Cacti (home)ForumsRepositoryDocumentation
Cacti: offical forums and support  

 FAQFAQ   SearchSearch   MemberlistMemberlist    RegisterRegister   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in    


Cacti 0.8.7b and 0.8.6k release - IMPORTANT SECURITY UPDATES
Goto page Previous  1, 2
 
Post new topic   Reply to topic    Cacti Forum Index -> Announcements
Author Message
rony
Developer/Forum Admin


Joined: 17 Nov 2003
Posts: 5448
Location: Wisconsin, USA

PostPosted: Thu Feb 14, 2008 9:27 am    Post subject: Reply with quote

andrew2 wrote:
Am I safe to assume those of us using web-basic authentication exclusively are safe from the security issues? (Assuming of course that authenticated users are trustworthy )

Andrew


That would be a correct assumption.
Back to top
super-hornet
Cacti User


Joined: 27 May 2007
Posts: 144

PostPosted: Tue Feb 19, 2008 10:44 pm    Post subject: Reply with quote

Hi all

I tried 2 times and this is what I get/found.

I use the 0.8.7b and then apply the Plugin Architecture 2.0 using the patch method. I get alot of files that rejects from patching. It is like incompatible or does not telly.

I then tried using the pre-patched filed included in the PA 2.0 and overwrite my 0.8.7b. Import the PA.SQL files and after that, try to access it, I get no graphics. It is like the patch to the webpages are wrong.
e.g,
my cacti is in http://123.123.123.123/cacti
But after the PA 2.0, the link inside the cacti become like /cacti/i/

SH
Back to top
Nemea



Joined: 15 Nov 2005
Posts: 13

PostPosted: Wed Feb 20, 2008 1:30 am    Post subject: Reply with quote

@super-hornet:
found this somewhere:

try adding a line to cacti/site/include/plugins.php

at the bottom of the file you will find:

define('URL_PATH', $config['url_path']);


change to:

$config['url_path'] = '/cacti/';
define('URL_PATH', $config['url_path']);


and replace '/cacti/' with your url.

Thsi fixed it for me.
Back to top
mduling



Joined: 01 Mar 2005
Posts: 16

PostPosted: Fri Feb 22, 2008 4:05 pm    Post subject: Reply with quote

This tip fixed the images problem. Thanks! But one last hurdle for me are the errors below. Anyone have a solution for that with PA 2.0 and Cacti 0.8.7b? And yes, this has been posted in the PA forum, but I see no answers so I'm asking here out of desperation. I did a fresh Cacti install and I imported the PA schema and edit global.php for MySQL info. Thanks.

----------
Warning: reset(): Passed variable is not an array or object in /opt/local/share/cacti/lib/functions.php on line 146

Warning: Variable passed to each() is not an array or object in /opt/local/share/cacti/lib/functions.php on line 147

Warning: reset(): Passed variable is not an array or object in /opt/local/share/cacti/lib/functions.php on line 146

Warning: Variable passed to each() is not an array or object in /opt/local/share/cacti/lib/functions.php on line 147

Warning: reset(): Passed variable is not an array or object in /opt/local/share/cacti/lib/functions.php on line 146

Warning: Variable passed to each() is not an array or object in /opt/local/share/cacti/lib/functions.php on line 147
Back to top
fmangeant
Cacti Guru User


Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France

PostPosted: Mon Feb 25, 2008 3:28 am    Post subject: Reply with quote

Hi

please post this in General or Unix forum.
Back to top
sradman



Joined: 30 Apr 2007
Posts: 7
Location: Vienna, Austria

PostPosted: Sun Mar 02, 2008 4:34 pm    Post subject: malformed official patch Reply with quote

Hi guys,

The patch "Invalid Upgrade Path from 0.8.6k Fix" posted on the official patches for 0.8.7b page is still broken (malformed patch).
Identation must have been lost on the way.

http://www.cacti.net/download_patches.php?version=0.8.7b
http://www.cacti.net/downloads/patches/0.8.7b/upgrade_from_086k_fix.patch

Please replace with a sane/tested version.

Thanks
Stefan
Back to top
suyashjain



Joined: 16 Nov 2006
Posts: 8
Location: Bangalore

PostPosted: Tue Mar 25, 2008 8:14 am    Post subject: Admin Password Hacking Reply with quote

Their is a big bug in cacti , in which it asks to change the "admin" password without login.

type the following url in browser and replace x.x.x.x with your cacti ip .
http://x.x.x.x/auth_changepassword.php?ref=index.php&action=changepassword&username=admin&password=aaaaaa&confirm=aaaaaa&submit=Save

It will change the admin password without any delay.

test it out immediately . I have tested it on latest cacti-0.8.7b version also.
Back to top
rony
Developer/Forum Admin


Joined: 17 Nov 2003
Posts: 5448
Location: Wisconsin, USA

PostPosted: Tue Mar 25, 2008 8:37 am    Post subject: Reply with quote

Please submit a bug report at http://www.cacti.net/bugs.php
Back to top
sradman



Joined: 30 Apr 2007
Posts: 7
Location: Vienna, Austria

PostPosted: Tue Mar 25, 2008 8:55 am    Post subject: Reply with quote

> It will change the admin password without any delay.

I'm running 0.8.7a and cannot confirm your report. The URL you posted will NOT change the admin password in my cacti installation.
Back to top
rony
Developer/Forum Admin


Joined: 17 Nov 2003
Posts: 5448
Location: Wisconsin, USA

PostPosted: Tue Mar 25, 2008 9:11 am    Post subject: Reply with quote

Unable to reproduce on either Cacti 0.8.7 or Cacti 0.8.6.

Make sure that you are NOT logged in when you attempt to change the password.
Back to top
Display posts from previous:   
Post new topic   Reply to topic    Cacti Forum Index -> Announcements All times are GMT - 5 Hours
Goto page Previous  1, 2
Page 2 of 2

 



Powered by phpBB © 2001, 2005 phpBB Group