oss-sec mailing list archives
Re: CVE Request -- Cacti v0.8.7 -- three security fixes
From: Tony Roman <roman () disorder com>
Date: Mon, 07 Jun 2010 13:45:49 -0400
The issue in question has been fixed in 0.8.7f release and will be also including in the 0.8.7g release.
The fix is not in the validation of the vertical label field in the UI or database, but when the text is used in execution of the rrdtool command line option for the vertical label.
Please keep all inquiries directed to me. Thanks, Tony Roman Cacti Developer On 6/7/10 11:07 AM, Larry Adams wrote:
On 6/7/2010 10:21 AM, Steven M. Christey wrote:On Tue, 1 Jun 2010, Jan Lieskovsky wrote:[C], SQL injection and shell escaping issues reported by Bonsai Information Security (http://www.bonsai-sec.com) [7] http://www.bonsai-sec.com/blog/index.php/using-grep-to-find-0days/ [8] http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php...2, OS command injection issue, CVE-2010-1645 / BONSAI-2010-0105References: [2] http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php Proper patches are the following three: (noticed by Tomas Hoger && confirmed by Tony Roman, thanks for it!)[3] http://svn.cacti.net/viewvc?view=rev&revision=5778 [4] http://svn.cacti.net/viewvc?view=rev&revision=5782 [5] http://svn.cacti.net/viewvc?view=rev&revision=5784The BONSAI-2010-0105 references two problems, one for ping.php and another one having to do with a "Vertical Label" in a "Graph Template."I don't see evidence of this vector in the revisions listed above. Does anybody else?(If the "Vertical Label" issue went unpatched, then a separate CVE should probably be assigned to it.)- SteveSteve,I just validated that the Vertical Label via the hostname field injection is not resolved from a UI perspective in host.php. I have not checked lib/rrd.php for proper escaping and will do that shortly.Generally, we're not as concerned when it comes to components of the UI that are not accessible for the guest account. However, I will close this loophole today and prior to Cacti 0.8.7g beta. Simply put, we should not permit any name there that is not either an IP address or something that is conforming (aka hostname or fqdn).I toyed with the idea of a gethostbyname validation. However, there are cases in Cacti where we have hosts that are represented more as Objects and not as physical hosts (aka no avail check), so it will have to be a hostname that is syntactically correct. I'll get you a commit # once it's in.Regards, Larry Adams Lead Cacti Developer
Current thread:
- CVE Request -- Cacti v0.8.7 -- three security fixes Jan Lieskovsky (May 24)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Josh Bressers (May 26)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Steven M. Christey (May 27)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Jan Lieskovsky (Jun 01)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Steven M. Christey (Jun 07)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Larry Adams (Jun 07)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Tony Roman (Jun 07)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Steven M. Christey (May 27)
- Re: CVE Request -- Cacti v0.8.7 -- three security fixes Josh Bressers (May 26)