Multiple vulnerabilities have been discovered in Cacti, the worst of which can lead to privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 1.2.26 | >= 1.2.26 |
Cacti is a web-based network graphing and reporting tool.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.26"
A vulnerability in Cacti could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 1.2.16-r1 | >= 1.2.16-r1 |
Cacti is a complete frontend to rrdtool.
The side_id parameter in data_debug.php does not properly verify input allowing SQL injection.
A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.16-r1"
Multiple vulnerabilities have been found in Cacti, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 1.2.13 | >= 1.2.13 |
| net-analyzer/cacti-spine | * | < 1.2.13 | >= 1.2.13 |
Cacti is a complete frontend to rrdtool.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.13"
All Cacti Spine users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-spine-1.2.13"
Multiple vulnerabilities have been found in Cacti, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 1.2.11 | >= 1.2.11 |
Cacti is a complete frontend to rrdtool.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.11"
Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 1.2.9 | >= 1.2.9 |
Cacti is a complete frontend to rrdtool.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
Remote attackers could execute arbitrary code or bypass intended access restrictions.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.2.9"
Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 1.1.20:1.1.20 | >= 1.1.20:1.1.20 |
Cacti is a complete frontend to rrdtool.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
Remote attackers could execute arbitrary code or bypass intended access restrictions.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-1.1.20:1.1.20"
Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.8h | >= 0.8.8h |
Cacti is a complete frontend to rrdtool.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, or remote authenticated users could bypass intended access restrictions.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.8h"
Multiple vulnerabilities have been found in Cacti, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.8d | >= 0.8.8d |
Cacti is a complete frontend to rrdtool
Multiple vulnerabilities have been discovered in cacti. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.8d"
Multiple vulnerabilities have been found in Cacti, allowing attackers to execute arbitrary code or perform XSS attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.8b | >= 0.8.8b |
Cacti is a complete network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality.
Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary SQL commands via specially crafted parameters, execute arbitrary shell code or inject malicious script code.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.8b"
Multiple vulnerabilities were discovered in Cacti.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.7b | >= 0.8.7b, >= 0.8.6j-r8 (revision) |
Cacti is a web-based network graphing and reporting tool.
The following inputs are not properly sanitized before being processed:
Furthermore, CRLF injection attack are possible via unspecified vectors (CVE-2008-0786).
A remote attacker could exploit these vulnerabilities, leading to path disclosure, Cross-Site Scripting attacks, SQL injection, and HTTP response splitting.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.7b"
An SQL injection vulnerability has been discovered in Cacti.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.7a | >= 0.8.6j-r7 (revision), >= 0.8.7a |
Cacti is a complete web-based frontend to rrdtool.
It has been reported that the "local_graph_id" variable used in the file graph.php is not properly sanitized before being processed in an SQL statement.
A remote attacker could send a specially crafted request to the vulnerable host, possibly resulting in the execution of arbitrary SQL code.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6j-r7"
Cacti has three vulnerabilities that could allow shell command execution or SQL injection.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.6i-r1 | >= 0.8.6i-r1 |
Cacti is a web-based network graphing and reporting tool.
rgod discovered that the Cacti cmd.php and copy_cacti_user.php scripts do not properly control access to the command shell, and are remotely accessible by unauthenticated users. This allows SQL injection via cmd.php and copy_cacti_user.php URLs. Further, the results from the injected SQL query are not properly sanitized before being passed to a command shell. The vulnerabilities require that the "register_argc_argv" option is enabled, which is the Gentoo default. Also, a number of similar problems in other scripts were reported.
These vulnerabilties can result in the execution of arbitrary shell commands or information disclosure via crafted SQL queries.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6i-r1"
Multiple vulnerabilities have been discovered in the ADOdb layer included in Cacti, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.6h_p20060108-r2 | >= 0.8.6h_p20060108-r2 |
Cacti is a complete web-based frontend to rrdtool. ADOdb is a PHP-based database abstraction layer which is included in Cacti.
Several vulnerabilities have been identified in the copy of ADOdb included in Cacti. Andreas Sandblad discovered a dynamic code evaluation vulnerability (CVE-2006-0147) and a potential SQL injection vulnerability (CVE-2006-0146). Andy Staudacher reported another SQL injection vulnerability (CVE-2006-0410), and Gulftech Security discovered multiple cross-site-scripting issues (CVE-2006-0806).
Remote attackers could trigger these vulnerabilities by sending malicious queries to the Cacti web application, resulting in arbitrary code execution, database compromise through arbitrary SQL execution, and malicious HTML or JavaScript code injection.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6h_p20060108-r2"
Cacti is vulnerable to several SQL injection, authentication bypass and file inclusion vulnerabilities.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | < 0.8.6f | >= 0.8.6f |
Cacti is a complete web-based frontend to rrdtool.
Cacti fails to properly sanitize input which can lead to SQL injection, authentication bypass as well as PHP file inclusion.
An attacker could potentially exploit the file inclusion to execute arbitrary code with the permissions of the web server. An attacker could exploit these vulnerabilities to bypass authentication or inject SQL queries to gain information from the database. Only systems with register_globals set to "On" are affected by the file inclusion and authentication bypass vulnerabilities. Gentoo Linux ships with register_globals set to "Off" by default.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6f"
Note: Users with the vhosts USE flag set should manually use webapp-config to finalize the update.
With special configurations of Cacti it is possible to change passwords via a SQL injection attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/cacti | * | <= 0.8.5a | >= 0.8.5a-r1 |
Cacti is a complete web-based front end to rrdtool.
Cacti is vulnerable to a SQL injection attack where an attacker may inject SQL into the Username field.
An attacker could compromise the Cacti service and potentially execute programs with the permissions of the user running Cacti. Only systems with php_flag magic_quotes_gpc set to Off are vulnerable. By default, Gentoo Linux installs PHP with this option set to On.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of Cacti.
All users should upgrade to the latest available version of Cacti, as follows:
# emerge sync # emerge -pv ">=net-analyzer/cacti-0.8.5a-r1" # emerge ">=net-analyzer/cacti-0.8.5a-r1"