CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b

[Vincent Danen <vdanen () redhat com>]

Cacti 0.8.8b was released today [1] with a changelog that notes:

Cacti 0.8.8b Change Log
[...]
  * security: SQL injection and shell escaping issues

It looks like the SQL injection issue is in api_poller.php and
utility.php [2]

I think there are two shell escaping issue:

1) snmp.php: Use escapeshellarg() instead of custom escape function for snmp library [3]
2) rrd.php: Properly escape all user input for consumption by rrdtool [4]


[1] http://sourceforge.net/mailarchive/message.php?msg_id=31258868
[2] http://svn.cacti.net/viewvc?view=rev&revision=7394
[3] http://svn.cacti.net/viewvc?view=rev&revision=7392
[4] http://svn.cacti.net/viewvc?view=rev&revision=7393


Looks like 3 CVEs are needed.

--
Vincent Danen / Red Hat Security Response Team