[CVE-2007-6035] cacti has a sql injection vulnerability

[Stephan Rügamer]

Binary package hint: cacti

Dear Colleagues,

a sql injection vulnerability was found for cacti < 0.8.7a.

From NVD:

SQL injection vulnerability in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Regards,

\sh

[William Grant (wgrant)]

I believe that CVE-2007-311[23] also affect all releases. It might be good to fix those now too.

[Stephan Rügamer (sruegamer)]

working on it, please don't push this to -security.

Updated debdiffs are coming.

[Stephan Rügamer (sruegamer)]

CVE-2007-311[23] already fixed in our cacti package for gutsy...

\sh

[Stephan Rügamer (sruegamer)]

no drupal5 in dapper

[Kees Cook (kees)]

Thanks for the debdiffs! These look good, I've got them building now. They should publish shortly.

[Christian Weigel (christian-dm00)]

this might be a different issue, but running checks with Nessus reported this problem on one of my machines:

"The version of Cacti does not properly check
whether the 'copy_cacti_user.php' script is being run from a
commandline and fails to sanitize user-supplied input before using it
in database queries. Provided PHP's 'register_argc_argv' parameter is
enabled, which is the default, an attacker can leverage this issue to
launch SQL injection attack against the underlying database and, for
example, add arbitrary administrative users."

I ran the test script at

http://milw0rm.com/exploits/3045

"successfully" with Dapper (Cacti 0.8.6h-ubuntu1)

[William Grant (wgrant)]

Oh dear, that's correct. Stephan apparently marked this Dapper task Invalid, when he thought it was another bug... Stephan, could you please provide a debdiff for Dapper when you have time?

No releases other than Dapper should remain affected.

[Stephan Rügamer (sruegamer)]

Fck....

Sure...

[Brian Thomason (brian-thomason)]

I have attached a debdiff for Dapper based on Stephan's work. I ran the exploit script to verify, and while the exploit does not succeed, the query simply fails that it attempts. If anyone else has cacti setup and would like to test this patch I'd appreciate it.

[Jamie Strandboge (jdstrand)]

Marking as In Progress per SecurityUpdateProcedures

[Jamie Strandboge (jdstrand)]

Thanks for the debdiff Brian! It looks great and I have committed it to our security queue.

[Jamie Strandboge (jdstrand)]

This was published a couple days ago. Thanks again for the patch Brian!