Bug 243592 (CVE-2007-3113)

Summary:	CVE-2007-3112, CVE-2007-3113: cacti DoS vulnerabilities
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	cacti	Assignee:	Mike McGrath <mmcgrath>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7	CC:	fedora-security-list, kevin
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	0.8.6j-8.fc7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-09-18 03:24:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-06-10 09:54:52 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3112
"Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to
cause a denial of service (CPU consumption) via a large value of the (1)
graph_start or (2) graph_end parameter."

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3113
"Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to
cause a denial of service (CPU consumption) via a large value of the (1)
graph_height or (2) graph_width parameter."

The patch linked to in the reports applies to 0.8.6j too.

Comment 1 Mike McGrath 2007-06-14 16:53:11 UTC

Sorry I'm not following, it seems that 0.8.6j has been fixed from these bugs, 
can you show me where you are finding otherwise?

Comment 2 Ville Skyttä 2007-06-14 17:10:49 UTC

Like I mentioned, that patch to which both of the CVE's link to, applies to
0.8.6j too.  I haven't checked beyond that.

$ make prep
[...]
$ cd cacti-0.8.6j
$ curl -s
"http://svn.cacti.net/cgi-bin/viewcvs.cgi/branches/BRANCH_0_8_6/cacti/graph_image.php?rev=3956&r1=3898&r2=3956&makepatch=1&diff_format=h"
| patch -p3
patching file graph_image.php
Hunk #1 succeeded at 51 (offset 2 lines).

Comment 3 Kevin Fenzi 2007-09-14 00:15:04 UTC

Any further word here? Is 0.8.6j vulnerable?

Comment 4 Mike McGrath 2007-09-14 21:08:24 UTC

Confirmed, it is.  I'll apply the patches and push soon.  it has been fixed in
0.8.7 already but that is not an official release yet.

Comment 5 Fedora Update System 2007-09-18 03:24:43 UTC

cacti-0.8.6j-8.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.