exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

OpenVAS Authentication Bypass

OpenVAS Authentication Bypass
Posted Nov 15, 2013
Authored by Tim Brown at OpenVAS

It has been identified that OpenVAS Manager and OpenVAS Administrator are vulnerable to authentication bypass due to an incorrect state assignment when processing OMP and OAP requests. It has been identified that this vulnerability may allow unauthorised access to OpenVAS Manager and OpenVAS Administrator on vulnerable systems.

tags | advisory
advisories | CVE-2013-6765, CVE-2013-6766
SHA-256 | fea21aeb4dde6897080ead6cceae08c814ff068c37348f8083727463c74d3633

OpenVAS Authentication Bypass

Change Mirror Download
OpenVAS Security Advisory (OVSA20131108)
Date: 8th November 2013
Product: OpenVAS Manager < 3.0.7 and < 4.0.4 and OpenVAS Administrator < 1.2.2 and < 1.3.2
Vendor: OpenVAS <http://www.openvas.org/>
Risk: Low

Summary

It has been identified that OpenVAS Manager and OpenVAS Administrator are
vulnerable to authentication bypass due to an incorrect state assignment when
processing OMP and OAP requests. It has been identified that this
vulnerability may allow unauthorised access to OpenVAS Manager and OpenVAS
Administrator on vulnerable systems. CVE-2013-6765 has been assigned to this
vulnerability in Manager and CVE-2013-6766 to the same vulnerability in
Administrator.

Current Status

As of the 8th November, the state of the vulnerabilities is believed
to be as follows. Patches have been supplied by Greenbone Networks which
it successfully resolves this vulnerability. New releases of both OpenVAS
Manager and OpenVAS Administrator have also been created which incorporate
these patches.

Technical Details

It has been identified that OpenVAS Manager and OpenVAS Administrator are
vulnerable to authentication bypass due to an invalid state assignment when
processing OMP and OAP requests.

Upon processing an OMP and OAP request to retrieve the version information
from OpenVAS Administrator and OpenVAS Manager, the state is incorrectly set
to CLIENT_AUTHENTIC, allowing additional OMP and OAP commands to be called.
This can be seen in the omp_xml_handle_end_element() function from omp.c (for
OpenVAS Manager):

if (client_state)
set_client_state (CLIENT_AUTHENTIC);
else
set_client_state (CLIENT_TOP);
break;

In this instance, the first condition will always hold. Rather, the check
should be whether client_state is currently set to CLIENT_GET_VERSION_AUTHENTIC.

It should be noted that not all of the newly available commands are functional,
since they often rely upon additional session state information being present
which will not be the case where the authentication has been bypassed.

Furthermore, the vulnerable code path is typically only accessible to users
who have logged into a host running OpenVAS Manager or OpenVAS Administrator
via SSH as the affected services are typically only bound to localhost.

Fix

OpenVAS recommends that the publicly available patches are applied. If
building from source, then patches r18285 (for OpenVAS Administrator 1.2.x) or
r18281 (for Administrator 1.3.x) and r18276 (for OpenVAS Manager 3.0.x) or
r18271 (for Manager 4.0.x) should be obtained from the OpenVAS SVN repository.

A fresh tarball containing the latest stable release of Administrator
can be obtained from:

* http://wald.intevation.org/frs/download.php/1442/openvas-administrator-1.3.2.tar.gz

A fresh tarball containing the latest stable release of Manager
can be obtained from:

* http://wald.intevation.org/frs/download.php/1434/openvas-manager-4.0.4.tar.gz

In the event that OpenVAS has been supplied as part of a distribution then
the vendor or organisation concerned should be contacted for a patch. Known
major distributors of OpenVAS precompiled packages have already been notified.

History

On the 3rd August 2013, Antonio Sanchez Arago initially attempted to contact the
OpenVAS security team to report the issue in OpenVAS Manager however it was
missed as many of the team were on annual leave.

Unfortunately, it was not picked up until Antonio attempted to contact us again
on in late October. On this occasion, it was picked up and the team were able
to reproduce the vulnerability.

On the 7th November, we contacted Antonio to confirm that the team had
successfully reproduced the issue and Greenbone Networks to notify them of the
vulnerability and request assistance in coordinating the disclosure. Major
distributors of OpenVAS precompiled packages were also notified about the
upcoming patches.

New versions of both OpenVAS Manager and OpenVAS Administrator were released on
the 8th.

The OpenVAS security team then contacted MITRE and on the 9th November,
CVE-2013-6764 and CVE-2013-6766 were assigned for this vulnerability.

Thanks

OpenVAS would like to thank Antonio Sanchez Arago for his help in reporting
the vulnerability and apologise to all concerned for the substantial delay
in triaging his report.
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close