OpenVAS Command Injection

2012.11.14
Risk: High
Local: No
Remote: No
CWE: CWE-78


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

OpenVAS Security Advisory (OVSA20121112) Date: 12th November 2012 Product: OpenVAS Manager < 3.0.4 and < 4.0+beta4 Vendor: OpenVAS <http://www.openvas.org/> Risk: Medium Summary It has been identified that OpenVAS Manager is vulnerable to command injection due to insufficient validation of user supplied data when processing OMP requests. It has been identified that this vulnerability may allow arbitrary code to be executed with the privileges of the OpenVAS Manager on vulnerable systems. CVE-2012-5520 has been assigned to this vulnerability. Current Status As of the 12th November, the state of the vulnerabilities is believed to be as follows. A patch has been supplied by Greenbone Networks which it successfully resolves this vulnerability. New releases of both 3.0.x and 4.0.x have also been created which incorporate this patch. Technical Details It has been identified that OpenVAS Manager is vulnerable to command injection due to insufficient validation of user supplied data when sending reports to a Sourcefire Defense Center. The processing of requests containing malicious values for the ip address or port causes the command below to be executed with the privileges of the OpenVAS Manager (typically root) using the send_to_sourcefire() function from manage_sql.c: command = g_strdup_printf ("/bin/sh %s %s %s %s %s > /dev/null" " 2> /dev/null", script, ip, port, pkcs12_file, report_file); ... if (ret = system (command)... As you can see, an attacker can influence both the ip address and port within the concatenated string. The vulnerable code path is only accessible to authenticated users of OpenVAS Manager. Fix OpenVAS recommends that the publicly available patches are applied. If building from source, then either patch r14404, r14405 and r14421 (trunk) or r14437 (3.0.x) should be obtained from the OpenVAS SVN repository. A fresh tarball containing the latest stable release can be obtained from: * http://wald.intevation.org/frs/download.php/1212/openvas-manager-3.0.4.tar.gz In the event that OpenVAS has been supplied as part of a distribution then the vendor or organisation concerned should be contacted for a patch. History On the 7th November 2012, Greenbone Networks contacted the OpenVAS security team to notify them of the vulnerability and request assistance in coordinating the disclosure. OpenVAS Manager 3.0.4 was released on the 7th. The OpenVAS security team and Greenbone Networks opened a dialogue in order to draft this advisory and on the 12th November, CVE-2012-5520 was assigned for this vulnerability. Thanks OpenVAS would like to thank Andre Heinecke of Greenbone Networks for his help in reporting the vulnerability.

References:

http://www.openvas.org/
http://wald.intevation.org/frs/download.php/1212/openvas-manager-3.0.4.tar.gz


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top