[CVE-2007-6035] cacti has a sql injection vulnerability

I believe that CVE-2007-311[23] also affect all releases. It might be good to fix those now too.

working on it, please don't push this to -security.

Updated debdiffs are coming.

CVE-2007-311[23] already fixed in our cacti package for gutsy...

\sh

no drupal5 in dapper

Thanks for the debdiffs! These look good, I've got them building now. They should publish shortly.

this might be a different issue, but running checks with Nessus reported this problem on one of my machines:

"The version of Cacti does not properly check
whether the 'copy_cacti_user.php' script is being run from a
commandline and fails to sanitize user-supplied input before using it
in database queries. Provided PHP's 'register_argc_argv' parameter is
enabled, which is the default, an attacker can leverage this issue to
launch SQL injection attack against the underlying database and, for
example, add arbitrary administrative users."

I ran the test script at

http://milw0rm.com/exploits/3045

"successfully" with Dapper (Cacti 0.8.6h-ubuntu1)

Oh dear, that's correct. Stephan apparently marked this Dapper task Invalid, when he thought it was another bug... Stephan, could you please provide a debdiff for Dapper when you have time?

No releases other than Dapper should remain affected.

Fck....

Sure...

I have attached a debdiff for Dapper based on Stephan's work. I ran the exploit script to verify, and while the exploit does not succeed, the query simply fails that it attempts. If anyone else has cacti setup and would like to test this patch I'd appreciate it.

Marking as In Progress per SecurityUpdateProcedures

Thanks for the debdiff Brian! It looks great and I have committed it to our security queue.

This was published a couple days ago. Thanks again for the patch Brian!