Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 7 Aug 2013 10:06:42 -0600
From: Vincent Danen <>
Subject: CVE request: SQL injection and shell escaping issues in Cacti <

Cacti 0.8.8b was released today [1] with a changelog that notes:

Cacti 0.8.8b Change Log
   * security: SQL injection and shell escaping issues

It looks like the SQL injection issue is in api_poller.php and
utility.php [2]

I think there are two shell escaping issue:

1) snmp.php: Use escapeshellarg() instead of custom escape function for snmp library [3]
2) rrd.php: Properly escape all user input for consumption by rrdtool [4]


Looks like 3 CVEs are needed.

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ