AOH :: HP Unsorted C :: B1A-1092.HTM

Cacti Multiple Parameter Cross Site Scripting Vulnerabilities



Cacti Multiple Parameter Cross Site Scripting Vulnerabilities
Cacti Multiple Parameter Cross Site Scripting Vulnerabilities



Cacti Multiple Parameter Cross Site Scripting Vulnerabilities


I. BACKGROUND
---------------------

"Cacti is a complete network graphing solution designed to harness the power
of RRDTool's data storage and graphing functionality. Cacti provides a fast
poller, advanced graph templating, multiple data acquisition methods, and
user management features out of the box." from cacti.net


II. VULNERABILITIES
---------------------

VUPEN Web Vulnerability Research Team discovered three vulnerabilities in
PHP-Calendar.

These issues are caused by input validation errors when processing the
"hostname", "host_id" and "description" parameters, which could be exploited
by attackers to cause arbitrary scripting code to be executed by the user's
browser in the security context of an affected Web site.


III. AFFECTED PRODUCTS
---------------------------

Cacti version 0.8.7e and prior


IV. SOLUTION
----------------

Upgrade to Cacti version 0.8.7f


V. CREDIT
--------------

These vulnerabilities were discovered by Mohammed Boumediane (VUPEN 
Security)
with help of the VUPEN Web Application Security Scanning (WASS) technology.


VI. VUPEN Web Application Security Scanner (WASS)
----------------------------------------------------

VUPEN Web Application Security Scanner (WASS) is a SaaS security scanning
technology which enables corporations and organizations to identify, track
and remediate security vulnerabilities affecting their web sites and
web applications, prevent criminals from gaining unauthorized access to
sensitive data, and comply with security requirements such as PCI.

VUPEN WASS is based on a proprietary technology developed by VUPEN security
experts, and combines black-box (smart and automated) and grey-box
(signature-based) scanning to accurately identify web vulnerabilities such
as those in the OWASP Top 10 including SQL injection and cross-site 
scripting,
but also real-world vulnerabilities such as shell command injection and
file inclusion.

Read More: http://www.vupen.com/english/wass/ 


VII. REFERENCES
----------------------

http://www.vupen.com/english/advisories/2010/1203 
http://www.cacti.net/release_notes_0_8_7f.php 


VIII. DISCLOSURE TIMELINE
-----------------------------

2010-05-05 - Vendor notified
2010-05-05 - Vendor response
2010-05-09 - status update received
2010-05-21 - Coordinated public Disclosure




The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.