Bug 394595 – <net-analyzer/cacti-0.8.7i : Multiple Vulnerabilities (CVE-2011-5223)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2011-12-13 19:36:18 UTC]

From secunia security advisory at $URL:

Description:
1) Input passed to the "default_height" and "default_width" parameters in graph_settings.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "num_columns" parameter in graph_settings.php is not properly sanitised before being used. This can be exploited to insert HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

3) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. log out a user when a logged-in user visits a specially crafted web page.

The vulnerabilities are reported in versions prior to 0.8.7i.


Solution:
Update to version 0.8.7i.


@pva, this version is already in tree, ok to stabilize?

[Comment 1 Peter Volkov (RETIRED) 2011-12-14 05:07:02 UTC]

Yup, go ahead:
=net-analyzer/cacti-0.8.7i
Target KEYWORDS="alpha amd64 hppa ppc ppc64 sparc x86"

[Comment 2 Agostino Sarubbo 2011-12-14 17:24:54 UTC]

(In reply to comment #1)
> Yup, go ahead:
> =net-analyzer/cacti-0.8.7i
> Target KEYWORDS="alpha amd64 hppa ppc ppc64 sparc x86"

we needs also net-analyzer/cacti-spine-0.8.7i ?

[Comment 3 Agostino Sarubbo 2011-12-15 20:10:42 UTC]

amd64 stable

[Comment 4 Jeroen Roovers (RETIRED) 2011-12-16 15:00:21 UTC]

Stable for HPPA.

[Comment 5 Peter Volkov (RETIRED) 2011-12-17 01:42:12 UTC]

(In reply to comment #2)
> (In reply to comment #1)
> > Yup, go ahead:
> > =net-analyzer/cacti-0.8.7i
> > Target KEYWORDS="alpha amd64 hppa ppc ppc64 sparc x86"
> 
> we needs also net-analyzer/cacti-spine-0.8.7i ?

Not necessarily. Actually I'd like to give it some time in ~arch.

[Comment 6 Mark Loeser (RETIRED) 2011-12-23 00:03:59 UTC]

moved back to ~ppc/~ppc64, all done

[Comment 7 Raúl Porcel (RETIRED) 2012-01-01 15:07:47 UTC]

alpha/sparc/x86 stable

[Comment 8 Agostino Sarubbo 2012-01-01 16:15:55 UTC]

Thanks everyone. @Security, please vote.

[Comment 9 Tim Sammut (RETIRED) 2012-01-01 17:43:59 UTC]

Thanks, folks. GLSA Vote: no.

[Comment 10 Stefan Behte (RETIRED) 2012-03-06 01:21:02 UTC]

Vote: No, closing noglsa.

[Comment 11 GLSAMaker/CVETool Bot 2012-10-29 17:41:22 UTC]

CVE-2011-5223 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5223):
  Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti
  before 0.8.7i allows remote attackers to hijack the authentication of
  unspecified victims via unknown vectors.