Описание
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| cacti | fixed | 0.8.8b+dfsg-4 | package | |
| cacti | fixed | 0.8.7g-1+squeeze4 | squeeze | package |
Примечания
http://bugs.cacti.net/view.php?id=2405 (not yet public)
http://svn.cacti.net/viewvc?view=rev&revision=7439
CVE for all changes to lib/rrd.php to add cacti_escapeshellarg calls
Связанные уязвимости
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
ALT-PU-2014-1594: package `cacti` update to version 0.8.8b-alt2