OpenVAS Manager Remote Arbitrary Command Injection Vulnerability

Bugtraq ID:	45987
Class:	Input Validation Error
CVE:	CVE-2011-0018
Remote:	Yes
Local:	No
Published:	Jan 25 2011 12:00AM
Updated:	Mar 19 2015 08:49AM
Credit:	Ronald Kingma and Alexander van Eee of ISSX.
Vulnerable:	OpenVAS Project OpenVAS Manager 2.0 OpenVAS Project OpenVAS Manager 1.0
Not Vulnerable:

OpenVAS Manager Remote Arbitrary Command Injection Vulnerability

OpenVAS Manager is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary code with the privileges of the application or to execute arbitrary commands with elevated privileges.

OpenVAS Manager Remote Arbitrary Command Injection Vulnerability

An exploit has been provided by the vendor which demonstrates command execution with escalated privileges. Please see the references for more details.

OpenVAS Manager Remote Arbitrary Command Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

OpenVAS Manager Remote Arbitrary Command Injection Vulnerability

References:

• OpenVAS (OpenVAS Project)
  
• [OVSA20110118] OpenVAS Manager Vulnerable To Command Injection (OpenVAS Project)