This host is installed with OVS Manager and is prone command injection vulnerability.

Successful exploitation will allow attacker to execute arbitrary commands with the privileges of the OVS Manager (typically root).

Apply the patch or upgrade to OVS Manager 1.0.4, 2.0.2 or later, For update refer, http://www.openvas.org/ http://www.openvas.org/OVSA20110118.html ***** NOTE : Ignore this warning, if above mentioned patch is already applied. *****

The flaw is due to an input validation error in the 'email()' function in 'manage_sql.c' while processing OMP (OVS Management Protocol) requests sent by authenticated users of the GSA (Greenbone Security Assistant) web application.

OVS Manager versions prior to 1.0.4 and prior to 2.0.2

• http://osvdb.org/70639
• http://secunia.com/advisories/43037
• http://www.exploit-db.com/exploits/16086/
• http://www.openvas.org/OVSA20110118.html
• http://www.vupen.com/english/advisories/2011/0208
• http://xforce.iss.net/xforce/xfdb/65011

---

Updated on 2015-03-25