Info

Disclosure

Jun 22, 2005

Discovery

May 12, 2005

Dates

Exploit

Jun 22, 2005

Solution

Jun 22, 2005

Description

Cacti contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to 'config_settings.php' script not properly sanitizing user input supplied to the 'config[include_path]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Web Related

Solution

Upgrade to version 0.8.6e or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The Cacti Group

Cacti

0.8.6c

References

Security Tracker: 1014252
Bugtraq ID: 14028
Secunia Advisory ID: 15490 15931 16136
Related OSVDB ID: 17424 17426
CVE ID: 2005-1526 (see also: NVD)
ISS X-Force ID: 21119
Keyword: GLSA-200506-20
Other Advisory URL: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000978
http://www.debian.org/security/2005/dsa-764
http://www.idefense.com/application/poi/display?id=266&type=vulnerabilities
Vendor Specific Advisory URL: http://security.gentoo.org/glsa/glsa-200506-20.xml
Vendor Specific News/Changelog Entry: http://www.cacti.net/release_notes_0_8_6e.php

Credit

Maciej Piotr Falkiewicz - iDEFENSE

Direct URL: http://osvdb.org/17425