Multiple vulnerabilities were discovered in Cacti.
|Package||net-analyzer/cacti on all architectures|
|Affected versions||< 0.8.7b|
|Unaffected versions||>= 0.8.7b, revision >= 0.8.6j-r8|
Cacti is a web-based network graphing and reporting tool.
The following inputs are not properly sanitized before being processed:
Furthermore, CRLF injection attack are possible via unspecified vectors (CVE-2008-0786).
A remote attacker could exploit these vulnerabilities, leading to path disclosure, Cross-Site Scripting attacks, SQL injection, and HTTP response splitting.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.7b"
March 10, 2008
May 28, 2009: 02