Some vulnerabilities have been discovered in Nessus Vulnerability Scanner, which can be exploited by malicious people to overwrite or delete arbitrary files or compromise a vulnerable system.

The vulnerabilities are caused due to the SCANCTRL.ScanCtrlCtrl.1 (scan.dll) ActiveX control including the insecure "deleteReport()", "deleteNessusRC()", "saveNessusRC()", and "addsetConfig()" methods. These can be exploited to e.g. delete or corrupt arbitrary files on the system or load malicious script code and then save it in an arbitrary location on a user's system in the context of the currently logged-on user.

The vulnerabilities are confirmed on version 3.0.6. Prior versions may also be affected.

Solution
Update to version 3.0.6.1.
Further details available to Secunia VIM customers

Provided and/or discovered by
"deleteReport()" and "addsetConfig()" methods reported by Krystian Kloskowski. Additional information provided by Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Tenable Network Security:
http://www.nessus.org/news/

http://milw0rm.com/exploits/4230
http://milw0rm.com/exploits/4237

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers