Date: Wed, 7 Aug 2013 10:06:42 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b Cacti 0.8.8b was released today  with a changelog that notes: Cacti 0.8.8b Change Log [...] * security: SQL injection and shell escaping issues It looks like the SQL injection issue is in api_poller.php and utility.php  I think there are two shell escaping issue: 1) snmp.php: Use escapeshellarg() instead of custom escape function for snmp library  2) rrd.php: Properly escape all user input for consumption by rrdtool   http://sourceforge.net/mailarchive/message.php?msg_id=31258868  http://svn.cacti.net/viewvc?view=rev&revision=7394  http://svn.cacti.net/viewvc?view=rev&revision=7392  http://svn.cacti.net/viewvc?view=rev&revision=7393 Looks like 3 CVEs are needed. -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.