SB2009113001 - OS Command Injection in Cacti

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: CVE-2009-4112)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to the application allows authenticated administrators to update the "Data Input Method" for the "Linux - Get Memory Usage" setting and insert arbitrary system command. A remote authenticated administrator can execute arbitrary OS commands on the system.

Remediation

Install update from vendor's website.

References

• http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0292.html
• http://www.openwall.com/lists/oss-security/2009/11/26/1
• http://www.openwall.com/lists/oss-security/2009/11/30/2
• http://www.securityfocus.com/archive/1/508129/100/0/threaded