1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200712-02 / cacti |
| Release Date | December 05, 2007 |
| Latest Revision | December 05, 2007: 02 |
| Impact | normal |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| net-analyzer/cacti | < 0.8.7a | revision >= 0.8.6j-r7, >= 0.8.7a | All supported architectures |
Related bugreports: #199509
An SQL injection vulnerability has been discovered in Cacti.
Cacti is a complete web-based frontend to rrdtool.
It has been reported that the "local_graph_id" variable used in the file graph.php is not properly sanitized before being processed in an SQL statement.
A remote attacker could send a specially crafted request to the vulnerable host, possibly resulting in the execution of arbitrary SQL code.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6j-r7" |