[Pkg-virtualbox-devel] Bug#807542: /usr/lib/virtualbox/vboxwebsrv: started web service without user consent

[Ritesh Raj Sarraf]

Package: virtualbox
Version: 5.0.10-dfsg-4
Severity: important
File: /usr/lib/virtualbox/vboxwebsrv

Hello Gianfranco,


The following has happened without user consent. And especially when
there is no VBox service active.


These days, I'm also exploring KVM, and so have virtualbox not enabled/running
on my box.

rrs at learner:~$ sudo systemctl status vboxweb.service 
[sudo] password for rrs: 
● vboxweb.service - VirtualBox Web Service
   Loaded: loaded (/lib/systemd/system/vboxweb.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2015-12-08 17:18:42 IST; 1 day 20h ago
 Main PID: 1892 (vboxwebsrv)
    Tasks: 18 (limit: 512)
   CGroup: /system.slice/vboxweb.service
           ├─1892 /usr/lib/virtualbox/vboxwebsrv --pidfile /run/vboxweb.pid --background
           ├─1903 /usr/lib/virtualbox/VBoxXPCOMIPCD
           └─1940 /usr/lib/virtualbox/VBoxSVC --auto-shutdown

Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004182 main     OS Product: Linux
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004185 main     OS Release: 4.3.0+
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004186 main     OS Version: #35 SMP PREEMPT Fri Nov 6 18:29:25 IST 2015
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004232 main     DMI Product Name: 20344
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004251 main     DMI Product Version: Lenovo Yoga 2 13
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004362 main     Host RAM: 7908MB total, 7769MB available
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004369 main     Executable: /usr/lib/virtualbox/vboxwebsrv
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004371 main     Process ID: 1728
Dec 08 17:18:42 learner vboxwebsrv[1728]: 00:00:00.004372 main     Package type: LINUX_64BITS_GENERIC (OSE)
Dec 08 17:18:42 learner systemd[1]: Started VirtualBox Web Service.
2015-12-10 / 14:11:35 ♒♒♒  ☺    


rrs at learner:~$ sudo systemctl status virtualbox
[sudo] password for rrs: 
● virtualbox.service - LSB: VirtualBox Linux kernel module
   Loaded: loaded (/etc/init.d/virtualbox; bad; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:systemd-sysv-generator(8)
2015-12-10 / 14:13:28 ♒♒♒    ☹  => 3  


-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (101, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.3.0+ (SMP w/4 CPU cores; PREEMPT)
Locale: LANG=en_IN.utf8, LC_CTYPE=en_IN.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages virtualbox depends on:
ii  adduser                               3.113+nmu3
ii  init-system-helpers                   1.24
ii  libc6                                 2.19-22
ii  libcurl3-gnutls                       7.45.0-1+b1
ii  libgcc1                               1:5.2.1-23
ii  libgsoap7                             2.8.22-1+b1
ii  libpng12-0                            1.2.54-1
ii  libpython2.7                          2.7.10-5+b1
ii  libsdl1.2debian                       1.2.15-12
ii  libssl1.0.2                           1.0.2d-3
ii  libstdc++6                            5.2.1-23
ii  libvncserver1                         0.9.10+dfsg-3
ii  libvpx2                               1.4.0-4
ii  libx11-6                              2:1.6.3-1
ii  libxcursor1                           1:1.1.14-1+b1
ii  libxext6                              2:1.3.3-1
ii  libxml2                               2.9.2+zdfsg1-4
ii  libxmu6                               2:1.1.2-2
ii  libxt6                                1:1.1.5-1
ii  python                                2.7.9-1
ii  python2.7                             2.7.10-5+b1
pn  python:any                            <none>
ii  virtualbox-dkms [virtualbox-modules]  5.0.10-dfsg-4
ii  zlib1g                                1:1.2.8.dfsg-2+b1

Versions of packages virtualbox recommends:
ii  libgl1-mesa-glx [libgl1]  11.0.6-1
ii  libqt4-opengl             4:4.8.7+dfsg-5
ii  libqtcore4                4:4.8.7+dfsg-5
ii  libqtgui4                 4:4.8.7+dfsg-5
ii  virtualbox-qt             5.0.10-dfsg-4

Versions of packages virtualbox suggests:
pn  vde2                            <none>
ii  virtualbox-guest-additions-iso  5.0.10-1

-- no debconf information