Red Hat Bugzilla – Bug 432758
cacti: multiple input saintization issues (CVE-2008-0783, CVE-2008-0784, CVE-2008-0785, CVE-2008-0786)
Last modified: 2008-02-19 04:03:04 EST
Description of problem:
Lack of input saintization can reportedly   compose XSS, SQL injection or
HTTP response splitting attack vector.
CVE name/names was/were requested
cacti-0.8.7b-1.fc8 has been submitted as an update for Fedora 8
*** Bug 432473 has been marked as a duplicate of this bug. ***
cacti-0.8.7b-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
cacti-0.8.7b-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
* XSS vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7
before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject
arbitrary web script or HTML via the (1) view_type parameter to
graph.php, (2) filter parameter to graph_view.php, and (3) action and
login_username parameters to index.php/login.
* Path disclosure vulnerabilities
graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows
remote attackers to obtain the full path via an invalid local_graph_id
parameter and other unspecified vectors.
Note: This is not an issue for Fedora packages, as installation path can be
trivially figured out from RPMs.
* SQL injection vulnerabilities
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b
and 0.8.6 before 0.8.6k allow remote authenticated users to execute
arbitrary SQL commands via the (1) graph_list parameter to
graph_view.php, (2) leaf_id and id parameters to tree.php, (3)
local_graph_id parameter to graph_xport.php, and (4) login_username
parameter to index.php/login.
* HTTP response splitting vulnerabilities
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6
before 0.8.6k, when running on older PHP interpreters, allows remote
attackers to inject arbitrary HTTP headers and conduct HTTP response
splitting attacks via unspecified vectors.
Note: This may be a non-issue for Fedora too, as reportedly only works on
unspecified older PHP versions.
Updates pushed to Fedora as: