PT-2006-3073 · Tenable · Nessus

Published 2006-04-29 · Updated 2018-10-18 · CVE-2006-2093

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Nessus versions prior to 2.2.8 Nessus versions 3.x prior to 3.0.3

Description The issue allows user-assisted attackers to cause a denial of service via a NASL script that calls the split function with an invalid sep parameter. This could lead to excessive memory consumption. The NASL language is designed to guarantee that a script cannot perform malicious actions, but in this case, the expectation that a split statement will not use excessive memory may not be met.

Recommendations For Nessus versions prior to 2.2.8, update to version 2.2.8 or later. For Nessus versions 3.x prior to 3.0.3, update to version 3.0.3 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-2093

Affected Products

Nessus

References · 10

• http://securitytracker.com/id?1015996 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2093 · Security Note
• http://vupen.com/english/advisories/2006/1541 · Vendor Advisory
• https://usn.ubuntu.com/279-1 · Vendor Advisory
• http://securityreason.com/securityalert/817 · Note
• http://osvdb.org/25084 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26034 · Note
• http://securityfocus.com/archive/1/431994/100/0/threaded · Note
• http://securityfocus.com/archive/1/431993/100/0/threaded · Note
• http://securityfocus.com/archive/1/431987/100/0/threaded · Note