[gentoo-announce] [ GLSA 201509-03 ] Cacti: Multiple vulnerabilities - gentoo-announce

From:	Kristian Fiskerstrand <k_f@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201509-03 ] Cacti: Multiple vulnerabilities
Date:	Thu, 24 Sep 2015 16:55:42
Message-Id:	`56042927.9020503@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201509-03

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: Cacti: Multiple vulnerabilities

9

     Date: September 24, 2015

10

     Bugs: #506356, #515108, #554758

11

       ID: 201509-03

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in Cacti, the worst of which

19

could lead to arbitrary code execution.

20

21

Background

22

==========

23

24

Cacti is a complete frontend to rrdtool

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  net-analyzer/cacti           < 0.8.8d                  >= 0.8.8d

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in cacti. Please review

38

the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

A remote attacker could possibly execute arbitrary code with the

44

privileges of the process, or cause a Denial of Service condition.

45

46

Workaround

47

==========

48

49

There is no known workaround at this time.

50

51

Resolution

52

==========

53

54

All Cacti users should upgrade to the latest version:

55

56

  # emerge --sync

57

  # emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.8d"

58

59

References

60

==========

61

62

[ 1 ] CVE-2014-2326

63

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2326

64

[ 2 ] CVE-2014-2327

65

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2327

66

[ 3 ] CVE-2014-2328

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2328

68

[ 4 ] CVE-2014-2708

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2708

70

[ 5 ] CVE-2014-2709

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2709

72

[ 6 ] CVE-2014-4002

73

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4002

74

[ 7 ] CVE-2014-5025

75

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5025

76

[ 8 ] CVE-2014-5026

77

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5026

78

[ 9 ] CVE-2015-2967

79

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2967

80

81

Availability

82

============

83

84

This GLSA and any updates to it are available for viewing at

85

the Gentoo Security Website:

86

87

 https://security.gentoo.org/glsa/201509-03

88

89

Concerns?

90

=========

91

92

Security is a primary focus of Gentoo Linux and ensuring the

93

confidentiality and security of our users' machines is of utmost

94

importance to us. Any security concerns should be addressed to

95

security@g.o or alternatively, you may file a bug at

96

https://bugs.gentoo.org.

97

98

License

99

=======

100

101

Copyright 2015 Gentoo Foundation, Inc; referenced text

102

belongs to its owner(s).

103

104

The contents of this document are licensed under the

105

Creative Commons - Attribution / Share Alike license.

106

107

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201509-03
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: Cacti: Multiple vulnerabilities
9	Date: September 24, 2015
10	Bugs: #506356, #515108, #554758
11	ID: 201509-03
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in Cacti, the worst of which
19	could lead to arbitrary code execution.
20
21	Background
22	==========
23
24	Cacti is a complete frontend to rrdtool
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 net-analyzer/cacti < 0.8.8d >= 0.8.8d
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in cacti. Please review
38	the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	A remote attacker could possibly execute arbitrary code with the
44	privileges of the process, or cause a Denial of Service condition.
45
46	Workaround
47	==========
48
49	There is no known workaround at this time.
50
51	Resolution
52	==========
53
54	All Cacti users should upgrade to the latest version:
55
56	# emerge --sync
57	# emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.8d"
58
59	References
60	==========
61
62	[ 1 ] CVE-2014-2326
63	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2326
64	[ 2 ] CVE-2014-2327
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2327
66	[ 3 ] CVE-2014-2328
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2328
68	[ 4 ] CVE-2014-2708
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2708
70	[ 5 ] CVE-2014-2709
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2709
72	[ 6 ] CVE-2014-4002
73	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4002
74	[ 7 ] CVE-2014-5025
75	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5025
76	[ 8 ] CVE-2014-5026
77	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5026
78	[ 9 ] CVE-2015-2967
79	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2967
80
81	Availability
82	============
83
84	This GLSA and any updates to it are available for viewing at
85	the Gentoo Security Website:
86
87	https://security.gentoo.org/glsa/201509-03
88
89	Concerns?
90	=========
91
92	Security is a primary focus of Gentoo Linux and ensuring the
93	confidentiality and security of our users' machines is of utmost
94	importance to us. Any security concerns should be addressed to
95	security@g.o or alternatively, you may file a bug at
96	https://bugs.gentoo.org.
97
98	License
99	=======
100
101	Copyright 2015 Gentoo Foundation, Inc; referenced text
102	belongs to its owner(s).
103
104	The contents of this document are licensed under the
105	Creative Commons - Attribution / Share Alike license.
106
107	http://creativecommons.org/licenses/by-sa/2.5