Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 May 2010 12:18:51 +0200
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>
CC: oss-security <>,
        Nahuel Grisolia <>,
        Stefan Esser <>
Subject: CVE Request -- Cacti v0.8.7 -- three security fixes

Hi Steve,

   Cacti upstream has released:

   latest v0.8.7 version, adressing three security flaws:
     [A], MOPS-2010-023: Cacti Graph Viewer SQL Injection Vulnerability

          Credit: The vulnerability was discovered by Stefan Esser as part of the SQL Injection Marathon.
          Upstream changeset:

     [B], Cross-site scripting issues reported by VUPEN Security (

          Credit: Vulnerabilities reported by Mohammed Boumediane (VUPEN Security).
          Upstream changeset:

     [C], SQL injection and shell escaping issues reported by Bonsai Information Security (

          Credit: This vulnerability was discovered by Nahuel Grisolia ( nahuel -at- )
          Upstream changeset:

If a logged Cacti user was tricked into visiting a specially-crafted Web page, it could lead to:
i,   unauthorized arbitrary database data dislosure (vulnerability [A], from [2]),
ii,  unauthorized arbitrary scripting code execution (vulnerability [B], from [5]),
iii, execution of unintended commands or accessing unauthorized data. (vulnerability [C], from [8]).


Could you allocate relevant CVE ids?

Thanks && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.