Recently, a Russian vulnerability researcher and exploit dev published detailed info about a zero-day vulnerability in VirtualBox. His explanation includes a step-by-step guide on exploiting the bug. The bug is present on the software itself, allowing all the platforms to be vulnerable.

Using the bug, an attacker would easily escape the virtual environment and reach the Ring 3 privilege layer – a layer for running code from most user programs with the least privileges.

How the vulnerability works

According to Sergey Zelenyuk who identified the bug, shows details on how the bug can be leveraged on virtual machines configured with the “Intel PRO/1000 MT Desktop (82540EM)” network adapter in NAT mode. It’s the default setup of all the guest systems for accessing external networks.

According to a technical write-up by Zelenyuk, the network adapter is vulnerable that allows an attacker with root/admin privilege to escape to the host Ring 3. Then, using existing techniques, the attacker can escalate privileges to Ring 0 via /dev/vboxdrv.

The researcher describes the mechanics in detail, showing how to create the necessary conditions for obtaining a buffer overflow to abuse and escape the virtual confinement.

100% Reliable

The exploit Zelenyuk wrote relies on the 2 conditions. Although not impossible, an attacker has to chain another vulnerability for granting them increased privilege on the host system.

Here’s a demo he showed.

The post VirtualBox Zero-day Vulnerability appeared first on Linux Windows and android Tutorials.

VirtualBox is definitely the most popular software to perform this task. It’s open-source, powerful and free of cost. It also supports all the OS in the market to run in a virtual environment. For example, you can even install the most unpopular Linux distros without any trouble.

Installing VirtualBox in the system is quite easy. However, installing it in Linux systems isn’t. Here’s how to install VirtualBox for Linux users.

There are 2 ways you can install VirtualBox – the easy & hard ways.

The easy way

Universal Method (for all Linux distro)

Let’s take a look at the universal way.

• Go to VirtualBox downloads page.
• Download the .RUN package.

• Open the terminal in your Linux distro.
• Run the following commands:

cd ~/Downloads
chmod +x VirtualBox-5.2.8-121009-Linux_amd64.run
sudo ./VirtualBox-5.2.8-121009-Linux_amd64.run

Note: If you end up with some type of error for any missing package, you have to install those first.

Voila! Installation complete. To start VirtualBox, run the following command in terminal:

virtualbox

To uninstall the program, you can use the following commands:

cd /opt/VirtualBox
sudo ./uninstall.sh

Distro-wise

You can also download and install other packages according to your Linux distro. That’s more recommended than this way because it isn’t easy for new users. For example, I’m using Xubuntu 17.04. So, I have to download the responsive DEB package and install it.

For installing the DEB package on your Ubuntu/Ubuntu-based distro, run the following commands:

sudo dpkg -i VirtualBox-5.2_5.2.8-121009_Ubuntu_zetsy_amd64.deb
sudo apt install -f

OpenSUSE users, install the RPM package using these command:

zypper install VirtualBox-5.2-5.2.8_121009_openSUSE132-1.x86_64.rpm

Fedora users, run these commands:

sudo dnf install VirtualBox-5.2-5.2.8_121009_fedora26-1.x86_64.rpm

The hard way

You’ll find the in-depth instruction of installing VirtualBox via commands in the VirtualBox downloads page.

Enjoy!

The post How to Install VirtualBox on Linux appeared first on Linux Windows and android Tutorials.