[ GLSA 200408-21 ] Cacti: SQL injection vulnerability

[Kurt Lieber <klieber () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200408-21
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Cacti: SQL injection vulnerability
      Date: August 23, 2004
      Bugs: #60630
        ID: 200408-21

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

With special configurations of Cacti it is possible to change passwords
via a SQL injection attack.

Background
==========

Cacti is a complete web-based front end to rrdtool.

Affected packages
=================

    -------------------------------------------------------------------
     Package             /  Vulnerable  /                   Unaffected
    -------------------------------------------------------------------
  1  net-analyzer/cacti      <= 0.8.5a                    >= 0.8.5a-r1

Description
===========

Cacti is vulnerable to a SQL injection attack where an attacker may
inject SQL into the Username field.

Impact
======

An attacker could use these vulnerabilities to compromise the Cacti
service and potentially execute programs with the permissions of the
user running Cacti.

Workaround
==========

To prevent SQL code injection, php_flag magic_quotes_gpc should be set
to Off. By default, Gentoo Linux installs PHP with this option set to
Off.

Resolution
==========

All users should upgrade to the latest available version of Cacti, as
follows:

    # emerge sync

    # emerge -pv ">=net-analyzer/cacti-0.8.5a-r1"
    # emerge ">=net-analyzer/cacti-0.8.5a-r1"

References
==========

  [ 1 ] Full Disclosure Announcement
        http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0717.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

    http://security.gentoo.org/glsa/glsa-200408-21.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

Attachment: _bin
Description: