exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

OpenVAS Command Injection

OpenVAS Command Injection
Posted Nov 13, 2012
Authored by Tim Brown at OpenVAS

It has been identified that OpenVAS Manager is vulnerable to command injection due to insufficient validation of user supplied data when processing OMP requests. It has been identified that this vulnerability may allow arbitrary code to be executed with the privileges of the OpenVAS Manager on vulnerable systems.

tags | exploit, arbitrary
advisories | CVE-2012-5520
SHA-256 | 29cfb654d65c6206e5eb00b77e4c9af21b10e0084e0c061d804308cd9283a39f

OpenVAS Command Injection

Change Mirror Download
OpenVAS Security Advisory (OVSA20121112)
Date: 12th November 2012
Product: OpenVAS Manager < 3.0.4 and < 4.0+beta4
Vendor: OpenVAS <http://www.openvas.org/>
Risk: Medium

Summary

It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
processing OMP requests. It has been identified that this vulnerability
may allow arbitrary code to be executed with the privileges of the
OpenVAS Manager on vulnerable systems. CVE-2012-5520 has been assigned
to this vulnerability.

Current Status

As of the 12th November, the state of the vulnerabilities is believed
to be as follows. A patch has been supplied by Greenbone Networks which
it successfully resolves this vulnerability. New releases of both 3.0.x
and 4.0.x have also been created which incorporate this patch.

Technical Details

It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
sending reports to a Sourcefire Defense Center.

The processing of requests containing malicious values for the ip address
or port causes the command below to be executed with the privileges of
the OpenVAS Manager (typically root) using the send_to_sourcefire()
function from manage_sql.c:

command = g_strdup_printf ("/bin/sh %s %s %s %s %s > /dev/null"
" 2> /dev/null",
script,
ip,
port,
pkcs12_file,
report_file);

...
if (ret = system (command)...

As you can see, an attacker can influence both the ip address and port
within the concatenated string.

The vulnerable code path is only accessible to authenticated users of
OpenVAS Manager.

Fix

OpenVAS recommends that the publicly available patches are applied. If
building from source, then either patch r14404, r14405 and r14421 (trunk)
or r14437 (3.0.x) should be obtained from the OpenVAS SVN repository.
A fresh tarball containing the latest stable release can be obtained from:

* http://wald.intevation.org/frs/download.php/1212/openvas-manager-3.0.4.tar.gz

In the event that OpenVAS has been supplied as part of a distribution
then the vendor or organisation concerned should be contacted for a
patch.

History

On the 7th November 2012, Greenbone Networks contacted the OpenVAS security team
to notify them of the vulnerability and request assistance in
coordinating the disclosure.

OpenVAS Manager 3.0.4 was released on the 7th.

The OpenVAS security team and Greenbone Networks opened a dialogue in order
to draft this advisory and on the 12th November, CVE-2012-5520 was assigned for
this vulnerability.

Thanks

OpenVAS would like to thank Andre Heinecke of Greenbone Networks for
his help in reporting the vulnerability.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close