The remote OVS Manager is prone to an authentication bypass.

Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain actions.

Update to version 3.0.7 or 4.0.4.

A software bug in the server module 'OVS Manager' allowed to bypass the OMP authentication procedure. The attack vector is remotely available in case public OMP is enabled. In case of successful attack, the attacker gains partial rights to execute OMP commands. The bypass authentication is, however, incomplete and several OMP commands will fail to execute properly.

Try to bypass OMP authentication by sending a special crafted request.

• http://openvas.org/OVSA20131108.html

---

Updated on 2015-03-25