Cacti 0.8.7b and 0.8.6k release - IMPORTANT SECURITY UPDATES

fmangeant

Important Security Fixes for Cacti

Multiple security vulnerabilities have been discovered in Cacti's web interface:

XSS vulnerabilities
Path disclosure vulnerabilities
SQL injection vulnerabilities
HTTP response splitting vulnerabilities

All the above issues have been addressed in a new release of Cacti:

0.8.7b - http://www.cacti.net/downloads/cacti-0.8.7b.tar.gz
0.8.6k - http://www.cacti.net/downloads/cacti-0.8.6k.tar.gz

Patches for the following versions are available at:

0.8.7a - http://www.cacti.net/download_patches.php?version=0.8.7a
0.8.6j - http://www.cacti.net/download_patches.php?version=0.8.6j

mcutting · Cacti Pro User Joined: 16 Oct 2006 Posts: 906

Will there be any pre-patched files for Windows users with 0.8.7a ?

Thanks

TheWitness · Posted: Tue Feb 12, 2008 7:12 am Post subject:

Please note that Jimmy will have to release a corresponding Plugin Architecture to go with this release.

Regards,

TheWitness

mcutting · Cacti Pro User Joined: 16 Oct 2006 Posts: 906

Thanks Larry - I was going to ask about that as well...

TheWitness · Posted: Tue Feb 12, 2008 7:16 am Post subject:

Jimmy is pretty busy, but should be able to nock this out. If not, one of us can package it.

Regards,

TheWitness

Howie · Posted: Tue Feb 12, 2008 2:55 pm Post subject:

To clarify - are the patches above to fix the specific security issues or to upgrade to 0.8.7b?

It might be easier for me to stick with 0.8.7a at the moment since my Cacti is pretty hacked about in places

rony · Posted: Tue Feb 12, 2008 3:08 pm Post subject:

Patches are just for security issues.

fmangeant · Posted: Tue Feb 12, 2008 3:11 pm Post subject:

TheWitness · Posted: Tue Feb 12, 2008 8:39 pm Post subject:

fmangeant · Posted: Wed Feb 13, 2008 2:58 am Post subject:

Plugin Architecture 2.0 for Cacti 0.8.7b is out : http://forums.cacti.net/viewtopic.php?t=25766

Howie · Posted: Wed Feb 13, 2008 3:26 am Post subject:

TheWitness · Posted: Wed Feb 13, 2008 6:45 am Post subject:

Well, please let me know if there is anything we missed. We can do 0.8.7b patches...

Larry

mcutting · Cacti Pro User Joined: 16 Oct 2006 Posts: 906

HELP !!!

I managed to get the PIA working on 0.8.7b, but now have

CMDPHP: Poller[0] ERROR: A DB Exec Failed!, Error:'1064', SQL:"REPLACE INTO settings (name, value) VALUES ('url_path', 'Cacti\')'

In the logs every 10 seconds - I have set the url_path variable in plugins.php as suggested, and everything seems to work, with the exception of this error.

Any ideas ?

fmangeant · Posted: Thu Feb 14, 2008 9:02 am Post subject:

Hi

please post in the plugin arch forum.

andrew2 · Posted: Thu Feb 14, 2008 9:15 am Post subject:

Am I safe to assume those of us using web-basic authentication exclusively are safe from the security issues? (Assuming of course that authenticated users are trustworthy

)

Andrew