PT-2014-3193 · Greenbone Networks · Openvas Manager

Publicado 2014-05-19 · Atualizado 2014-05-19 · CVE-2013-6765

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenVAS Manager versions 3.0 through 3.0.6 OpenVAS Manager versions 4.0 through 4.0.3

Description The issue allows remote attackers to bypass authentication restrictions and execute commands via a crafted request for version information. This is demonstrated by the omp xml handle end element function in omp.c, which causes the state to be set to CLIENT AUTHENTIC.

Recommendations For OpenVAS Manager versions 3.0 through 3.0.6, update to version 3.0.7 to resolve the issue. For OpenVAS Manager versions 4.0 through 4.0.3, update to version 4.0.4 to resolve the issue.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-6765

Produtos afetados

Openvas Manager

Referências · 5

• 🔥 https://exploit-db.com/exploits/34026 · Exploit
• http://openvas.org/OVSA20131108.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6765 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/11/10/2 · Nota
• http://lists.wald.intevation.org/pipermail/openvas-announce/2013-November/000157.html · Aviso do Fabricante