CVE-2013-6765 in Manager
Summary
by MITRE
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/05/2024
The vulnerability described in CVE-2013-6765 represents a critical authentication bypass flaw in OpenVAS Manager versions prior to 3.0.7 and 4.0.4. This issue stems from improper handling of OpenVAS Management Protocol (OMP) requests, specifically targeting the version information query mechanism. The flaw allows remote attackers to circumvent the intended authentication controls that should restrict access to OMP commands, effectively enabling unauthorized execution of administrative functions. The vulnerability manifests through a crafted OMP request that manipulates the authentication state of the system, causing the application to incorrectly set the client state to CLIENT_AUTHENTIC without proper verification.
The technical implementation of this vulnerability occurs within the omp.c source file, specifically in the omp_xml_handle_end_element function where the authentication state management fails to properly validate incoming requests. This function processes XML elements from OMP requests and contains a logic flaw that permits authentication state transitions without adequate credential verification. The flaw exploits the system's trust in version information requests, treating them as legitimate authentication tokens rather than requiring proper authentication credentials. This represents a classic case of insufficient input validation and authentication state management, which falls under CWE-287 - Improper Authentication and CWE-306 - Missing Authentication for Critical Function.
The operational impact of this vulnerability is severe as it grants remote attackers complete administrative control over OpenVAS Manager systems. Attackers can execute any OMP command available in the system without proper authentication, potentially leading to complete system compromise, data exfiltration, and unauthorized network scanning activities. The vulnerability is particularly dangerous because it operates at the protocol level, meaning attackers can leverage standard OMP clients to exploit the flaw without requiring specialized tools or deep system knowledge. This makes the attack surface significantly larger and the exploitation more accessible to threat actors with basic network security knowledge.
Mitigation strategies for this vulnerability include immediate patching to versions 3.0.7 and 4.0.4 or later, which contain the necessary authentication state management fixes. Organizations should also implement network segmentation to restrict access to OpenVAS Manager services, deploy intrusion detection systems to monitor for suspicious OMP traffic patterns, and enforce strict firewall rules limiting access to the OpenVAS Manager ports. Additionally, implementing multi-factor authentication mechanisms and regular security audits of the OpenVAS configuration can provide additional layers of protection. From an ATT&CK framework perspective, this vulnerability maps to T1078 - Valid Accounts and T1566 - Phishing, as it allows for unauthorized access through legitimate authentication mechanisms and can be exploited as part of broader attack campaigns. The vulnerability also demonstrates the importance of proper state management in security-critical applications and highlights the need for comprehensive authentication testing during security reviews.