[OVSA20110118] OpenVAS Manager Vulnerable To Command Injection

Summary

It has been identified that OpenVAS Manager is
vulnerable to command injection
due to insufficient validation of user supplied data
when processing OMP
requests. It has been identified that this vulnerability
allows privilege
escalation within the OpenVAS Manager but more complex
injection may allow
arbitrary code to be executed with the privileges of the
OpenVAS Manager on
vulnerable systems. CVE-2011-0018 has been assigned to
this vulnerability.

The vulnerable code path is only accessible to
authenticated users of OpenVAS
Manager however it may also be triggered either directly
or by using a cross-
site request forgery based attack via the Greenbone
Security Assistant web
application.

Current Status

As of the 20th January 2011, the state of the
vulnerabilities is believed to
be as follows. A patch has been supplied by Greenbone
Networks which it
successfully resolves this vulnerability. New releases
of both 1.0.x and 2.0.x
have also been created which incorporate this patch.
Note that the cross-site
address forgery elements of this vulnerability have not
yet been addressed in
the Greenbone Security Assistant web application.

Thanks

OpenVAS would like to thank Ronald Kingma and Alexander
van Eee of ISSX for
their help in reporting the vulnerability.

Tim Brown
<mailto:[email protected]>
<http://www.openvas.org/&gt;