Bug 531094

Summary:	<net-analyzer/openvas-manager-4.0.6/5.0.7 SQL injection (CVE-2014-9220)
Product:	Gentoo Security	Reporter:	Justin Lecher (RETIRED) <jlec>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hanno
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	~3 [noglsa]
Whiteboard:
Package list:		Runtime testing required:	---

Description Justin Lecher (RETIRED) gentoo-dev

2014-11-29 08:31:56 UTC

I got this mail today:

"""
Hello,

The OpenVAS developers have just released two important security
releases for the Open Vulnerability Assessment System release series 6
and 7 (OpenVAS-6 and OpenVAS-7).

The releases are:
- OpenVAS Manager 4.0.6
- OpenVAS Manager 5.0.7

We highly recommend to update your OpenVAS installation to the versions
listed above immediately.

It has been identified that OpenVAS Manager is vulnerable to sql
injections due to a improper handling of the timezone parameter in
modify_schedule OMP command. It has been identified that this
vulnerability may allow read-access via sql for authorized user account
which have permission to modify schedule objects.

For details and current information on this vulnerability please refer
to the following page on the OpenVAS website:

  http://www.openvas.org/OVSA20141128.html

The source tarballs for the releases are available for download from the
OpenVAS website at:

  https://wald.intevation.org/frs/?group_id=29

This page contains signatures and checksums for the source tarballs as
well.

You can find links to the latest source tarballs for all currently
maintained releases here:

  http://openvas.org/install-source.html

Binary packages for major GNU/Linux distributions by third parties are
expected to follow soon.
"""

Don't know whether there is a CVE, but I will try to look into the bump this weekend.

Comment 1 Justin Lecher (RETIRED) gentoo-dev

2014-12-01 16:44:39 UTC

+*openvas-manager-6.0_beta4 (01 Dec 2014)
+*openvas-manager-5.0.7 (01 Dec 2014)
+
+  01 Dec 2014; Justin Lecher <jlec@gentoo.org> -openvas-manager-4.0.4.ebuild,
+  -openvas-manager-5.0.4-r2.ebuild, -openvas-manager-5.0.5.ebuild,
+  +openvas-manager-5.0.7.ebuild, +openvas-manager-6.0_beta4.ebuild:
+  Version Bump; drop old vulnerable versions, #531094
+

Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-12-09 17:43:14 UTC

Thank you for the report, fix and cleanup. Non-stable package, closing noglsa

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2015-01-01 21:12:54 UTC

CVE-2014-9220 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9220):
  SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before
  5.0.7 allows remote attackers to execute arbitrary SQL commands via the
  timezone parameter in a modify_schedule OMP command.