FreeBSD : cacti -- multiple vulnerabilities (1cf00643-ed8a-11d9-8310-0001020eed82)

This script is Copyright (C) 2005-2013 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

Stefan Esser reports :

Wrongly implemented user input filters lead to multiple SQL Injection
vulnerabilities which can lead f.e. to disclosure of the admin
password hash.

Wrongly implemented user input filters allows injection of user input
into executed commandline.

Alberto Trivero posted his Remote Command Execution Exploit for Cacti
<= 0.8.6d to Bugtraq on the 22th June. Having analysed his bug we come
to the conclusion, that the malfunctioning input filters, which were
already mentioned in the previous advisory are also responsible for
this bug still being exploitable.

A HTTP headers bypass switch can also be used to completely bypass the
authentification system of Cacti. As admin it is possible to execute
shell commands with the permission of the webserver.

While looking at the source of Cacti a HTTP headers bypass switch was
discovered, that also switches off a call to session_start() and the
manual application of addslashes() in case of magic_quotes_gpc=Off.

When register_globals is turned on* an attacker can use this switch to
disables Cacti's use of PHP's session support and therefore supply the
session variables on his own through f.e. the URL. Additionally using
the switch renders several SQL statements vulnerable to SQL Injections
attacks, when magic_quotes_gpc is turned off, which is the recommended
setting.

Logged in as an admin it is possible to issue shell commands.

(*) register_globals is turned off by default since PHP 4.2 but is
activated on most servers because of older scripts requiring it.

See also :

http://marc.info/?l=bugtraq&m=111954136315248
http://www.hardened-php.net/advisory-032005.php
http://www.hardened-php.net/advisory-042005.php
http://www.hardened-php.net/advisory-052005.php
http://www.nessus.org/u?a13d95de

Solution :

Update the affected package.

Risk factor :

High

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 18859 (freebsd_pkg_1cf00643ed8a11d983100001020eed82.nasl)

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now