Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Updated cacti packages fix multiple vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:052 | First vendor Publication | 2008-02-27 |
| Vendor | Mandriva | Last vendor Modification | 2008-02-27 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A number of vulnerabilities were found in the Cacti program, including XSS vulnerabilities, SQL injection vulnerabilities, CRLF injection vulnerabilities, and information disclosure vulnerabilities. This update provides Cacti 0.8.6k which corrects these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:052 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 25 % | CWE-200 | Information Exposure |
| 25 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| 25 % | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25) |
| 25 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20240 | |||
| Oval ID: | oval:org.mitre.oval:def:20240 | ||
| Title: | DSA-1569-1 cacti - multiple vulnerabilities | ||
| Description: | It was discovered that Cacti, a systems and services monitoring frontend, performed insufficient input sanitising, leading to cross site scripting and SQL injection being possible. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1569-1 CVE-2008-0783 CVE-2008-0785 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | cacti |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7735 | |||
| Oval ID: | oval:org.mitre.oval:def:7735 | ||
| Title: | DSA-1569 cacti -- insufficient input sanitising | ||
| Description: | It was discovered that Cacti, a systems and services monitoring frontend, performed insufficient input sanitising, leading to cross site scripting and SQL injection being possible. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1569 CVE-2008-0783 CVE-2008-0785 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | cacti |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-05-28 | Name : Cacti Multiple Input Validation Vulnerabilities File : nvt/cacti_27749.nasl |
| 2009-05-16 | Name : Cacti 'data_input.php' Cross Site Scripting Vulnerability File : nvt/cacti_34991.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200803-18 (cacti) File : nvt/glsa_200803_18.nasl |
| 2008-08-15 | Name : Debian Security Advisory DSA 1569-3 (cacti) File : nvt/deb_1569_3.nasl |
| 2008-05-27 | Name : Debian Security Advisory DSA 1569-2 (cacti) File : nvt/deb_1569_2.nasl |
| 2008-05-12 | Name : Debian Security Advisory DSA 1569-1 (cacti) File : nvt/deb_1569_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 41793 | Cacti graph.php local_graph_id Variable Path Disclosure |
| 41785 | Cacti index.php/sql.php Login Action login_username Parameter SQL Injection |
| 41784 | Cacti graph_xport.php local_graph_id Parameter SQL Injection |
| 41783 | Cacti tree.php Multiple Parameter SQL Injection |
| 41782 | Cacti index.php/login Multiple Parameter XSS |
| 41781 | Cacti graph_view.php filter Parameter XSS |
| 41741 | Cacti Unspecified CRLF |
| 41740 | Cacti graph.php view_type Parameter XSS |
| 41739 | Cacti graph_view.php graph_list Parameter SQL Injection Cacti contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'graph_view.php' script not properly sanitizing user-supplied input to the 'graph_list' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-05-09 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1569.nasl - Type : ACT_GATHER_INFO |
| 2008-03-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200803-18.nasl - Type : ACT_GATHER_INFO |
| 2008-02-18 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1699.nasl - Type : ACT_GATHER_INFO |
| 2008-02-18 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1737.nasl - Type : ACT_GATHER_INFO |
| 2008-02-13 | Name : The remote web server contains a PHP script that is susceptible to a SQL inje... File : cacti_login_username_sql_injection.nasl - Type : ACT_ATTACK |
