Bug 146021 - [security] net-mgmt/cacti sql injection & command execution
Summary: [security] net-mgmt/cacti sql injection & command execution
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Sergey Matveychuk
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-04-24 21:40 UTC by niels
Modified: 2010-04-27 15:47 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description niels freebsd_committer freebsd_triage 2010-04-24 21:40:01 UTC 
Two vulnerabilities found in Cacti affect our port. One of them has been patched by the developers. Please refer to the links below for more info:

http://www.cacti.net/downloads/patches/0.8.7e/sql_injection_template_export.patch
http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php
http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php

This PR is a reminder to update the port. A VuXML entry will be commited to mark the current version of the port vulnerable.

Fix: 

Please update the port using the upstream security patch
How-To-Repeat: N/A
Comment 1 dfilter service freebsd_committer freebsd_triage 2010-04-24 22:15:07 UTC 
niels       2010-04-24 21:14:58 UTC

  FreeBSD ports repository

  Modified files:
    security/vuxml       vuln.xml 
  Log:
  Documented vulnerabilities in moodle, tomcat55, tomcat66 and cacti
  
  PR:             ports/146021
  PR:             ports/146022
  Approved by:    remko (secteam)
  Security:       http://seclists.org/bugtraq/2010/Apr/200
  Security:       http://docs.moodle.org/en/Moodle_1.9.8_release_notes
  Security:       http://www.bonsai-sec.com/en/research/vulnerability.php
  
  Revision  Changes    Path
  1.2146    +95 -1     ports/security/vuxml/vuln.xml
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2010-04-24 23:58:09 UTC 
Responsible Changed
From-To: freebsd-ports-bugs->sem

Fix synopsis and assign.
Comment 3 Sergey Matveychuk freebsd_committer freebsd_triage 2010-04-27 15:47:24 UTC 
State Changed
From-To: open->closed

A patch from developers applied