Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injecti
--nextPart4020962.olciALkYy5
Content-Type: multipart/mixed;
boundary="Boundary-01=_ZrmoQ2vyZhaSUO/"
Content-Transfer-Encoding: 7bit
--Boundary-01=_ZrmoQ2vyZhaSUO/
Content-Type: Text/Plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Doh, a document gets proof read by multiple people and yet it contains a=20
mistake. In the Current Status section of the advisory, the date is=20
incorrect. A corrected advisory is attached.
Tim
=2D-=20
Tim Brown
<mailto:timb@openvas,org>
<http://www.openvas.org/>
--Boundary-01=_ZrmoQ2vyZhaSUO/
Content-Type: text/plain;
charset="UTF-8";
name="OVSA20121112.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="OVSA20121112.txt"
OpenVAS Security Advisory (OVSA20121112)
Date: 12th November 2012
Product: OpenVAS Manager < 3.0.4 and < 4.0+beta4
Vendor: OpenVAS <http://www.openvas.org/>
Risk: Medium
Summary
It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
processing OMP requests. It has been identified that this vulnerability
may allow arbitrary code to be executed with the privileges of the
OpenVAS Manager on vulnerable systems. CVE-2012-5520 has been assigned
to this vulnerability.
Current Status
As of the 12th November, the state of the vulnerabilities is believed
to be as follows. A patch has been supplied by Greenbone Networks which
it successfully resolves this vulnerability. New releases of both 3.0.x
and 4.0.x have also been created which incorporate this patch.
Technical Details
It has been identified that OpenVAS Manager is vulnerable to command
injection due to insufficient validation of user supplied data when
sending reports to a Sourcefire Defense Center.
The processing of requests containing malicious values for the ip address
or port causes the command below to be executed with the privileges of
the OpenVAS Manager (typically root) using the send_to_sourcefire()
function from manage_sql.c:
command = g_strdup_printf ("/bin/sh %s %s %s %s %s > /dev/null"
" 2> /dev/null",
script,
ip,
port,
pkcs12_file,
report_file);
....
if (ret = system (command)...
As you can see, an attacker can influence both the ip address and port
within the concatenated string.
The vulnerable code path is only accessible to authenticated users of
OpenVAS Manager.
Fix
OpenVAS recommends that the publicly available patches are applied. If
building from source, then either patch r14404, r14405 and r14421 (trunk)
or r14437 (3.0.x) should be obtained from the OpenVAS SVN repository.
A fresh tarball containing the latest stable release can be obtained from:
* http://wald.intevation.org/frs/download.php/1212/openvas-manager-3.0.4.tar.gz
In the event that OpenVAS has been supplied as part of a distribution
then the vendor or organisation concerned should be contacted for a
patch.
History
On the 7th November 2012, Greenbone Networks contacted the OpenVAS security team
to notify them of the vulnerability and request assistance in
coordinating the disclosure.
OpenVAS Manager 3.0.4 was released on the 7th.
The OpenVAS security team and Greenbone Networks opened a dialogue in order
to draft this advisory and on the 12th November, CVE-2012-5520 was assigned for
this vulnerability.
Thanks
OpenVAS would like to thank Andre Heinecke of Greenbone Networks for
his help in reporting the vulnerability.
--Boundary-01=_ZrmoQ2vyZhaSUO/--
--nextPart4020962.olciALkYy5
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABCAAGBQJQomrZAAoJEPJhpTVyySo73FQP/1nHAfGXbQCm98CAzwsdQhXL
3IYrJe9/pNUU7Phdrf5Pcgh7tmT/pDZ/dBZ2i547o+sTz8vF3WH6FhaGHwXDQ3eJ
DprXfHNejrlrEFL0L/qkMvtpPRVPAIkmSKolG+/H67h4aOCRuuL/nFF7wMAwpbya
EOMO/uF41wlOit1h1SmTV2DAbPswZuDAid6zODaLeAPMbytfBffVVzsXTF7ZpLdc
h4bfg0CBrfYmnEqD7H/zt5Oe/aiojPuaruy6deT6w99gmUgaj400WvKb/4B6Lu6X
egw+xIu0VRq4t7L18HdohRcpxV8nfXxb5+RzgVTpId0WR+muxa6L2e5KZSA/kA43
Za+/NwwUXB54MmjaY9RSpsCe42NsT3M2dXrzGC5MvEnHXPSVigVkwkqBgpmRdGWl
fplrcCoCdtqssrwX3la0Qxxp+6k09CR6VXUesMczyawcgJ10CtV7ZqVTMkKzTzYF
k5XqjtCeVEpEp+WGen9PaJZR6MfVijI+JFEPV33d7qYG381oaaNqe71xDhN4Hh1M
sTgP0HWYvlyu7trf3KrWH1reLFiNYWmhW5ap8vEMyI4ZXDk9xjxbeHjLeyYUwOpR
5LR7lUpPU+buaTtEs30ngIATCPuz4SEpyeDsK4dOTd7fcmPxRQKlJ8zSBkn3Ja/9
SvzXElGddxqvMR8nVnbV
=tzii
-----END PGP SIGNATURE-----
--nextPart4020962.olciALkYy5--