From cf8fc631a93c63f968bf096289f3ebe27472ba89 Mon Sep 17 00:00:00 2001 From: simon Date: Tue, 5 Jul 2005 20:33:11 +0000 Subject: Document cacti -- multiple vulnerabilities. Prodded by: Babak Farrokhi --- security/vuxml/vuln.xml | 63 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 4018cd758673..e3cbd5da69f0 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,69 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> + + cacti -- multiple vulnerabilities + + + cacti + 0.8.6f + + + + +

Stefan Esser reports:

+
Wrongly implemented user input filters lead to multiple + SQL Injection vulnerabilities which can lead f.e. to + disclosure of the admin password hash.
+

+
Wrongly implemented user input filters allows injection + of user input into executed commandline.
+
Alberto Trivero posted his Remote Command Execution + Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th + June. Having analysed his bug we come to the conclusion, + that the malfunctioning input filters, which were already + mentioned in the previous advisory are also responsible + for this bug still being exploitable.
+

+
A HTTP headers bypass switch can also be used to + completely bypass the authentification system of Cacti. As + admin it is possible to execute shell commands with the + permission of the webserver.
+
While looking at the source of Cacti a HTTP headers + bypass switch was discovered, that also switches off a + call to session_start() and the manual + application of addslashes() in case of + magic_quotes_gpc=Off.
+
When register_globals is turned on* an attacker can use + this switch to disables Cacti's use of PHP's session + support and therefore supply the session variables on his + own through f.e. the URL. Additionally using the switch + renders several SQL statements vulnerable to SQL + Injections attacks, when magic_quotes_gpc is turned off, + which is the recommended setting.
+
Logged in as an admin it is possible to issue shell + commands.
+
(*) register_globals is turned off by default since PHP + 4.2 but is activated on most servers because of older + scripts requiring it.
+

+ + + + http://marc.theaimsgroup.com/?l=bugtraq&m=111954136315248 + http://www.hardened-php.net/advisory-032005.php + http://www.hardened-php.net/advisory-042005.php + http://www.hardened-php.net/advisory-052005.php + + + 2005-06-22 + 2005-07-05 + + + wordpress -- multiple vulnerabilities -- cgit