CVE-2011-0018: Input Validation
Published Jan 28, 2011
·Updated
The email function in managesql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the (1) To or (2) From e-mail address in an OMP request to the Greenbone Security Assistant (GSA).
Affected Software
17 affected components
OpenVAS OpenVAS Manager=1.0.0-beta2
OpenVAS OpenVAS Manager=2.0-rc1
OpenVAS OpenVAS Manager=1.0.0-beta5
OpenVAS OpenVAS Manager=1.0.0
OpenVAS OpenVAS Manager=1.0.2
OpenVAS OpenVAS Manager=2.0-beta2
OpenVAS OpenVAS Manager=1.0.1
OpenVAS OpenVAS Manager=2.0-rc2
OpenVAS OpenVAS Manager=1.0.0-beta4
OpenVAS OpenVAS Manager=2.0-beta1
OpenVAS OpenVAS Manager=1.0.0-rc1
OpenVAS OpenVAS Manager=1.0.0-beta7
OpenVAS OpenVAS Manager=2.0-beta3
OpenVAS OpenVAS Manager=1.0.0-beta3
OpenVAS OpenVAS Manager=1.0.0-beta6
OpenVAS OpenVAS Manager=1.0.0-beta1
OpenVAS OpenVAS Manager=1.0.3
Remediation
Patch Available
Event History
Jan 28, 2011
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-0018?
CVE-2011-0018 is considered a medium severity vulnerability.
2
How do I fix CVE-2011-0018?
To fix CVE-2011-0018, you should upgrade your OpenVAS Manager to version 2.0.0 or later.
3
Who is affected by CVE-2011-0018?
CVE-2011-0018 affects OpenVAS Manager versions 1.0.x through 1.0.3 and 2.0.x through 2.0rc2.
4
What type of attack can exploit CVE-2011-0018?
CVE-2011-0018 can be exploited by remote authenticated users to execute arbitrary commands.
5
Which components of OpenVAS are involved in CVE-2011-0018?
The vulnerability in CVE-2011-0018 is related to the email function in manage_sql.c of OpenVAS Manager.