Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=54326a4c73e1bc292245f501d40a4681f5807593
commit 54326a4c73e1bc292245f501d40a4681f5807593 Author: kikadf <[email protected]> Date: Thu Aug 21 15:29:00 2014 +0200 cacti-0.8.8b-3-x86_64 * Fix CVE-2014-5025, CVE-2014-5026, CVE-2014-5043, CVE-2014-5261, * CVE-2014-5262 diff --git a/source/network-extra/cacti/CVE-2014-4002.patch b/source/network-extra/cacti/CVE-2014-4002.patch index c3ff1d9..39bf351 100644 --- a/source/network-extra/cacti/CVE-2014-4002.patch +++ b/source/network-extra/cacti/CVE-2014-4002.patch @@ -2,6 +2,7 @@ Description: CVE-2014-4002 Unspecified Cross-Site Scripting Vulnerability Author: cigamit Source: http://svn.cacti.net/viewvc?view=rev&revision=7451 Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 +Source: svn://svn.cacti.net/cacti/cacti@7458 --- a/host_templates.php +++ b/host_templates.php @@ -117,6 +117,10 @@ @@ -9,7 +10,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $host_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -22,7 +23,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $cdef_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -35,7 +36,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $dq_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -48,7 +49,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $ds_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -61,7 +62,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $device_actions, $fields_host_edit; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -74,7 +75,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $di_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -87,7 +88,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $graph_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -101,7 +102,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $graph_actions; + + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -114,7 +115,7 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 global $colors, $ds_actions; + /* ================= input validation ================= */ -+ input_validate_input_number(get_request_var_post('drp_action')); ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); + /* ==================================================== */ + /* if we are to save this form, instead of display it */ @@ -134,3 +135,16 @@ Source: http://svn.cacti.net/viewvc?view=rev&revision=7452 $save["id"] = $_POST["graph_template_input_id"]; $save["hash"] = get_hash_graph_template($_POST["graph_template_input_id"], "graph_template_input"); $save["graph_template_id"] = $_POST["graph_template_id"]; +--- a/user_admin.php ++++ b/user_admin.php +@@ -72,6 +72,10 @@ + function form_actions() { + global $colors, $user_actions, $auth_realms; + ++ /* ================= input validation ================= */ ++ input_validate_input_regex(get_request_var_post('drp_action'), "^([a-zA-Z0-9_]+)$"); ++ /* ==================================================== */ ++ + /* if we are to save this form, instead of display it */ + if (isset($_POST["selected_items"])) { + if (get_request_var_post("drp_action") != "2") { diff --git a/source/network-extra/cacti/CVE-2014-5025-5026-5043.patch b/source/network-extra/cacti/CVE-2014-5025-5026-5043.patch new file mode 100644 index 0000000..874a71b --- /dev/null +++ b/source/network-extra/cacti/CVE-2014-5025-5026-5043.patch @@ -0,0 +1,168 @@ +Description: Several names/titles were not sanitized which allowes a + privileged user to inject XSS code. + . + CVE-2014-5025 http://www.openwall.com/lists/oss-security/2014/07/22/9 + CVE-2014-5026 http://www.openwall.com/lists/oss-security/2014/07/22/9 + CVE-2014-5043 http://www.openwall.com/lists/oss-security/2014/07/24/9 +Bugs: http://bugs.cacti.net/view.php?id=2456 +Author: Paul Gevers <[email protected]> + +--- a/data_sources.php ++++ b/data_sources.php +@@ -427,7 +427,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $ds_list .= "<li>" . get_data_source_title($matches[1]) . "<br>"; ++ $ds_list .= "<li>" . htmlspecialchars(get_data_source_title($matches[1])) . "<br>"; + $ds_array[$i] = $matches[1]; + + $i++; +@@ -1359,7 +1359,7 @@ + $poller_interval = ((isset($poller_intervals[$data_source["local_data_id"]])) ? $poller_intervals[$data_source["local_data_id"]] : 0); + + form_alternate_row_color($colors["alternate"], $colors["light"], $i, 'line' . $data_source["local_data_id"]); $i++; +- form_selectable_cell("<a class='linkEditMain' href='" . htmlspecialchars("data_sources.php?action=ds_edit&id=" . $data_source["local_data_id"]) . "' title='" . $data_source["name_cache"] . "'>" . ((get_request_var_request("filter") != "") ? preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", title_trim(htmlspecialchars($data_source["name_cache"]), read_config_option("max_title_data_source"))) : title_trim(htmlspecialchars($data_source["name_cache"]), read_config_option("max_title_data_source"))) . "</a>", $data_source["local_data_id"]); ++ form_selectable_cell("<a class='linkEditMain' href='" . htmlspecialchars("data_sources.php?action=ds_edit&id=" . $data_source["local_data_id"]) . "' title='" . htmlspecialchars($data_source["name_cache"], ENT_QUOTES) . "'>" . ((get_request_var_request("filter") != "") ? preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", title_trim(htmlspecialchars($data_source["name_cache"]), read_config_option("max_title_data_source"))) : title_trim(htmlspecialchars($data_source["name_cache"]), read_config_option("max_title_data_source"))) . "</a>", $data_source["local_data_id"]); + form_selectable_cell($data_source['local_data_id'], $data_source['local_data_id']); + form_selectable_cell($data_input_name, $data_source["local_data_id"]); + form_selectable_cell(get_poller_interval($poller_interval), $data_source["local_data_id"]); +--- a/cdef.php ++++ b/cdef.php +@@ -194,7 +194,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $cdef_list .= "<li>" . db_fetch_cell("select name from cdef where id=" . $matches[1]) . "<br>"; ++ $cdef_list .= "<li>" . htmlspecialchars(db_fetch_cell("select name from cdef where id=" . $matches[1])) . "<br>"; + $cdef_array[$i] = $matches[1]; + + $i++; +--- a/tree.php ++++ b/tree.php +@@ -354,7 +354,7 @@ + } + + include("./include/top_header.php"); +- form_confirm("Are You Sure?", $text, htmlspecialchars("tree.php?action=edit&id=" . $_GET["tree_id"]), htmlspecialchars("tree.php?action=item_remove&id=" . $_GET["id"] . "&tree_id=" . $_GET["tree_id"])); ++ form_confirm("Are You Sure?", htmlspecialchars($text, ENT_QUOTES), htmlspecialchars("tree.php?action=edit&id=" . $_GET["tree_id"]), htmlspecialchars("tree.php?action=item_remove&id=" . $_GET["id"] . "&tree_id=" . $_GET["tree_id"])); + include("./include/bottom_footer.php"); + exit; + } +@@ -383,7 +383,7 @@ + + if ((read_config_option("deletion_verification") == "on") && (!isset($_GET["confirm"]))) { + include("./include/top_header.php"); +- form_confirm("Are You Sure?", "Are you sure you want to delete the tree <strong>'" . db_fetch_cell("select name from graph_tree where id=" . $_GET["id"]) . "'</strong>?", htmlspecialchars("tree.php"), htmlspecialchars("tree.php?action=remove&id=" . $_GET["id"])); ++ form_confirm("Are You Sure?", "Are you sure you want to delete the tree <strong>'" . htmlspecialchars(db_fetch_cell("select name from graph_tree where id=" . $_GET["id"]), ENT_QUOTES) . "'</strong>?", htmlspecialchars("tree.php"), htmlspecialchars("tree.php?action=remove&id=" . $_GET["id"])); + include("./include/bottom_footer.php"); + exit; + } +--- a/data_input.php ++++ b/data_input.php +@@ -185,7 +185,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $di_list .= "<li>" . db_fetch_cell("SELECT name FROM data_input WHERE id='" . $matches[1] . "'") . "</li>"; ++ $di_list .= "<li>" . htmlspecialchars(db_fetch_cell("SELECT name FROM data_input WHERE id='" . $matches[1] . "'")) . "</li>"; + $di_array[$i] = $matches[1]; + + $i++; +@@ -246,7 +246,7 @@ + + if ((read_config_option("deletion_verification") == "on") && (!isset($_GET["confirm"]))) { + include("./include/top_header.php"); +- form_confirm("Are You Sure?", "Are you sure you want to delete the field <strong>'" . db_fetch_cell("select name from data_input_fields where id=" . $_GET["id"]) . "'</strong>?", htmlspecialchars("data_input.php?action=edit&id=" . $_GET["data_input_id"]), htmlspecialchars("data_input.php?action=field_remove&id=" . $_GET["id"] . "&data_input_id=" . $_GET["data_input_id"])); ++ form_confirm("Are You Sure?", "Are you sure you want to delete the field <strong>'" . htmlspecialchars(db_fetch_cell("select name from data_input_fields where id=" . $_GET["id"]), ENT_QUOTES) . "'</strong>?", htmlspecialchars("data_input.php?action=edit&id=" . $_GET["data_input_id"]), htmlspecialchars("data_input.php?action=field_remove&id=" . $_GET["id"] . "&data_input_id=" . $_GET["data_input_id"])); + include("./include/bottom_footer.php"); + exit; + } +--- a/graphs.php ++++ b/graphs.php +@@ -387,7 +387,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $graph_list .= "<li>" . get_graph_title($matches[1]) . "</li>"; ++ $graph_list .= "<li>" . htmlspecialchars(get_graph_title($matches[1])) . "</li>"; + $graph_array[$i] = $matches[1]; + + $i++; +--- a/host_templates.php ++++ b/host_templates.php +@@ -156,7 +156,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $host_list .= "<li>" . db_fetch_cell("select name from host_template where id=" . $matches[1]) . "<br>"; ++ $host_list .= "<li>" . htmlspecialchars(db_fetch_cell("select name from host_template where id=" . $matches[1])) . "<br>"; + $host_array[$i] = $matches[1]; + + $i++; +--- a/data_templates.php ++++ b/data_templates.php +@@ -305,7 +305,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $ds_list .= "<li>" . db_fetch_cell("select name from data_template where id=" . $matches[1]) . "<br>"; ++ $ds_list .= "<li>" . htmlspecialchars(db_fetch_cell("select name from data_template where id=" . $matches[1])) . "<br>"; + $ds_array[$i] = $matches[1]; + + $i++; +--- a/graph_templates.php ++++ b/graph_templates.php +@@ -216,7 +216,7 @@ + input_validate_input_number($matches[1]); + /* ==================================================== */ + +- $graph_list .= "<li>" . db_fetch_cell("select name from graph_templates where id=" . $matches[1]) . "<br>"; ++ $graph_list .= "<li>" . htmlspecialchars(db_fetch_cell("select name from graph_templates where id=" . $matches[1])) . "<br>"; + $graph_array[$i] = $matches[1]; + + $i++; +--- a/user_admin.php ++++ b/user_admin.php +@@ -179,7 +179,7 @@ + /* ==================================================== */ + + if (get_request_var_post("drp_action") != "2") { +- $user_list .= "<li>" . db_fetch_cell("SELECT username FROM user_auth WHERE id=" . $matches[1]) . "<br>"; ++ $user_list .= "<li>" . htmlspecialchars(db_fetch_cell("SELECT username FROM user_auth WHERE id=" . $matches[1])) . "<br>"; + } + $user_array[$i] = $matches[1]; + +--- a/graph_templates_inputs.php ++++ b/graph_templates_inputs.php +@@ -134,7 +134,7 @@ + + if ((read_config_option("deletion_verification") == "on") && (!isset($_GET["confirm"]))) { + include("./include/top_header.php"); +- form_confirm("Are You Sure?", "Are you sure you want to delete the input item <strong>'" . db_fetch_cell("select name from graph_template_input where id=" . $_GET["id"]) . "'</strong>? NOTE: Deleting this item will NOT affect graphs that use this template.", htmlspecialchars("graph_templates.php?action=template_edit&id=" . $_GET["graph_template_id"]), htmlspecialchars("graph_templates_inputs.php?action=input_remove&id=" . $_GET["id"] . "&graph_template_id=" . $_GET["graph_template_id"])); ++ form_confirm("Are You Sure?", "Are you sure you want to delete the input item <strong>'" . htmlspecialchars(db_fetch_cell("select name from graph_template_input where id=" . $_GET["id"]), ENT_QUOTES) . "'</strong>? NOTE: Deleting this item will NOT affect graphs that use this template.", htmlspecialchars("graph_templates.php?action=template_edit&id=" . $_GET["graph_template_id"]), htmlspecialchars("graph_templates_inputs.php?action=input_remove&id=" . $_GET["id"] . "&graph_template_id=" . $_GET["graph_template_id"])); + include("./include/bottom_footer.php"); + exit; + } +--- a/data_queries.php ++++ b/data_queries.php +@@ -340,7 +340,7 @@ + + if ((read_config_option("deletion_verification") == "on") && (!isset($_GET["confirm"]))) { + include("./include/top_header.php"); +- form_confirm("Are You Sure?", "Are you sure you want to delete the Data Query Graph <strong>'" . db_fetch_cell("select name from snmp_query_graph where id=" . $_GET["id"]) . "'</strong>?", htmlspecialchars("data_queries.php?action=edit&id=" . $_GET["snmp_query_id"]), htmlspecialchars("data_queries.php?action=item_remove&id=" . $_GET["id"] . "&snmp_query_id=" . $_GET["snmp_query_id"])); ++ form_confirm("Are You Sure?", "Are you sure you want to delete the Data Query Graph <strong>'" . htmlspecialchars(db_fetch_cell("select name from snmp_query_graph where id=" . $_GET["id"]), ENT_QUOTES) . "'</strong>?", htmlspecialchars("data_queries.php?action=edit&id=" . $_GET["snmp_query_id"]), htmlspecialchars("data_queries.php?action=item_remove&id=" . $_GET["id"] . "&snmp_query_id=" . $_GET["snmp_query_id"])); + include("./include/bottom_footer.php"); + exit; + } +--- a/utilities.php ++++ b/utilities.php +@@ -746,7 +746,7 @@ + </td> + <td style='white-space:nowrap;'> + <?php if (isset($item["full_name"])) { +- print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["full_name"])) : $item["full_name"]); ++ print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", htmlspecialchars($item["full_name"]))) : htmlspecialchars($item["full_name"])); + }else{ + print "(User Removed)"; + } diff --git a/source/network-extra/cacti/CVE-2014-5261.patch b/source/network-extra/cacti/CVE-2014-5261.patch new file mode 100644 index 0000000..53d93c3 --- /dev/null +++ b/source/network-extra/cacti/CVE-2014-5261.patch @@ -0,0 +1,19 @@ +Description: CVE-2014-5261 Unsufficient input sanitation + Since there is no check whether $size is actually a number, only that + it starts with a number ... it's possible to insert commands by adding + a ';' followed by any command. +Author: [email protected] +Bug: http://bugs.cacti.net/view.php?id=2455 +Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1127165 +Source: svn://svn.cacti.net/cacti/cacti@7454 +--- a/lib/rrd.php ++++ b/lib/rrd.php +@@ -2060,7 +2060,7 @@ + $size = 8; + } + +- return "--font " . strtoupper($type) . ":" . $size . ":" . $font . RRD_NL; ++ return "--font " . strtoupper($type) . ":" . floatval($size) . ":" . $font . RRD_NL; + } + + function rrd_substitute_host_query_data($txt_graph_item, $graph, $graph_item) { diff --git a/source/network-extra/cacti/CVE-2014-5262.patch b/source/network-extra/cacti/CVE-2014-5262.patch new file mode 100644 index 0000000..e2b73e5 --- /dev/null +++ b/source/network-extra/cacti/CVE-2014-5262.patch @@ -0,0 +1,19 @@ +Description: CVE-2014-5262 Incomplete and incorrect input parsing + leads to SQL injection attack scenarios +Author: [email protected] +Bug: http://bugs.cacti.net/view.php?id=2455 +Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1127165 +Source: svn://svn.cacti.net/cacti/cacti@7454 +--- a/graph_settings.php ++++ b/graph_settings.php +@@ -54,6 +54,10 @@ + + while (list($tab_short_name, $tab_fields) = each($settings_graphs)) { + while (list($field_name, $field_array) = each($tab_fields)) { ++ /* Check every field with a numeric default value and reset it to default if the inputted value is not numeric */ ++ if (isset($field_array["default"]) && is_numeric($field_array["default"]) && !is_numeric(get_request_var_post($field_name))) { ++ $_POST[$field_name] = $field_array["default"]; ++ } + if ($field_array["method"] == "checkbox") { + if (isset($_POST[$field_name])) { + db_execute("REPLACE INTO settings_graphs (user_id,name,value) VALUES (" . $_SESSION["sess_user_id"] . ",'$field_name', 'on')"); diff --git a/source/network-extra/cacti/FrugalBuild b/source/network-extra/cacti/FrugalBuild index 4f12daa..e761c8f 100644 --- a/source/network-extra/cacti/FrugalBuild +++ b/source/network-extra/cacti/FrugalBuild @@ -4,7 +4,7 @@ pkgname=cacti pkgver=0.8.8b -pkgrel=2 +pkgrel=3 pkgdesc="Cacti is a complete network graphing solution designed to harness the power of RRDTool's data storage and graphing functionality." url="http://cacti.net/"; depends=('rrdtool' 'apache' 'mysql' 'php' 'net-snmp>=5.7') @@ -17,13 +17,18 @@ sha1sums=('84979416ae08d586064328d6451a3108b74a3b06') # FSA fix *** source=(${source[@]} CVE-2013-1435.patch CVE-2013-5588.patch CVE-2013-5589.patch CVE-2014-2326_2328_2708_2709.patch - CVE-2014-2327.patch CVE-2014-4002.patch) + CVE-2014-2327.patch CVE-2014-4002.patch + CVE-2014-5025-5026-5043.patch CVE-2014-5261.patch + CVE-2014-5262.patch) sha1sums=(${sha1sums[@]} 'fce20bc2c6157a85da94f02388d39c72b217f969' \ '690c6b1718e47a0ed1449971881a61bf51758f55' \ '6b35773be1424dbacde25a8ad709e136c7a7ef6d' \ 'a1aa1a99da45b2b72736f196e8405b954a9b7507' \ '78258b13758f06331b0c54fbbc9fc905000bc9cc' \ - 'b5713d184a21496437e8b99aaa7a2ebcdfdf9a88') + 'ebdaeefd5827d1ea3a9380adc7d57cc1069875b1' \ + 'e9266a17732a6b64d7b5f3befa47032550f43b39' \ + '33d2384d122e39284bc967042e7e7d5d3576a3a7' \ + '3f6f432a2bb2c61a6a166cfcc7dd73db02596b4a') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
