Description of problem: Lack of input saintization can reportedly [1] [2] compose XSS, SQL injection or HTTP response splitting attack vector. [1] http://www.cacti.net/release_notes_0_8_7b.php [2] http://secunia.com/advisories/28872/
CVE name/names was/were requested
cacti-0.8.7b-1.fc8 has been submitted as an update for Fedora 8
*** Bug 432473 has been marked as a duplicate of this bug. ***
cacti-0.8.7b-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
cacti-0.8.7b-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
CVE ids: * XSS vulnerabilities CVE-2008-0783: Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via the (1) view_type parameter to graph.php, (2) filter parameter to graph_view.php, and (3) action and login_username parameters to index.php/login. * Path disclosure vulnerabilities CVE-2008-0784 graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and other unspecified vectors. Note: This is not an issue for Fedora packages, as installation path can be trivially figured out from RPMs. * SQL injection vulnerabilities CVE-2008-0785: Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login. * HTTP response splitting vulnerabilities CVE-2008-0786: CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Note: This may be a non-issue for Fedora too, as reportedly only works on unspecified older PHP versions. Additional references: http://marc.info/?l=bugtraq&m=120284658901282&w=4 http://www.securityfocus.com/bid/27749 http://securitytracker.com/alerts/2008/Feb/1019414.html
Updates pushed to Fedora as: https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1737 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1699