CVE-2011-2305 / CVE-2011-2300

Debian Bug report logs - #635276
CVE-2011-2305 / CVE-2011-2300

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2011-2305 / CVE-2011-2300

Date: Sun, 24 Jul 2011 18:20:33 +0200

Package: virtualbox-ose
Version: 4.0.10-dfsg-1
Severity: grave
Tags: security

Does this affect the versions in Debian?

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2305 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2300

Cheers,
        Moritz

Message #10 received at 635276@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 635276@bugs.debian.org

Subject: Re: CVE-2011-2305 / CVE-2011-2300

Date: Tue, 26 Jul 2011 22:12:10 +0200

On Sun, Jul 24, 2011 at 06:20:33PM +0200, Moritz Muehlenhoff wrote:
> Package: virtualbox-ose
> Version: 4.0.10-dfsg-1
> Severity: grave
> Tags: security
> 
> Does this affect the versions in Debian?
> 
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2305 
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2300

I asked for details on oss-security:

From: Dan Rosenberg <dan.j.rosenberg@gmail.com>
To: oss-security@lists.openwall.com

On Tue, Jul 26, 2011 at 11:19 AM, Moritz Muehlenhoff <jmm@debian.org> wrote:
> Hi,
> does anyone have further information on
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2300 and
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2305
> and whether if affects the open source version of Virtual Box?
>

These issues were found by Tarjei Mandt, and are described in this blog post:
http://mista.nu/blog/author/mista/

CVE-2011-2300 allows gaining elevated privileges within a Windows
guest due to a vulnerability in the Windows Guest Additions.
CVE-2011-2305 allows executing arbitrary code on the host due to a
vulnerability in the VirtualBox graphics stack.

Tarjei found these issues via code auditing, so it follows that they
affect the open source version of VirtualBox.

-Dan

Cheers,
        Moritz

Message #15 received at 635276@bugs.debian.org (full text, mbox, reply):

From: Michael Meskes <meskes@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 635276@bugs.debian.org

Subject: Re: [Pkg-virtualbox-devel] Bug#635276: CVE-2011-2305 / CVE-2011-2300

Date: Wed, 27 Jul 2011 10:58:13 +0200

> These issues were found by Tarjei Mandt, and are described in this blog post:
> http://mista.nu/blog/author/mista/
> 
> CVE-2011-2300 allows gaining elevated privileges within a Windows
> guest due to a vulnerability in the Windows Guest Additions.

It's impossible to check the details here because we only distribute the
Windows Guest Additions as binary in non-free. According to the blog entry
4.0.10, the version in unstable and testing, is fine. I cannot tell ifrom our
sources if the old 3.2.10 version in stable is affected at all. However, if it
was, there is no way to update that package short of uploading the new 4.0
version to stable.

> CVE-2011-2305 allows executing arbitrary code on the host due to a
> vulnerability in the VirtualBox graphics stack.

This one affects only the version in backports. Unstable and testing already
have 4.0.10 which already contains the fix and stable has 3.2.10 which didn't
have the problem.

Michael

-- 
Michael Meskes
Michael at Fam-Meskes dot De, Michael at Meskes dot (De|Com|Net|Org)
Michael at BorussiaFan dot De, Meskes at (Debian|Postgresql) dot Org
Jabber: michael.meskes at googlemail dot com
VfL Borussia! Força Barça! Go SF 49ers! Use Debian GNU/Linux, PostgreSQL

Message #20 received at 635276-done@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <debfx-pkg@fobos.de>

To: 635276-done@bugs.debian.org, Moritz Mühlenhoff <jmm@inutil.org>

Cc: Michael Meskes <meskes@debian.org>

Subject: Re: Bug#635276: [Pkg-virtualbox-devel] Bug#635276: CVE-2011-2305 / CVE-2011-2300

Date: Thu, 28 Jul 2011 14:30:18 +0200

I'm closing this bug as Michael has updated the version in backports
to 4.0.10 and we can't fix virtualbox-guest-additions in stable.

Moritz, can you update the security tracker?
The version information in the original CVEs are wrong, see
http://vbox.innotek.de/pipermail/vbox-dev/2011-July/004383.html

CVE-2011-2300 affects the virtualbox-guest-additions (not virtualbox-ose)
package in squeeze.
CVE-2011-2305 doesn't affect any version in Debian.

Felix

Send a report that this bug log contains spam.