|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Gentoo Local Security Checks >> [GLSA-200701-23] Cacti: Command execution and SQL injection Vulnerability Assessment Details
|
[GLSA-200701-23] Cacti: Command execution and SQL injection |
||
Cacti: Command execution and SQL injection Detailed Explanation for this Vulnerability Assessment The remote host is affected by the vulnerability described in GLSA-200701-23 (Cacti: Command execution and SQL injection) rgod discovered that the Cacti cmd.php and copy_cacti_user.php scripts do not properly control access to the command shell, and are remotely accessible by unauthenticated users. This permits SQL injection via cmd.php and copy_cacti_user.php URLs. Further, the results from the injected SQL query are not properly sanitized before being passed to a command shell. The vulnerabilities require that the "register_argc_argv" option is enabled, which is the Gentoo default. Also, a number of similar problems in other scripts were reported. Impact These vulnerabilties can result in the execution of arbitrary shell commands or information disclosure via crafted SQL queries. Workaround There is no known workaround at this time. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6799 Solution: All Cacti users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6i-r1" Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: (C) 2007 Michel Arboi |
||
Cables, Connectors |
LSI 9305-16i SATA SAS 12Gbs RAID Controller PCIe 3.0 x8 IT-Mode 4* 8643 SATA
$229.99
Dell R630 8SFF 2.4Ghz 12-Core 128GB H330 RAID 10GB RJ-45 NIC 2x750W PSU 8x Trays
$430.04
Dell R630 8SFF 2.4Ghz 20-Core 128GB H730 RAID 10GB RJ-45 NIC 2x750W PSU 8x Trays
$455.04
ACASIS 2.5/3.5 inch 2 Bay SATA USB 3.0 Hard Drive Disk HDD SSD Enclosure 4 RAID
$58.99
Inspur LSI 9300-8i Raid Card 12Gbps HBA HDD Controller High Profile IT MODE
$15.98
LSI MegaRAID 9361-8i 12Gb PCIe 8-Port SAS/SATA RAID 1Gb w/BBU/CacheVault/License
$39.95
LSI MegaRAID 9361-8i 12Gbps PCIe 3 x8 SATA SAS 3 8 Port RAID + BBU & CacheVault
$39.00
ORICO Multi Bay RAID Hard Drive Enclosure USB 3.0/ Type-C For 2.5/3.5'' HDD SSDs
$82.49
NEW LSI MEGARAID SAS 9361-8i 12GB/s SAS + SATA RAID CONTROLLER CARD PCIe x8 3.0
$99.00
Yottamaster 4Bay RAID RGB Hard Drive Enclosure Type B Fr 2.5'' 3.5" SATA HDD SSD
$149.99
|
||
No Discussions have been posted on this vulnerability. |