Hi all, On 12-12-15 13:41, Paul Gevers wrote: > Please don't, upstream already has a patch in SVN¹, but didn't mark the > bug (I just did).
Please find attached the debdiff that I could come up with from my work on sid, jessie and wheezy. It isn't tested yet (I don't have a suitable setup for that) so I appreciate it if somebody could check the patch doesn't break graph.php. Paul
diff -u cacti-0.8.7g/debian/changelog cacti-0.8.7g/debian/changelog --- cacti-0.8.7g/debian/changelog +++ cacti-0.8.7g/debian/changelog @@ -1,3 +1,10 @@ +cacti (0.8.7g-1+squeeze10) squeeze-lts; urgency=high + + * Add upstream patch to fix (Closes: #807599) + - CVE-2015-8369 SQL Injection vulnerability in graph.php + + -- Paul Gevers <elb...@debian.org> Sun, 13 Dec 2015 20:48:52 +0100 + cacti (0.8.7g-1+squeeze9) squeeze-lts; urgency=high * Non-maintainer upload by the Squeeze LTS Team. diff -u cacti-0.8.7g/debian/patches/series cacti-0.8.7g/debian/patches/series --- cacti-0.8.7g/debian/patches/series +++ cacti-0.8.7g/debian/patches/series @@ -28,0 +29 @@ +CVE-2015-8369_sql_injection_in_graph.php.patch only in patch2: unchanged: --- cacti-0.8.7g.orig/debian/patches/CVE-2015-8369_sql_injection_in_graph.php.patch +++ cacti-0.8.7g/debian/patches/CVE-2015-8369_sql_injection_in_graph.php.patch @@ -0,0 +1,206 @@ +From 1d85f9ab30af9558eb1da3a3c73a2551e08ec1ee Mon Sep 17 00:00:00 2001 +From: cigamit <cigamit@860744bd-22fc-0310-8c96-e9fe5004b5ca> +Date: Sat, 28 Nov 2015 20:08:16 +0000 +Subject: [PATCH] -bug:0002646: SQL injection in graph.php + +git-svn-id: svn://svn.cacti.net/cacti/cacti@7767 860744bd-22fc-0310-8c96-e9fe5004b5ca +--- + tags/0.8.8g/graph.php | 78 ++++++++++++++++---------------- + tags/0.8.8g/include/top_graph_header.php | 4 +- + 3 files changed, 42 insertions(+), 41 deletions(-) + +Index: cacti/graph.php +=================================================================== +--- cacti.orig/graph.php ++++ cacti/graph.php +@@ -27,45 +27,45 @@ if (!isset($_REQUEST["action"])) { $_REQ + if (!isset($_REQUEST["view_type"])) { $_REQUEST["view_type"] = ""; } + + $guest_account = true; ++/* ================= input validation ================= */ ++input_validate_input_regex(get_request_var_request("rra_id"), "^([0-9]+|all)$"); ++input_validate_input_number(get_request_var_request("local_graph_id")); ++input_validate_input_number(get_request_var_request("graph_end")); ++input_validate_input_number(get_request_var_request("graph_start")); ++input_validate_input_regex(get_request_var_request("view_type"), "^([a-zA-Z0-9]+)$"); ++/* ==================================================== */ ++ + include("./include/auth.php"); + include_once("./lib/rrd.php"); + include_once("./lib/html_tree.php"); + include_once("./include/top_graph_header.php"); + +-/* ================= input validation ================= */ +-input_validate_input_regex(get_request_var("rra_id"), "^([0-9]+|all)$"); +-input_validate_input_number(get_request_var("local_graph_id")); +-input_validate_input_number(get_request_var("graph_end")); +-input_validate_input_number(get_request_var("graph_start")); +-input_validate_input_regex(get_request_var_request("view_type"), "^([a-zA-Z0-9]+)$"); +-/* ==================================================== */ +- +-if (!isset($_GET['rra_id'])) { +- $_GET['rra_id'] = 'all'; ++if (!isset($_REQUEST['rra_id'])) { ++ $_REQUEST['rra_id'] = 'all'; + } + +-if ($_GET["rra_id"] == "all") { ++if ($_REQUEST["rra_id"] == "all") { + $sql_where = " where id is not null"; + }else{ +- $sql_where = " where id=" . $_GET["rra_id"]; ++ $sql_where = " where id=" . $_REQUEST["rra_id"]; + } + + /* make sure the graph requested exists (sanity) */ +-if (!(db_fetch_cell("select local_graph_id from graph_templates_graph where local_graph_id=" . $_GET["local_graph_id"]))) { ++if (!(db_fetch_cell("select local_graph_id from graph_templates_graph where local_graph_id=" . $_REQUEST["local_graph_id"]))) { + print "<strong><font size='+1' color='FF0000'>GRAPH DOES NOT EXIST</font></strong>"; exit; + } + + /* take graph permissions into account here, if the user does not have permission + give an "access denied" message */ + if (read_config_option("auth_method") != 0) { +- $access_denied = !(is_graph_allowed($_GET["local_graph_id"])); ++ $access_denied = !(is_graph_allowed($_REQUEST["local_graph_id"])); + + if ($access_denied == true) { + print "<strong><font size='+1' color='FF0000'>ACCESS DENIED</font></strong>"; exit; + } + } + +-$graph_title = get_graph_title($_GET["local_graph_id"]); ++$graph_title = get_graph_title($_REQUEST["local_graph_id"]); + + if ($_REQUEST["view_type"] == "tree") { + print "<table width='100%' style='background-color: #ffffff; border: 1px solid #ffffff;' align='center' cellspacing='0' cellpadding='3'>"; +@@ -73,7 +73,7 @@ if ($_REQUEST["view_type"] == "tree") { + print "<table width='100%' style='background-color: #f5f5f5; border: 1px solid #bbbbbb;' align='center' cellspacing='0' cellpadding='3'>"; + } + +-$rras = get_associated_rras($_GET["local_graph_id"]); ++$rras = get_associated_rras($_REQUEST["local_graph_id"]); + + switch ($_REQUEST["action"]) { + case 'view': +@@ -94,12 +94,12 @@ case 'view': + <table width='1' cellpadding='0'> + <tr> + <td> +- <img class='graphimage' id='graph_<?php print $_GET["local_graph_id"] ?>' src='<?php print htmlspecialchars("graph_image.php?action=view&local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $rra["id"]);?>' border='0' alt='<?php print htmlspecialchars($graph_title);?>'> ++ <img class='graphimage' id='graph_<?php print $_REQUEST["local_graph_id"] ?>' src='<?php print htmlspecialchars("graph_image.php?action=view&local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $rra["id"]);?>' border='0' alt='<?php print htmlspecialchars($graph_title, ENT_QUOTES);?>'> + </td> + <td valign='top' style='padding: 3px;' class='noprint'> +- <a href='<?php print htmlspecialchars("graph.php?action=zoom&local_graph_id=" . $_GET["local_graph_id"]. "&rra_id=" . $rra["id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_zoom.gif' border='0' alt='Zoom Graph' title='Zoom Graph' style='padding: 3px;'></a><br> +- <a href='<?php print htmlspecialchars("graph_xport.php?local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $rra["id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_query.png' border='0' alt='CSV Export' title='CSV Export' style='padding: 3px;'></a><br> +- <a href='<?php print htmlspecialchars("graph.php?action=properties&local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $rra["id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_properties.gif' border='0' alt='Graph Source/Properties' title='Graph Source/Properties' style='padding: 3px;'></a> ++ <a href='<?php print htmlspecialchars("graph.php?action=zoom&local_graph_id=" . $_REQUEST["local_graph_id"]. "&rra_id=" . $rra["id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_zoom.gif' border='0' alt='Zoom Graph' title='Zoom Graph' style='padding: 3px;'></a><br> ++ <a href='<?php print htmlspecialchars("graph_xport.php?local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $rra["id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_query.png' border='0' alt='CSV Export' title='CSV Export' style='padding: 3px;'></a><br> ++ <a href='<?php print htmlspecialchars("graph.php?action=properties&local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $rra["id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_properties.gif' border='0' alt='Graph Source/Properties' title='Graph Source/Properties' style='padding: 3px;'></a> + </td> + </tr> + <tr> +@@ -129,7 +129,7 @@ case 'zoom': + } + + /* fetch information for the current RRA */ +- $rra = db_fetch_row("select id,timespan,steps,name from rra where id=" . $_GET["rra_id"]); ++ $rra = db_fetch_row("select id,timespan,steps,name from rra where id=" . $_REQUEST["rra_id"]); + + /* define the time span, which decides which rra to use */ + $timespan = -($rra["timespan"]); +@@ -140,24 +140,24 @@ case 'zoom': + FROM (data_template_data,data_template_rrd,graph_templates_item) + WHERE graph_templates_item.task_item_id=data_template_rrd.id + AND data_template_rrd.local_data_id=data_template_data.local_data_id +- AND graph_templates_item.local_graph_id=" . $_GET["local_graph_id"] . ++ AND graph_templates_item.local_graph_id=" . $_REQUEST["local_graph_id"] . + " LIMIT 0,1"); + $ds_step = empty($ds_step) ? 300 : $ds_step; + $seconds_between_graph_updates = ($ds_step * $rra["steps"]); + + $now = time(); + +- if (isset($_GET["graph_end"]) && ($_GET["graph_end"] <= $now - $seconds_between_graph_updates)) { +- $graph_end = $_GET["graph_end"]; ++ if (isset($_REQUEST["graph_end"]) && ($_REQUEST["graph_end"] <= $now - $seconds_between_graph_updates)) { ++ $graph_end = $_REQUEST["graph_end"]; + }else{ + $graph_end = $now - $seconds_between_graph_updates; + } + +- if (isset($_GET["graph_start"])) { +- if (($graph_end - $_GET["graph_start"])>$max_timespan) { ++ if (isset($_REQUEST["graph_start"])) { ++ if (($graph_end - $_REQUEST["graph_start"])>$max_timespan) { + $graph_start = $now - $max_timespan; + }else { +- $graph_start = $_GET["graph_start"]; ++ $graph_start = $_REQUEST["graph_start"]; + } + }else{ + $graph_start = $now + $timespan; +@@ -172,7 +172,7 @@ case 'zoom': + graph_templates_graph.height, + graph_templates_graph.width + from graph_templates_graph +- where graph_templates_graph.local_graph_id=" . $_GET["local_graph_id"]); ++ where graph_templates_graph.local_graph_id=" . $_REQUEST["local_graph_id"]); + + $graph_height = $graph["height"]; + $graph_width = $graph["width"]; +@@ -210,11 +210,11 @@ case 'zoom': + <table width='1' cellpadding='0'> + <tr> + <td> +- <img id='zoomGraphImage' src='<?php print htmlspecialchars("graph_image.php?action=zoom&local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $_GET["rra_id"] . "&view_type=" . $_REQUEST["view_type"] . "&graph_start=" . $graph_start . "&graph_end=" . $graph_end . "&graph_height=" . $graph_height . "&graph_width=" . $graph_width . "&title_font_size=" . $title_font_size);?>' border='0' alt='<?php print htmlspecialchars($graph_title);?>'> ++ <img id='zoomGraphImage' src='<?php print htmlspecialchars("graph_image.php?action=zoom&local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $_REQUEST["rra_id"] . "&view_type=" . $_REQUEST["view_type"] . "&graph_start=" . $graph_start . "&graph_end=" . $graph_end . "&graph_height=" . $graph_height . "&graph_width=" . $graph_width . "&title_font_size=" . $title_font_size);?>' border='0' alt='<?php print htmlspecialchars($graph_title, ENT_QUOTES);?>'> + </td> + <td valign='top' style='padding: 3px;' class='noprint'> +- <a href='<?php print htmlspecialchars("graph.php?action=properties&local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $_GET["rra_id"] . "&view_type=" . $_REQUEST["view_type"] . "&graph_start=" . $graph_start . "&graph_end=" . $graph_end);?>'><img src='images/graph_properties.gif' border='0' alt='Graph Source/Properties' title='Graph Source/Properties' style='padding: 3px;'></a> +- <a href='<?php print htmlspecialchars("graph_xport.php?local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $_GET["rra_id"] . "&view_type=" . $_REQUEST["view_type"]);?>&graph_start=<?php print $graph_start;?>&graph_end=<?php print $graph_end;?>'><img src='images/graph_query.png' border='0' alt='CSV Export' title='CSV Export' style='padding: 3px;'></a><br> ++ <a href='<?php print htmlspecialchars("graph.php?action=properties&local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $_REQUEST["rra_id"] . "&view_type=" . $_REQUEST["view_type"] . "&graph_start=" . $graph_start . "&graph_end=" . $graph_end);?>'><img src='images/graph_properties.gif' border='0' alt='Graph Source/Properties' title='Graph Source/Properties' style='padding: 3px;'></a> ++ <a href='<?php print htmlspecialchars("graph_xport.php?local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $_REQUEST["rra_id"] . "&view_type=" . $_REQUEST["view_type"]);?>&graph_start=<?php print $graph_start;?>&graph_end=<?php print $graph_end;?>'><img src='images/graph_query.png' border='0' alt='CSV Export' title='CSV Export' style='padding: 3px;'></a><br> + </td> + </tr> + <tr> +@@ -242,16 +242,16 @@ case 'properties': + <table width='1' cellpadding='0'> + <tr> + <td> +- <img src='<?php print htmlspecialchars("graph_image.php?action=properties&local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $_GET["rra_id"] . "&graph_start=" . (isset($_GET["graph_start"]) ? $_GET["graph_start"] : "0") . "&graph_end=" . (isset($_GET["graph_end"]) ? $_GET["graph_end"] : "0"));?>' border='0' alt='<?php print htmlspecialchars($graph_title);?>'> ++ <img src='<?php print htmlspecialchars("graph_image.php?action=properties&local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $_REQUEST["rra_id"] . "&graph_start=" . (isset($_REQUEST["graph_start"]) ? $_REQUEST["graph_start"] : "0") . "&graph_end=" . (isset($_REQUEST["graph_end"]) ? $_REQUEST["graph_end"] : "0"));?>' border='0' alt='<?php print htmlspecialchars($graph_title);?>'> + </td> + <td valign='top' style='padding: 3px;'> +- <a href='<?php print htmlspecialchars("graph.php?action=zoom&local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $_GET["rra_id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_zoom.gif' border='0' alt='Zoom Graph' title='Zoom Graph' style='padding: 3px;'></a><br> +- <a href='<?php print htmlspecialchars("graph_xport.php?local_graph_id=" . $_GET["local_graph_id"] . "&rra_id=" . $_GET["rra_id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_query.png' border='0' alt='CSV Export' title='CSV Export' style='padding: 3px;'></a><br> ++ <a href='<?php print htmlspecialchars("graph.php?action=zoom&local_graph_id=" . $_REQUEST["local_graph_id"]. "&rra_id=" . $_REQUEST["rra_id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_zoom.gif' border='0' alt='Zoom Graph' title='Zoom Graph' style='padding: 3px;'></a><br> ++ <a href='<?php print htmlspecialchars("graph_xport.php?local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=" . $_REQUEST["rra_id"] . "&view_type=" . $_REQUEST["view_type"]);?>'><img src='images/graph_query.png' border='0' alt='CSV Export' title='CSV Export' style='padding: 3px;'></a><br> + </td> + </tr> + <tr> + <td colspan='2' align='center'> +- <strong><?php print htmlspecialchars(db_fetch_cell("select name from rra where id=" . $_GET["rra_id"]));?></strong> ++ <strong><?php print htmlspecialchars(db_fetch_cell("select name from rra where id=" . $_REQUEST["rra_id"]));?></strong> + </td> + </tr> + </table> +Index: cacti/include/top_graph_header.php +=================================================================== +--- cacti.orig/include/top_graph_header.php ++++ cacti/include/top_graph_header.php +@@ -129,12 +129,12 @@ if (isset($_REQUEST["action"]) && $_REQU + $graph_data_array["print_source"] = true; + + /* override: graph start time (unix time) */ +- if (!empty($_GET["graph_start"])) { ++ if (!empty($_REQUEST["graph_start"])) { + $graph_data_array["graph_start"] = get_request_var_request("graph_start"); + } + + /* override: graph end time (unix time) */ +- if (!empty($_GET["graph_end"])) { ++ if (!empty($_REQUEST["graph_end"])) { + $graph_data_array["graph_end"] = get_request_var_request("graph_end"); + } +
signature.asc
Description: OpenPGP digital signature