FreeBSD : cacti -- multiple vulnerabilities (1cf00643-ed8a-11d9-8310-0001020eed82)

High Nessus Plugin ID 18859


The remote FreeBSD host is missing a security-related update.


Stefan Esser reports :

Wrongly implemented user input filters lead to multiple SQL Injection vulnerabilities which can lead f.e. to disclosure of the admin password hash.

Wrongly implemented user input filters allows injection of user input into executed commandline.

Alberto Trivero posted his Remote Command Execution Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th June. Having analysed his bug we come to the conclusion, that the malfunctioning input filters, which were already mentioned in the previous advisory are also responsible for this bug still being exploitable.

A HTTP headers bypass switch can also be used to completely bypass the authentification system of Cacti. As admin it is possible to execute shell commands with the permission of the webserver.

While looking at the source of Cacti a HTTP headers bypass switch was discovered, that also switches off a call to session_start() and the manual application of addslashes() in case of magic_quotes_gpc=Off.

When register_globals is turned on* an attacker can use this switch to disables Cacti's use of PHP's session support and therefore supply the session variables on his own through f.e. the URL. Additionally using the switch renders several SQL statements vulnerable to SQL Injections attacks, when magic_quotes_gpc is turned off, which is the recommended setting.

Logged in as an admin it is possible to issue shell commands.

(*) register_globals is turned off by default since PHP 4.2 but is activated on most servers because of older scripts requiring it.


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 18859

File Name: freebsd_pkg_1cf00643ed8a11d983100001020eed82.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2005/07/13

Modified: 2013/06/21

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:cacti, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2005/07/05

Vulnerability Publication Date: 2005/06/22