Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 585401 - (BONSAI-2010-0104, CVE-2010-1431) CVE-2010-1431 cacti: SQL injection vulnerability (BONSAI-2010-0104)
CVE-2010-1431 cacti: SQL injection vulnerability (BONSAI-2010-0104)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20100421,repor...
: Security
Depends On: 541684 585207 585402
Blocks:
  Show dependency tree / graph
 
Reported: 2010-04-23 17:26 EDT by Vincent Danen
Modified: 2018-08-15 17:46 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-12-21 17:45:24 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0635 normal SHIPPED_LIVE Important: Red Hat High Performance Computing (HPC) Solution 5.5 2010-08-19 22:42:21 EDT

  None (edit)
Description Vincent Danen 2010-04-23 17:26:14 EDT 
An SQL injection vulnerability was reported in cacti [1].  Input passed via the 'export_item_id' parameter to the templates_export.php script is not properly sanitized prior to being used in an SQL query.  Upstream has provided a patch to correct this issue [2].

[1] http://seclists.org/fulldisclosure/2010/Apr/272
[2] http://www.cacti.net/downloads/patches/0.8.7e/sql_injection_template_export.patch
Comment 1 Vincent Danen 2010-04-23 17:27:50 EDT 
Created cacti tracking bugs for this issue

Affects: fedora-all [bug 585402]
Comment 2 Vincent Danen 2010-04-26 15:27:21 EDT 
bug 585207 has addressed this in Fedora and EPEL.
Comment 3 Vincent Danen 2010-04-26 15:52:47 EDT 
This has been assigned CVE-2010-1431.
Comment 4 Tomas Hoger 2010-06-29 05:05:37 EDT 
Direct link to BONSAI-2010-0104 advisory:

http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php
Comment 5 errata-xmlrpc 2010-08-19 22:42:32 EDT 
This issue has been addressed in following products:

  Red Hat HPC Solution for RHEL 5

Via RHSA-2010:0635 https://rhn.redhat.com/errata/RHSA-2010-0635.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.