PT-2014-3194 · Greenbone Networks · Openvas Administrator

Publicado 2014-05-19 · Atualizado 2014-05-20 · CVE-2013-6766

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenVAS Administrator versions 1.2 through 1.2.1 OpenVAS Administrator versions 1.3 through 1.3.1

Description The issue allows remote attackers to bypass authentication restrictions and execute commands via a crafted request for version information, causing the state to be set to CLIENT AUTHENTIC. This occurs due to a flaw in handling OAP requests.

Recommendations For OpenVAS Administrator versions 1.2 through 1.2.1, update to version 1.2.2 to resolve the issue. For OpenVAS Administrator versions 1.3 through 1.3.1, update to version 1.3.2 to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-6766

Produtos afetados

Openvas Administrator

Referências · 4

• http://openwall.com/lists/oss-security/2013/11/10/2 · Nota
• http://openvas.org/OVSA20131108.html · Aviso do Fabricante
• http://lists.wald.intevation.org/pipermail/openvas-announce/2013-November/000157.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6766 · Nota de Segurança