RaXnet Cacti Config.PHP Design Error Vulnerability
BID:14130
Info
RaXnet Cacti Config.PHP Design Error Vulnerability
| Bugtraq ID: | 14130 |
| Class: | Design Error |
| CVE: |
CVE-2005-2149 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 01 2005 12:00AM |
| Updated: | Sep 07 2006 08:38PM |
| Credit: | Stefan Esser of the Hardened PHP Project is credited with the discovery of this vulnerability. |
| Vulnerable: |
Raxnet Cacti 0.8.6 e Raxnet Cacti 0.8.6 d Raxnet Cacti 0.8.6 c Raxnet Cacti 0.8.6 b Raxnet Cacti 0.8.6 a Raxnet Cacti 0.8.6 Raxnet Cacti 0.8.5 a Raxnet Cacti 0.8.5 Raxnet Cacti 0.8.4 Raxnet Cacti 0.8.3 a Raxnet Cacti 0.8.3 Raxnet Cacti 0.8.2 a Raxnet Cacti 0.8.2 Raxnet Cacti 0.8.1 Raxnet Cacti 0.8 Raxnet Cacti 0.6.8 a Raxnet Cacti 0.6.8 Raxnet Cacti 0.6.7 Raxnet Cacti 0.6.6 Raxnet Cacti 0.6.5 Raxnet Cacti 0.6.4 Raxnet Cacti 0.6.3 Raxnet Cacti 0.6.2 Raxnet Cacti 0.6.1 Raxnet Cacti 0.6 Raxnet Cacti 0.5 |
| Not Vulnerable: |
Raxnet Cacti 0.8.6 f |
Discussion
RaXnet Cacti Config.PHP Design Error Vulnerability
A design error affecting RaXnet Cacti can allow an attacker to prevent the 'session_start()' and 'addslashes()' functions from being called.
The affected 'session_start()' and 'addslashes()' calls are nested inside an 'if' control statement that depends on an attacker-controlled value. Reports indicate that this value may be controlled through a URI parameter when 'register_globals' is set.
A remote attacker may exploit these issues to gain administrative access to the affected software.
A design error affecting RaXnet Cacti can allow an attacker to prevent the 'session_start()' and 'addslashes()' functions from being called.
The affected 'session_start()' and 'addslashes()' calls are nested inside an 'if' control statement that depends on an attacker-controlled value. Reports indicate that this value may be controlled through a URI parameter when 'register_globals' is set.
A remote attacker may exploit these issues to gain administrative access to the affected software.
Exploit / POC
RaXnet Cacti Config.PHP Design Error Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
RaXnet Cacti Config.PHP Design Error Vulnerability
Solution:
The vendor has addressed this issue in Cacti version 0.8.6f.
Please see the referenced advisories for more information.
Raxnet Cacti 0.5
Raxnet Cacti 0.6
Raxnet Cacti 0.6.1
Raxnet Cacti 0.6.2
Raxnet Cacti 0.6.3
Raxnet Cacti 0.6.4
Raxnet Cacti 0.6.5
Raxnet Cacti 0.6.6
Raxnet Cacti 0.6.7
Raxnet Cacti 0.6.8 a
Raxnet Cacti 0.6.8
Raxnet Cacti 0.8
Raxnet Cacti 0.8.1
Raxnet Cacti 0.8.2
Raxnet Cacti 0.8.2 a
Raxnet Cacti 0.8.3 a
Raxnet Cacti 0.8.3
Raxnet Cacti 0.8.4
Raxnet Cacti 0.8.5
Raxnet Cacti 0.8.5 a
Raxnet Cacti 0.8.6 a
Raxnet Cacti 0.8.6 b
Raxnet Cacti 0.8.6 e
Raxnet Cacti 0.8.6
Raxnet Cacti 0.8.6 d
Raxnet Cacti 0.8.6 c
Solution:
The vendor has addressed this issue in Cacti version 0.8.6f.
Please see the referenced advisories for more information.
Raxnet Cacti 0.5
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.1
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.2
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.3
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.4
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.5
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.6
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.7
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.8 a
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.6.8
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.1
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.2
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.2 a
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.3 a
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.3
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.4
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.5
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.5 a
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.6 a
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.6 b
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.6 e
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.6
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.6 d
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
Raxnet Cacti 0.8.6 c
-
Raxnet Cacti 0.8.6f
http://www.cacti.net/download_cacti.php
References
RaXnet Cacti Config.PHP Design Error Vulnerability
References:
References:
- Cacti Authentification/Addslashes Bypass Vulnerability (Hardened-PHP Project)
- Cacti Homepage (Cacti)
- Cacti Remote Command Execution Vulnerability (Hardened-PHP Project)
- Changelog 0.8.6f (Raxnet)