Stay Secure with the Latest Linux Advisories

security advisoryhigh severitycode execution

Gentoo 201401-20 High: Cacti Code Execution And XSS Risk Advisory

Multiple vulnerabilities have been found in Cacti, allowing attackers to execute arbitrary code or perform XSS attacks.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201401-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Cacti: Multiple vulnerabilities Date: January 21, 2014 Bugs: #324031, #480196 ID: 201401-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Cacti, allowing attackersto execute arbitrary code or perform XSS attacks. Background ========= Cacti is a complete network graphing solution designed to harness the power of RRDTool's data storage and graphing functionality. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-analyzer/cacti < 0.8.8b > = 0.8.8b Description ========== Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could execute arbitrary SQL commands via specially crafted parameters, execute arbitrary shell code or inject malicious script code. Workaround ========= There is no known workaround at this time. Resolution ========= All Cacti users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-analyzer/cacti-0.8.8b" References ========= [ 1 ] CVE-2010-1644 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1644 [ 2 ] CVE-2010-1645 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1645 [ 3 ]CVE-2010-2092 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2092 [ 4 ] CVE-2010-2543 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2543 [ 5 ] CVE-2010-2544 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2544 [ 6 ] CVE-2010-2545 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2545 [ 7 ] CVE-2013-1434 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1434 [ 8 ] CVE-2013-1435 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1435 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201401-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Cacti on the Gentoo platform has been discovered to contain critical vulnerabilities, permitting remote code execution and potential XSS attacks; immediate patching is advised.. Cacti Vulnerabilities, Gentoo Security Advisory, Code Execution Risk, XSS Threat. . LinuxSecurity.com Team

Jan 21, 2014 Gentoo