ID de Prueba:	1.3.6.1.4.1.25623.1.0.120663
Categoría:	Amazon Linux Local Security Checks
Título:	Amazon Linux: Security Advisory (ALAS-2016-673)
Resumen:	The remote host is missing an update for the 'cacti' package(s) announced via the ALAS-2016-673 advisory.
Descripción:	Summary: The remote host is missing an update for the 'cacti' package(s) announced via the ALAS-2016-673 advisory. Vulnerability Insight: Various cross-site scripting (XSS) flaws (CVE-2013-5588, CVE-2014-5025, CVE-2014-5026) and various SQL injection flaws (CVE-2013-5589, CVE-2015-4342, CVE-2015-4634, CVE-2015-8377, CVE-2015-8604) were discovered affecting versions of Cacti prior to 0.8.8g. Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2015-2665) SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. (CVE-2015-4454) Affected Software/OS: 'cacti' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-5588 BugTraq ID: 62001 http://www.securityfocus.com/bid/62001 Debian Security Information: DSA-2747 (Google Search) http://www.debian.org/security/2013/dsa-2747 http://secunia.com/advisories/54652 SuSE Security Announcement: openSUSE-SU-2015:0479 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html Common Vulnerability Exposure (CVE) ID: CVE-2013-5589 BugTraq ID: 62005 http://www.securityfocus.com/bid/62005 Common Vulnerability Exposure (CVE) ID: CVE-2014-5025 BugTraq ID: 68759 http://www.securityfocus.com/bid/68759 Debian Security Information: DSA-3007 (Google Search) http://www.debian.org/security/2014/dsa-3007 https://security.gentoo.org/glsa/201509-03 http://www.openwall.com/lists/oss-security/2014/07/22/9 XForce ISS Database: cacti-cve20145025-xss(94814) https://exchange.xforce.ibmcloud.com/vulnerabilities/94814 Common Vulnerability Exposure (CVE) ID: CVE-2014-5026 http://seclists.org/oss-sec/2014/q3/244 XForce ISS Database: cacti-cve20145026-xss(94816) https://exchange.xforce.ibmcloud.com/vulnerabilities/94816 Common Vulnerability Exposure (CVE) ID: CVE-2015-2665 BugTraq ID: 75309 http://www.securityfocus.com/bid/75309 Debian Security Information: DSA-3295 (Google Search) http://www.debian.org/security/2015/dsa-3295 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://www.fortiguard.com/advisory/FG-VD-15-017/ http://www.securitytracker.com/id/1032672 Common Vulnerability Exposure (CVE) ID: CVE-2015-4342 BugTraq ID: 75108 http://www.securityfocus.com/bid/75108 http://seclists.org/fulldisclosure/2015/Jun/19 http://packetstormsecurity.com/files/132224/Cacti-SQL-Injection-Header-Injection.html SuSE Security Announcement: openSUSE-SU-2015:1133 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-06/msg00052.html Common Vulnerability Exposure (CVE) ID: CVE-2015-4454 BugTraq ID: 75270 http://www.securityfocus.com/bid/75270 Common Vulnerability Exposure (CVE) ID: CVE-2015-4634 Debian Security Information: DSA-3312 (Google Search) http://www.debian.org/security/2015/dsa-3312 http://www.securitytracker.com/id/1032989 SuSE Security Announcement: openSUSE-SU-2015:1285 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-07/msg00052.html Common Vulnerability Exposure (CVE) ID: CVE-2015-8377 Debian Security Information: DSA-3494 (Google Search) http://www.debian.org/security/2016/dsa-3494 http://seclists.org/fulldisclosure/2015/Dec/57 https://security.gentoo.org/glsa/201607-05 http://www.securitytracker.com/id/1034498 Common Vulnerability Exposure (CVE) ID: CVE-2015-8604 http://seclists.org/fulldisclosure/2016/Jan/16 http://bugs.cacti.net/view.php?id=2652 http://packetstormsecurity.com/files/135191/Cacti-0.8.8f-graphs_new.php-SQL-Injection.html http://www.openwall.com/lists/oss-security/2016/01/04/8 http://www.openwall.com/lists/oss-security/2016/01/04/9 http://www.securitytracker.com/id/1034573
Copyright	Copyright (C) 2016 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.