CVE-2012-5520: Input Validation
Published Nov 26, 2012
·Updated
The sendtosourcefire function in managesql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.
Affected Software
13 affected components
OpenVAS OpenVAS Manager=3.0-beta1
OpenVAS OpenVAS Manager=3.0-beta2
OpenVAS OpenVAS Manager=3.0-beta3
OpenVAS OpenVAS Manager=3.0-beta4
OpenVAS OpenVAS Manager=3.0-beta5
OpenVAS OpenVAS Manager=3.0-beta6
OpenVAS OpenVAS Manager=3.0-beta7
OpenVAS OpenVAS Manager=3.0-beta8
OpenVAS OpenVAS Manager=3.0-rc1
OpenVAS OpenVAS Manager=3.0.0
OpenVAS OpenVAS Manager=3.0.1
OpenVAS OpenVAS Manager=3.0.2
OpenVAS OpenVAS Manager=3.0.3
Remediation
Patch Available
Event History
Nov 26, 2012
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-5520?
CVE-2012-5520 is considered a high severity vulnerability as it allows remote attackers to execute arbitrary commands.
2
How do I fix CVE-2012-5520?
To fix CVE-2012-5520, update OpenVAS Manager to version 3.0.4 or later.
3
What software versions are affected by CVE-2012-5520?
CVE-2012-5520 affects OpenVAS Manager versions 3.0-beta1 through 3.0.3.
4
Can CVE-2012-5520 be exploited remotely?
Yes, CVE-2012-5520 can be exploited remotely via specific fields in an OMP request.
5
What is the impact of CVE-2012-5520 on system security?
The impact of CVE-2012-5520 on system security is significant as it permits arbitrary command execution.