Summary
The remote OVS Administrator is prone to an authentication bypass.
Impact
Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain actions.
Solution
Update to version 1.2.2 or 1.3.2.
Insight
A software bug in the server module 'OVS Administrator' allowed to bypass the OAP authentication procedure. The attack vector is remotely available in case public OAP is enabled.
In case of successful attack, the attacker gains partial rights to execute OAP commands.
Detection
Try to bypass OAP authentication by sending a special crafted request.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-6766 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Adobe AIR Multiple Vulnerabilities -01 Feb13 (Linux)
- 7T Interactive Graphical SCADA System Multiple Security Vulnerabilities
- Adobe Air Code Execution and DoS Vulnerabilities (Windows)
- Adobe AIR Multiple Vulnerabilities -01 Feb13 (Mac OS X)
- Adobe ExtendedScript Toolkit (ESTK) Insecure Library Loading Vulnerability (Win)