Test ID:	1.3.6.1.4.1.25623.1.0.57809
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1250-1)
Summary:	The remote host is missing an update for the Debian 'cacti' package(s) announced via the DSA-1250-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'cacti' package(s) announced via the DSA-1250-1 advisory. Vulnerability Insight: It was discovered that cacti, a frontend to rrdtool, performs insufficient validation of data passed to the cmd script, which allows SQL injection and the execution of arbitrary shell commands. For the stable distribution (sarge) this problem has been fixed in version 0.8.6c-7sarge4. For the upcoming stable distribution (etch) this problem has been fixed in version 0.8.6i-3. For the unstable distribution (sid) this problem has been fixed in version 0.8.6i-3. We recommend that you upgrade your cacti package. Affected Software/OS: 'cacti' package(s) on Debian 3.1. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-6799 BugTraq ID: 21799 http://www.securityfocus.com/bid/21799 Bugtraq: 20070118 Re: FW: [cacti-announce] Cacti 0.8.6j Released (Google Search) http://www.securityfocus.com/archive/1/457290/100/0/threaded Debian Security Information: DSA-1250 (Google Search) http://www.debian.org/security/2007/dsa-1250 https://www.exploit-db.com/exploits/3029 http://security.gentoo.org/glsa/glsa-200701-23.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:015 http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.001.html http://securitytracker.com/id?1017451 http://secunia.com/advisories/23528 http://secunia.com/advisories/23665 http://secunia.com/advisories/23917 http://secunia.com/advisories/23941 SuSE Security Announcement: SUSE-SA:2007:007 (Google Search) http://www.novell.com/linux/security/advisories/2007_07_cacti.html http://www.vupen.com/english/advisories/2006/5193 XForce ISS Database: cacti-cmd-sql-injection(31177) https://exchange.xforce.ibmcloud.com/vulnerabilities/31177
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.