/a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:*:*:*:*:*:*:*:* (Version <= 4.3.2)

    • Configuration 3:
  • cpe:/a:oracle:vm_virtualbox:3.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:*:*:*:*:*:*:*:* (Version <= 3.2.18)

    • Configuration 4:
  • cpe:/a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:*:*:*:*:*:*:*:* (Version <= 4.2.18)

    • Configuration 5:
  • cpe:/a:oracle:vm_virtualbox:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:*:*:*:*:*:*:*:* (Version <= 4.0.20)

    • Configuration CCN 1:
  • cpe:/a:oracle:vm_virtualbox:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.26:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.24:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.18:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.20:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.22:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:3.2.18:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.2.18:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.0.20:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:vm_virtualbox:4.1.28:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:24111
    P
    		DSA-2878-1 virtualbox - security update
    2014-06-23
    oval:org.mitre.oval:def:21883
    V
    		Unspecified vulnerability in the VirtualBox component in Oracle Virtualization VirtualBox 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability
    2014-03-03
    oval:com.ubuntu.precise:def:20140407000
    V
    		CVE-2014-0407 on Ubuntu 12.04 LTS (precise) - medium.
    2014-01-15
    oval:com.ubuntu.trusty:def:20140407000
    V
    		CVE-2014-0407 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-01-15
    BACK
    oracle vm virtualbox 4.1.0
    oracle vm virtualbox 4.1.2
    oracle vm virtualbox 4.1.4
    oracle vm virtualbox 4.1.6
    oracle vm virtualbox 4.1.8
    oracle vm virtualbox 4.1.10
    oracle vm virtualbox 4.1.12
    oracle vm virtualbox 4.1.14
    oracle vm virtualbox 4.1.16
    oracle vm virtualbox 4.1.18
    oracle vm virtualbox 4.1.20
    oracle vm virtualbox 4.1.22
    oracle vm virtualbox 4.1.24
    oracle vm virtualbox 4.1.26
    oracle vm virtualbox *
    oracle vm virtualbox 4.3.0
    oracle vm virtualbox *
    oracle vm virtualbox 3.2.0
    oracle vm virtualbox 3.2.2
    oracle vm virtualbox 3.2.4
    oracle vm virtualbox 3.2.6
    oracle vm virtualbox 3.2.8
    oracle vm virtualbox 3.2.10
    oracle vm virtualbox 3.2.12
    oracle vm virtualbox 3.2.14
    oracle vm virtualbox 3.2.16
    oracle vm virtualbox *
    oracle vm virtualbox 4.2.0
    oracle vm virtualbox 4.2.2
    oracle vm virtualbox 4.2.4
    oracle vm virtualbox 4.2.6
    oracle vm virtualbox 4.2.8
    oracle vm virtualbox 4.2.10
    oracle vm virtualbox 4.2.12
    oracle vm virtualbox 4.2.14
    oracle vm virtualbox 4.2.16
    oracle vm virtualbox *
    oracle vm virtualbox 4.0
    oracle vm virtualbox 4.0.0
    oracle vm virtualbox 4.0.2
    oracle vm virtualbox 4.0.4
    oracle vm virtualbox 4.0.6
    oracle vm virtualbox 4.0.8
    oracle vm virtualbox 4.0.10
    oracle vm virtualbox 4.0.12
    oracle vm virtualbox 4.0.14
    oracle vm virtualbox 4.0.16
    oracle vm virtualbox 4.0.18
    oracle vm virtualbox *
    oracle vm virtualbox 4.0
    oracle vm virtualbox 4.1.0
    oracle vm virtualbox 4.2.0
    oracle vm virtualbox 4.2.6
    oracle vm virtualbox 4.2.8
    oracle vm virtualbox 4.2.10
    oracle vm virtualbox 4.2.12
    oracle vm virtualbox 4.2.14
    oracle vm virtualbox 4.2.16
    oracle vm virtualbox 4.2.2
    oracle vm virtualbox 4.2.4
    oracle vm virtualbox 3.2.16
    oracle vm virtualbox 3.2.0
    oracle vm virtualbox 3.2.10
    oracle vm virtualbox 3.2.12
    oracle vm virtualbox 3.2.14
    oracle vm virtualbox 3.2.2
    oracle vm virtualbox 3.2.4
    oracle vm virtualbox 3.2.6
    oracle vm virtualbox 3.2.8
    oracle vm virtualbox 4.1.26
    oracle vm virtualbox 4.1.24
    oracle vm virtualbox 4.1.10
    oracle vm virtualbox 4.1.12
    oracle vm virtualbox 4.1.14
    oracle vm virtualbox 4.1.16
    oracle vm virtualbox 4.1.18
    oracle vm virtualbox 4.1.2
    oracle vm virtualbox 4.1.20
    oracle vm virtualbox 4.1.22
    oracle vm virtualbox 4.1.4
    oracle vm virtualbox 4.1.6
    oracle vm virtualbox 4.1.8
    oracle vm virtualbox 4.0.18
    oracle vm virtualbox 4.0.0
    oracle vm virtualbox 4.0.10
    oracle vm virtualbox 4.0.12
    oracle vm virtualbox 4.0.14
    oracle vm virtualbox 4.0.16
    oracle vm virtualbox 4.0.2
    oracle vm virtualbox 4.0.4
    oracle vm virtualbox 4.0.6
    oracle vm virtualbox 4.0.8
    oracle vm virtualbox 3.2.18
    oracle vm virtualbox 4.2.18
    oracle vm virtualbox 4.3.0
    oracle vm virtualbox 4.3.2
    oracle vm virtualbox 4.0.20
    oracle vm virtualbox 4.1.28