Cacti: Multiple vulnerabilities in included ADOdb
Gentoo Linux Security Advisory
||GLSA 200604-07 / Cacti
||April 14, 2006
||April 14, 2006: 01
All supported architectures
Multiple vulnerabilities have been discovered in the ADOdb layer included
in Cacti, potentially resulting in the execution of arbitrary code.
Cacti is a complete web-based frontend to rrdtool. ADOdb is a
PHP-based database abstraction layer which is included in Cacti.
Several vulnerabilities have been identified in the copy of ADOdb
included in Cacti. Andreas Sandblad discovered a dynamic code
evaluation vulnerability (CVE-2006-0147) and a potential SQL injection
vulnerability (CVE-2006-0146). Andy Staudacher reported another SQL
injection vulnerability (CVE-2006-0410), and Gulftech Security
discovered multiple cross-site-scripting issues (CVE-2006-0806).
Remote attackers could trigger these vulnerabilities by sending
malicious queries to the Cacti web application, resulting in arbitrary
code execution, database compromise through arbitrary SQL execution,
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6h_p20060108-r2"