Test ID:	1.3.6.1.4.1.25623.1.0.703494
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 3494-1 (cacti - security update)
Summary:	Two SQL injection vulnerabilities were discovered in cacti, a web;interface for graphing of monitoring systems. Specially crafted input;can be used by an attacker in parameters of the graphs_new.php script to;execute arbitrary SQL commands on the database.
Description:	Summary: Two SQL injection vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems. Specially crafted input can be used by an attacker in parameters of the graphs_new.php script to execute arbitrary SQL commands on the database. Affected Software/OS: cacti on Debian Linux Solution: For the oldstable distribution (wheezy), these problems have been fixed in version 0.8.8a+dfsg-5+deb7u8. For the stable distribution (jessie), these problems have been fixed in version 0.8.8b+dfsg-8+deb8u4. For the testing distribution (stretch), these problems have been fixed in version 0.8.8f+ds1-4. For the unstable distribution (sid), these problems have been fixed in version 0.8.8f+ds1-4. We recommend that you upgrade your cacti packages. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-8377 Debian Security Information: DSA-3494 (Google Search) http://www.debian.org/security/2016/dsa-3494 http://seclists.org/fulldisclosure/2015/Dec/57 https://security.gentoo.org/glsa/201607-05 http://www.securitytracker.com/id/1034498 Common Vulnerability Exposure (CVE) ID: CVE-2015-8604 http://seclists.org/fulldisclosure/2016/Jan/16 http://bugs.cacti.net/view.php?id=2652 http://packetstormsecurity.com/files/135191/Cacti-0.8.8f-graphs_new.php-SQL-Injection.html http://www.openwall.com/lists/oss-security/2016/01/04/8 http://www.openwall.com/lists/oss-security/2016/01/04/9 http://www.securitytracker.com/id/1034573
Copyright	Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.