CVE-2013-6765

High

Published: 19/05/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

OpenVAS Manager versions 3.0 before 3.0.7 and 4.0 before 4.0.4 allow remote attackers to bypass OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information.

Risk Assessment

Attackers may gain access to OpenVAS management functions, potentially leading to unauthorized command execution and security breaches.

Recommendation

It is recommended to update OpenVAS Manager to version 3.0.7 or 4.0.4 to mitigate this vulnerability.

Other vulnerabilities in OpenVAS Manager

CVE-2014-9220High
CVE-2014-9220 describes an SQL injection vulnerability in OpenVAS Manager before version 4.0.6 and 5.x before version 5.0.7. It allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Original NVD description (English source)

OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.