Date: Wed, 26 May 2010 14:58:39 -0400 (EDT) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: Nahuel Grisolia <nahuel@...sai-sec.com>, Stefan Esser <stefan.esser@...tioneins.de>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- Cacti v0.8.7 -- three security fixes I'm going to butcher this up a bit to make it easier to follow (at least for me). ----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote: > > Cacti upstream has released: >  http://www.cacti.net/release_notes_0_8_7f.php > > latest v0.8.7 version, adressing three security flaws: > [A], MOPS-2010-023: Cacti Graph Viewer SQL Injection Vulnerability > http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html > http://www.vupen.com/english/advisories/2010/1204 > > Credit: The vulnerability was discovered by Stefan Esser as part of > the SQL Injection Marathon. > > Upstream changeset: > http://svn.cacti.net/viewvc?view=rev&revision=5920 Steve, you've been handling the MOPS stuff. I'm going to leave this one alone unless you tell me otherwise (I don't want to dupe). > [B], Cross-site scripting issues reported by VUPEN Security > http://www.vupen.com/english/advisories/2010/1203 > > Credit: Vulnerabilities reported by Mohammed Boumediane (VUPEN > Security). > > Upstream changeset: > http://svn.cacti.net/viewvc?view=rev&revision=5901 > Use CVE-2010-1644 for this one. > [C], SQL injection and shell escaping issues reported by Bonsai > Information Security (http://www.bonsai-sec.com) > http://www.bonsai-sec.com/blog/index.php/using-grep-to-find-0days/ > http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php > > Credit: This vulnerability was discovered by Nahuel Grisolia ( > nahuel -at- bonsai-sec.com ) > > Upstream changeset: > http://svn.cacti.net/viewvc?view=rev&revision=5747 > Use CVE-2010-1645 for this one. > References: >  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=582691 >  https://bugzilla.redhat.com/show_bug.cgi?id=595289 > Thanks. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.