Test ID:	1.3.6.1.4.1.25623.1.0.120472
Category:	Amazon Linux Local Security Checks
Title:	Amazon Linux: Security Advisory (ALAS-2014-347)
Summary:	The remote host is missing an update for the 'cacti' package(s) announced via the ALAS-2014-347 advisory.
Description:	Summary: The remote host is missing an update for the 'cacti' package(s) announced via the ALAS-2014-347 advisory. Vulnerability Insight: Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users. Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter. lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. Affected Software/OS: 'cacti' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2326 BugTraq ID: 66390 http://www.securityfocus.com/bid/66390 Bugtraq: 20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti (Google Search) http://www.securityfocus.com/archive/1/531588 Debian Security Information: DSA-2970 (Google Search) http://www.debian.org/security/2014/dsa-2970 http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html https://security.gentoo.org/glsa/201509-03 http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html http://secunia.com/advisories/57647 http://secunia.com/advisories/59203 SuSE Security Announcement: openSUSE-SU-2015:0479 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html Common Vulnerability Exposure (CVE) ID: CVE-2014-2327 BugTraq ID: 66392 http://www.securityfocus.com/bid/66392 http://jvn.jp/en/jp/JVN55076671/index.html http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html Common Vulnerability Exposure (CVE) ID: CVE-2014-2328 BugTraq ID: 66387 http://www.securityfocus.com/bid/66387 Common Vulnerability Exposure (CVE) ID: CVE-2014-2708 BugTraq ID: 66555 http://www.securityfocus.com/bid/66555 http://seclists.org/oss-sec/2014/q2/2 http://seclists.org/oss-sec/2014/q2/15 XForce ISS Database: cacti-cve20142708-sql-injection(92278) https://exchange.xforce.ibmcloud.com/vulnerabilities/92278 Common Vulnerability Exposure (CVE) ID: CVE-2014-2709 BugTraq ID: 66630 http://www.securityfocus.com/bid/66630
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.