CVE-2013-6765 OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information,....
HighCVSS 7.5
EPSS 7.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openvas manager | = 4.0-beta1 | No fix listed |
| openvas manager | = 4.0-beta2 | No fix listed |
| openvas manager | = 4.0-beta3 | No fix listed |
| openvas manager | = 4.0-beta4 | No fix listed |
| openvas manager | = 4.0-beta5 | No fix listed |
| openvas manager | = 4.0-rc1 | No fix listed |
| openvas manager | = 4.0.0 | No fix listed |
| openvas manager | = 4.0.1 | No fix listed |
| openvas manager | = 4.0.2 | No fix listed |
| openvas manager | = 4.0.3 | No fix listed |
| openvas manager | = 3.0-beta1 | No fix listed |
| openvas manager | = 3.0-beta2 | No fix listed |
| openvas manager | = 3.0-beta3 | No fix listed |
| openvas manager | = 3.0-beta4 | No fix listed |
| openvas manager | = 3.0-beta5 | No fix listed |
| openvas manager | = 3.0-beta6 | No fix listed |
| openvas manager | = 3.0-beta7 | No fix listed |
| openvas manager | = 3.0-beta8 | No fix listed |
| openvas manager | = 3.0-rc1 | No fix listed |
| openvas manager | = 3.0.0 | No fix listed |
| openvas manager | = 3.0.1 | No fix listed |
| openvas manager | = 3.0.2 | No fix listed |
| openvas manager | = 3.0.3 | No fix listed |
| openvas manager | = 3.0.4 | No fix listed |
| openvas manager | = 3.0.5 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| openvas manager | = 3.0.6 | No fix listed |
References
- [Openvas-announce] 20131108 Security Releases for OpenVAS-5 and OpenVAS-6 mailing-list vendor-advisory
- www.openvas.org
- [oss-security] 20131110 CVE-2013-6765 CVE-2013-6766 for OpenVAS 4.0.4/1.3.2/etc. mailing-list