Allow option to disable "hardening" introduced in 4.3.14

[poncho524]

If you are a developer then you already know why the reason is not being published. Exploits are in the wild and no one wants to go there.

Just wanted to add a note about the philosophy of FOSS and security issues.

OpenSSL, which is All about security, is very open about what vulnerabilities they fix. Just take a look at some of their release notes.

I still dont understand why Oracle thinks its fine to not mention fixed vulnerabilities in their release notes (as if VBox's security is more important than OpenSSL).

It would be great to let us know what was deemed fixed. Maybe someone in the SW devel community could do extra testing on it and offer even better fixes.

[Martin]

Is there a "SW devel community" for Virtualbox?
Over the last years I've only seen a few users trying to compile there own version, but no real indication that many developers outside Oracle where contributing.

From my point of view Virtualbox is a commercial application by Oracle where the "community" could use the source code if they wanted to.

[therock247uk]

I don't see how one can sue you for damages relating to using free software heh, if people are using it for commercial purpose (and if something blew up and it kills really important data to the point where someone could be fired/hurt themselves) they should have there own version that has such hardening.

[socratis]

how one can sue you

You're not living in the US, are you? Or in Greece for that matter... [citation needed].

[VM2VM]

I am new to VB forums, but this is one of the first threads I've read. I must say that the discussion is rather interesting, and still appreciate what little feedback was given by the Mods.

[MysteryGuy]

From a prior post:

> Are the developers going to have to explicitly white-list every single user request?

I was waiting for a 'fixed' version to appear, but I see that people still are having issues even in 4.3.18.

I would like to know if the current plan is that every 'incompatible' applications (SEP, etc.) module needs to be white-listed or if this is just supposed to work once all the bugs are ironed out.

If it turns out that every point upgrade of SEP, etc. breaks Virtualbox until a future version is released with the new signatures, then that seems like it will be a major pain...

[Petr Vones]

Follow up of offtopic discussion (started by me) here viewtopic.php?f=6&t=64111

You could say something like:
(a) The vulnerability allows for arbitrary code to be run with privileges on the Host OS, given that the Host OS has already been compromised.
[or] (b) This could allow crossover from guest to host (if thats true, that would be a Big Deal)

This is still my only question. I fully understand why the details are not disclosed. But the basic resolution between the (a) and (b) case should be said. My understanding is that all of this is the (a) one. In this case it is up to user responsibility to keep his/her host system clean. There are Windows features like Software Restriction Policy that effectively prevents loading "bad" DLLs from unwanted locations (temp or documents folders) accessible for write under non-administrator account at OS level (if someone lets his/her system to infect by a malware under administrator account, nothing can help there). Again, I can not agree that there is something wrong with Windows API design related to loading DLLs as has been criticized in recent discussion.

Just to add to what Perry said, imagine the two potential release notes:
[*]Fixed a vulnerability where a guest could gain administrator access to the host (CVE ###).

I am not sure that is the case due the lack of information. Based on available information and current issues I tend (hope) to believe it is the (a) case.

[socratis]

I was just throwing a "For example..." on why they do not disclose the exact information on the nature of the vulnerability, or how to reproduce it. But I believe that michaln has already answered your question:

The problem was, in a nutshell, privilege escalation on the host. In other words, trouble caused by a malicious user or malicious software running with user privileges.

[Petr Vones]

But I believe that michaln has already answered your question:

Not exactly. We know the result but not its cause. It is still open question whether it is (a) or (b) or different case. It is huge difference between the (a) or (b) impact. To say that in a simple way: (a) is user's fault, (b) is VirtualBox's fault.

[Perryg]

@ Petr Vones,

I can appreciate tenacity, but you are moving well beyond what is reasonably acceptable and into the realm of just being a pain . Please accept that you will never be told unless you buy out Oracle and drop the issue.

[Petr Vones]

but you are moving well beyond what is reasonably acceptable and into the realm of just being a pain

It is not the first time I hear that Ok, you win.

[Petr Vones]

Meanwhile ... https://www.virtualbox.org/ticket/13649#comment:5

[mpack]

I feel this topic has run it's course, and become sterile. Locking it.