BugTraq
[OVSA20121112] OpenVAS Manager Vulnerable To Command Injection Nov 13 2012 03:09PM
Tim Brown (timb openvas org) (1 replies)
Summary

It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
processing OMP requests. It has been identified that this vulnerability
may allow arbitrary code to be executed with the privileges of the
OpenVAS Manager on vulnerable systems. CVE-2012-5520 has been assigned
to this vulnerability.

Current Status

As of the 20th January 2011, the state of the vulnerabilities is believed
to be as follows. A patch has been supplied by Greenbone Networks which
it successfully resolves this vulnerability. New releases of both 3.0.x
and 4.0.x have also been created which incorporate this patch.

Thanks

OpenVAS would like to thank Andre Heinecke of Greenbone Networks for
his help in reporting the vulnerability.
--
Tim Brown
<mailto:timb@openvas,org>
<http://www.openvas.org/>
OpenVAS Security Advisory (OVSA20121112)
Date: 12th November 2012
Product: OpenVAS Manager < 3.0.4 and < 4.0+beta4
Vendor: OpenVAS <http://www.openvas.org/>
Risk: Medium

Summary

It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
processing OMP requests. It has been identified that this vulnerability
may allow arbitrary code to be executed with the privileges of the
OpenVAS Manager on vulnerable systems. CVE-2012-5520 has been assigned
to this vulnerability.

Current Status

As of the 20th January 2011, the state of the vulnerabilities is believed
to be as follows. A patch has been supplied by Greenbone Networks which
it successfully resolves this vulnerability. New releases of both 3.0.x
and 4.0.x have also been created which incorporate this patch.

Technical Details

It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
sending reports to a Sourcefire Defense Center.

The processing of requests containing malicious values for the ip address
or port causes the command below to be executed with the privileges of
the OpenVAS Manager (typically root) using the send_to_sourcefire()
function from manage_sql.c:

command = g_strdup_printf ("/bin/sh %s %s %s %s %s > /dev/null"
" 2> /dev/null",
script,
ip,
port,
pkcs12_file,
report_file);

...
if (ret = system (command)...

As you can see, an attacker can influence both the ip address and port
within the concatenated string.

The vulnerable code path is only accessible to authenticated users of
OpenVAS Manager.

Fix

OpenVAS recommends that the publicly available patches are applied. If
building from source, then either patch r14404, r14405 and r14421 (trunk)
or r14437 (3.0.x) should be obtained from the OpenVAS SVN repository.
A fresh tarball containing the latest stable release can be obtained from:

* http://wald.intevation.org/frs/download.php/1212/openvas-manager-3.0.4.t
ar.gz

In the event that OpenVAS has been supplied as part of a distribution
then the vendor or organisation concerned should be contacted for a
patch.

History

On the 7th November 2012, Greenbone Networks contacted the OpenVAS security team
to notify them of the vulnerability and request assistance in
coordinating the disclosure.

OpenVAS Manager 3.0.4 was released on the 7th.

The OpenVAS security team and Greenbone Networks opened a dialogue in order
to draft this advisory and on the 12th November, CVE-2012-5520 was assigned for
this vulnerability.

Thanks

OpenVAS would like to thank Andre Heinecke of Greenbone Networks for
his help in reporting the vulnerability.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAABCAAGBQJQomKtAAoJEPJhpTVyySo7GB4P/jF+Jh89LzoVl14v02l229N6
xb7G8Oo+kU7Y5oVJM3Leb9CJ98JDTW8AkF0blW60mxa1tsiuvcI4cLATE9H9HGMT
nyzqRhHG4QwCLCmWZIDQvzuOYPHxkWl7dxbz7ex2UK/7iVcyXD6XIfC8jHI5beMc
ZBNqyKLef27oPTeYacvB5R2iDJTsnldkGIOMnPqe0VgWIi6mHdpHrxmkp4/Ebfhh
f0XW+s1pTyw7Sh4EB5sQfqT1ihj495Um4CzJsBb7LBjDjnjZD9eeRRhD47o4c+Iz
2yYLBOV9u5jK4OWQOhAHTOwF/0r6EBi12ahN8WqSLjpHaYDd6xiBjZ2YZO8cfWwm
uzCZVQGtwGHGKjlw94rvJLXE/eJZnMqIeauonGi8z51hg0x+bCZKelw5f5H+RwPq
J9HuuH9kvajF2LWn7VxGrKzh1Hb86I6fkYF8P7CjdTfd4lnTRpuAnVa9pq2lAMev
MJkeR13pP/cVYpXlUz2dMAzGaoora2bXpyVlN3P2sAFsY0jaw+NNUZwh1zAU9ExK
D5jQRUBe5xNjJVVmUDtcvyVL4c7FGMWHueNfqI3NK3bDYmuo1q94xRtpOmc5H3vq
4BRjRRPrep+mZWDuk1Z9eCiWUfCseLmKiu9sUDQxsyTVjWGk4Plf36QKAvF5L82g
TwriBuyO+WcImxSfMVia
=64r0
-----END PGP SIGNATURE-----

[ reply ]
Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection Nov 13 2012 03:44PM
Tim Brown (timb openvas org) (1 replies)
Re: [oss-security] Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection Nov 14 2012 10:12AM
Jan Lieskovsky (jlieskov redhat com) (1 replies)


 

Privacy Statement
Copyright 2010, SecurityFocus