CVE-2013-6766 in Manager
Summary
by MITRE
OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENT_AUTHENTIC.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/02/2021
The vulnerability described in CVE-2013-6766 represents a critical authentication bypass flaw in OpenVAS Administrator versions prior to 1.2.2 and 1.3.2. This issue resides within the OpenVAS Administrator Protocol (OAP) implementation, which governs how administrative commands are processed and authenticated within the OpenVAS vulnerability scanning framework. The flaw specifically targets the authentication state management mechanism that should prevent unauthorized command execution.
The technical exploitation of this vulnerability occurs through a carefully crafted OAP request that specifically targets version information retrieval. When such a malformed request is processed by the vulnerable system, it triggers an unintended state transition where the system incorrectly sets the authentication state to CLIENT_AUTHENTIC. This misconfiguration effectively removes the authentication barrier that should normally be required before executing administrative commands. The vulnerability exploits a design flaw in the state machine implementation where version information requests are not properly validated against existing authentication contexts.
From an operational perspective, this authentication bypass allows remote attackers to execute arbitrary OAP commands without proper authorization. The impact extends beyond simple information disclosure to full administrative control of the OpenVAS Administrator service. Attackers can leverage this vulnerability to perform sensitive operations such as modifying scan configurations, accessing confidential scan results, manipulating user accounts, or even executing arbitrary code on the underlying system. This represents a severe privilege escalation vector that transforms a simple version query into a full system compromise.
The vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems. This classification emphasizes the fundamental flaw in the authentication state management where the system fails to properly validate the authentication context before executing privileged operations. Additionally, the attack pattern corresponds to techniques described in the MITRE ATT&CK framework under T1190 for exploitation of remote services and T1078 for valid accounts usage. The vulnerability demonstrates how seemingly benign functionality can be weaponized to bypass security controls, making it particularly dangerous in enterprise environments where OpenVAS Administrator services are exposed to untrusted networks.
Organizations should immediately apply the vendor patches released for OpenVAS Administrator versions 1.2.2 and 1.3.2 to remediate this vulnerability. Network segmentation should be implemented to limit access to OpenVAS Administrator services, and authentication should be enforced through secure channels only. Regular security assessments should include verification of authentication state management in protocol implementations, and monitoring should be enhanced to detect anomalous OAP request patterns. System administrators should also consider implementing additional access controls such as IP whitelisting and multi-factor authentication to provide defense-in-depth against similar authentication bypass scenarios.