The remote OVS Administrator is prone to an authentication bypass.

Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain actions.

Update to version 1.2.2 or 1.3.2.

A software bug in the server module 'OVS Administrator' allowed to bypass the OAP authentication procedure. The attack vector is remotely available in case public OAP is enabled. In case of successful attack, the attacker gains partial rights to execute OAP commands.

Try to bypass OAP authentication by sending a special crafted request.

• http://openvas.org/OVSA20131108.html

---

Updated on 2015-03-25