Date: Wed, 7 Aug 2013 10:06:42 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b Cacti 0.8.8b was released today  with a changelog that notes: Cacti 0.8.8b Change Log [...] * security: SQL injection and shell escaping issues It looks like the SQL injection issue is in api_poller.php and utility.php  I think there are two shell escaping issue: 1) snmp.php: Use escapeshellarg() instead of custom escape function for snmp library  2) rrd.php: Properly escape all user input for consumption by rrdtool   http://sourceforge.net/mailarchive/message.php?msg_id=31258868  http://svn.cacti.net/viewvc?view=rev&revision=7394  http://svn.cacti.net/viewvc?view=rev&revision=7392  http://svn.cacti.net/viewvc?view=rev&revision=7393 Looks like 3 CVEs are needed. -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ