BID:14129

RaXnet Cacti Graph_Image.PHP Remote Command Execution Variant Vulnerability

Info

RaXnet Cacti Graph_Image.PHP Remote Command Execution Variant Vulnerability

Bugtraq ID:	14129
Class:	Input Validation Error
CVE:	CVE-2005-1524
Remote:	Yes
Local:	No
Published:	Jul 01 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Stefan Esser of the Hardened PHP Project is credited with the discovery of this vulnerability.
Vulnerable:	S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 Raxnet Cacti 0.8.6 e Raxnet Cacti 0.8.6 d Raxnet Cacti 0.8.6 c Raxnet Cacti 0.8.6 b Raxnet Cacti 0.8.6 a Raxnet Cacti 0.8.6 Raxnet Cacti 0.8.5 a Raxnet Cacti 0.8.5 Raxnet Cacti 0.8.4 Raxnet Cacti 0.8.3 a Raxnet Cacti 0.8.3 Raxnet Cacti 0.8.2 a Raxnet Cacti 0.8.2 Raxnet Cacti 0.8.1 Raxnet Cacti 0.8 Raxnet Cacti 0.6.8 a Raxnet Cacti 0.6.8 Raxnet Cacti 0.6.7 + Debian Linux 3.0 Raxnet Cacti 0.6.6 Raxnet Cacti 0.6.5 Raxnet Cacti 0.6.4 Raxnet Cacti 0.6.3 Raxnet Cacti 0.6.2 Raxnet Cacti 0.6.1 Raxnet Cacti 0.6 Raxnet Cacti 0.5 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0

Not Vulnerable:	Raxnet Cacti 0.8.6 f

Discussion

RaXnet Cacti Graph_Image.PHP Remote Command Execution Variant Vulnerability

RaXnet Cacti is prone to a remote command execution vulnerability that manifests in the 'graph_image.php' script. The issue is due to a bug in the input filters that leads to a failure in the application to properly sanitize user-supplied input.

This issue can facilitate various attacks including unauthorized access to an affected computer.

Exploit / POC

RaXnet Cacti Graph_Image.PHP Remote Command Execution Variant Vulnerability

An exploit is not required.

/data/vulnerabilities/exploits/cacti_cmd.pl

Solution / Fix

RaXnet Cacti Graph_Image.PHP Remote Command Execution Variant Vulnerability

Solution:
The vendor has addressed this issue in Cacti version 0.8.6f:

Conectiva Linux advisory CLSA-2005:978 is available to address various issues affecting cacti. Please see the referenced advisory for more information.

SUSE has released advisory SUSE-SR:2005:017 to address various issues. Please see the referenced advisory for more information.

Debian GNU/Linux has released advisory DSA 764-1 to address various issues in Cacti. Please see the referenced advisory for further information.

Raxnet Cacti 0.5