Cacti Input Validation Holes Let Remote Users Inject SQL Commands and Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1014252
|
|
SecurityTracker URL: http://securitytracker.com/id?1014252
|
|
CVE Reference: CVE-2005-1524
, CVE-2005-1525
, CVE-2005-1526
(Links to External Site)
|
Updated: Jul 7 2008
|
Original Entry Date: Jun 21 2005
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 0.8.6e
|
Description: Some input validation vulnerabilities were reported in Cacti. A remote user can inject SQL commands. A remote user can execute arbitrary commands on the target system.
The software does not properly validate user-supplied input. A remote user can supply specially crafted parameter values to execute
SQL commands on the underlying database.
If the 'register_globals' configuration is set to 'on' in the target user's 'php.ini'
configuration file, then a remote user can supply a specially crafted URL to overwrite certain PHP variables and cause the system
to include and execute arbitrary PHP code. The PHP code, including operating system commands, will run with the privileges of the
target web service.
The vendor credits iDEFENSE with reporting these vulnerabilities.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
A remote user can execute SQL commands on the underlying database.
|
Solution: The vendor has released a fixed version (0.8.6e), available at:
http://www.cacti.net/download_cacti.php
A patch for 0.8.6d is also available at:
http://www.cacti.net/downloads/patches/0.8.6d/cacti_0_8_6e_security.patch
|
Vendor URL: www.raxnet.net/products/cacti/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Ian Berry <iberry@host.domain>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 2005-06-20 19:50
From: Ian Berry <iberry@host.domain>
Subject: Cacti 0.8.6e Released
|
Cacti version 0.8.6e has been released to address two security
vulnerabilities that have been disclosed by the iDEFENSE group. In
addition, a few bug fixes related to RRDtool 1.2 support, data sources,
and the poller have been included.
It is recommended that all users upgrade to this release or use the
patch provided against 0.8.6d containing the security fixes. The patch
and instructions for applying the patch can be found here:
http://www.cacti.net/download_patches.php?version=0.8.6d
See the release notes for a complete list of changes in this version:
http://www.cacti.net/release_notes_0_8_6e.php
Or download version 0.8.6e here:
http://www.cacti.net/download_cacti.php
Ian
|
|
