Ubuntu
cacti package

[SECURITY] cacti - CVE-2008-0785 and CVE-2008-0786

Bug #193744 reported by Emanuele Gentili
264
Affects Status Importance Assigned to Milestone
cacti (Debian)
Fix Released
Undecided
Unassigned
cacti (Ubuntu)
Fix Released
High
Unassigned
Dapper
Won't Fix
Undecided
Unassigned
Edgy
Won't Fix
Undecided
Unassigned
Feisty
Won't Fix
Undecided
Unassigned
Gutsy
Won't Fix
Undecided
Unassigned
Hardy
Fix Released
High
Unassigned

Bug Description

Binary package hint: cacti

CVE 2008-0785

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login.

CVE 2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVE References

Emanuele Gentili (emgent)
Changed in cacti:
assignee: nobody → emgent
importance: Undecided → High
status: New → Confirmed
Revision history for this message
StefanPotyra (sistpoty) wrote :

Emanuele, will this one be fixed with the new upstream version 0.8.7b-1 (cf. bug #194190)?

Revision history for this message
Emanuele Gentili (emgent) wrote :

no, in this bug debian was fix other bug (apllyed in Ubuntu first) with another _non_ security bugs that there isnt applyed in Ubuntu.

Revision history for this message
disabled.user (disabled.user-deactivatedaccount) wrote :

See also:
MDVSA-2008:052 (http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:052)

Adding CVE-2008-0783 and CVE-2008-0784.

Revision history for this message
Emanuele Gentili (emgent) wrote :

fixed by Stephan Herman in 0.8.7a-2ubuntu1.

Changed in cacti:
status: Confirmed → Fix Released
Revision history for this message
William Grant (wgrant) wrote :

I don't believe this is fixed in Hardy yet, but should be when bug #194190 is processed.

Changed in cacti:
status: Fix Released → In Progress
Emanuele Gentili (emgent)
Changed in cacti:
assignee: emgent → nobody
importance: High → Undecided
status: In Progress → New
assignee: nobody → emgent
importance: Undecided → High
status: New → In Progress
William Grant (wgrant)
Changed in cacti:
status: New → Fix Released
Revision history for this message
Luca Falavigna (dktrkranz) wrote :

Version 0.8.7b-2ubuntu1 is in Hardy now.

Changed in cacti:
assignee: emgent → nobody
status: In Progress → Fix Released
Revision history for this message
Hew (hew) wrote :

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

Changed in cacti:
status: New → Won't Fix
Revision history for this message
LumpyCustard (orangelumpycustard) wrote :

Please close for Feisty as Won't Fix? This goes for all the other Feisty bugs.

Revision history for this message
Hew (hew) wrote :

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

Changed in cacti:
status: New → Won't Fix
Revision history for this message
Sergio Zanchetta (primes2h) wrote :

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

Changed in cacti (Ubuntu Gutsy):
status: New → Won't Fix
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

Changed in cacti (Ubuntu Dapper):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.