CVE-2012-5520 The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP requ...
HighCVSS 7.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openvas manager | = 3.0-beta1 | No fix listed |
| openvas manager | = 3.0-beta2 | No fix listed |
| openvas manager | = 3.0-beta3 | No fix listed |
| openvas manager | = 3.0-beta4 | No fix listed |
| openvas manager | = 3.0-beta5 | No fix listed |
| openvas manager | = 3.0-beta6 | No fix listed |
| openvas manager | = 3.0-beta7 | No fix listed |
| openvas manager | = 3.0-beta8 | No fix listed |
| openvas manager | = 3.0-rc1 | No fix listed |
| openvas manager | = 3.0.0 | No fix listed |
| openvas manager | = 3.0.1 | No fix listed |
| openvas manager | = 3.0.2 | No fix listed |
| openvas manager | = 3.0.3 | No fix listed |
References
- 20121113 [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- 20121114 Re: [oss-security] Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- 20121114 Re: Re: [oss-security] Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- [oss-security] 20121113 Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- [oss-security] 20121113 [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- [oss-security] 20121114 Re: Re: Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- [oss-security] 20121114 Re: Re: [OVSA20121112] OpenVAS Manager Vulnerable To Command Injection mailing-list
- 49128 third-party-advisory
- wald.intevation.org
- www.openvas.org exploit patch vendor-advisory
- 56497 vdb-entry