Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php.

This fix contains several official patches from cacti: Command Line Add Graphs Syntax SNMP Invalid Responses Template Import/Export Duplication Cross-Site Scripting Fixes http://www.cacti.net/download_patches.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in cacti, a frontend to rrdtool for monitoring systems and services. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3112, CVE-2007-3113     It was discovered that cacti is prone to a denial of     service via the graph_height, graph_width, graph_start     and graph_end parameters. This issue only affects the     oldstable (etch) version of cacti.

  - CVE-2009-4032     It was discovered that cacti is prone to several     cross-site scripting attacks via different vectors.

  - CVE-2009-4112     It has been discovered that cacti allows authenticated     administrator users to gain access to the host system by     executing arbitrary commands via the 'Data Input Method'     for the 'Linux - Get Memory Usage' setting.

  There is no fix for this issue at this stage. Upstream will   implement a whitelist policy to only allow certain 'safe' commands.
  For the moment, we recommend that such access is only given to   trusted users and that the options 'Data Input' and 'User   Administration' are otherwise deactivated.

The package cacti was updated to fix four cross-site-scripting vulnerabilities (CVE-2009-4032: CVSS v2 Base Score: 4.9) and one privilege escalation bug (CVE-2009-4112).

The cacti development team reports :

The Cross-Site Scripting patch has been posted.

This patch addresses cross-site scripting issues reported by Moritz Naumann.

ID	Name	Product	Family	Severity
44878	Fedora 12 : cacti-0.8.7e-3.fc12 (2009-12560)	Nessus	Fedora Local Security Checks	medium
44819	Debian DSA-1954-1 : cacti - insufficient input sanitising	Nessus	Debian Local Security Checks	high
43602	Fedora 11 : cacti-0.8.7e-3.fc11 (2009-12575)	Nessus	Fedora Local Security Checks	medium
43025	openSUSE Security Update : cacti (cacti-1627)	Nessus	SuSE Local Security Checks	high
42874	FreeBSD : cacti -- XSS issues (04104985-d846-11de-84e4-00215af774f0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-4032

medium

Tenable Plugins

medium

high

medium

high

medium