PT-2014-3194 · Greenbone Networks · Openvas Administrator

Published 2014-05-19 · Updated 2014-05-20 · CVE-2013-6766

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenVAS Administrator versions 1.2 through 1.2.1 OpenVAS Administrator versions 1.3 through 1.3.1

Description The issue allows remote attackers to bypass authentication restrictions and execute commands via a crafted request for version information, causing the state to be set to CLIENT AUTHENTIC. This occurs due to a flaw in handling OAP requests.

Recommendations For OpenVAS Administrator versions 1.2 through 1.2.1, update to version 1.2.2 to resolve the issue. For OpenVAS Administrator versions 1.3 through 1.3.1, update to version 1.3.2 to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-6766

Affected Products

Openvas Administrator

References · 4

• http://openvas.org/OVSA20131108.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6766 · Security Note
• http://openwall.com/lists/oss-security/2013/11/10/2 · Note
• http://lists.wald.intevation.org/pipermail/openvas-announce/2013-November/000157.html · Note