Cacti: Multiple vulnerabilities — GLSA 201401-20

Multiple vulnerabilities have been found in Cacti, allowing attackers to execute arbitrary code or perform XSS attacks.

Affected packages

Background

Cacti is a complete network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality.

Description

Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could execute arbitrary SQL commands via specially crafted parameters, execute arbitrary shell code or inject malicious script code.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.8b"
 

References

• CVE-2010-1644
• CVE-2010-1645
• CVE-2010-2092
• CVE-2010-2543
• CVE-2010-2544
• CVE-2010-2545
• CVE-2013-1434
• CVE-2013-1435

Release date
January 21, 2014

Latest revision
January 21, 2014: 1

Severity
high

Exploitable
remote

Bugzilla entries

• 324031
• 480196