oss-security - Re: Re: CVE Request: cacti: SQL injection vulnerability in graphs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160105111246.GA4592@eldamar.local>
Date: Tue, 5 Jan 2016 12:12:46 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: Andreas Stieger <astieger@...e.com>
Cc: oss-security@...ts.openwall.com, cve-assign@...re.org,
	elbrus@...ian.org
Subject: Re: Re: CVE Request: cacti: SQL injection
 vulnerability in graphs_new.php

Hi Andreas,

On Tue, Jan 05, 2016 at 10:20:23AM +0100, Andreas Stieger wrote:
> Hello,
> 
> On 01/05/2016 12:58 AM, cve-assign@...re.org wrote:
> > > Another SQL injection vulnerability via graphs_new.php in cacti was
> > > found, reported to the bug http://bugs.cacti.net/view.php?id=2652
> >
> > http://bugs.cacti.net/view.php?id=2652 is CVE-2015-8604.
> 
> Check against a possible duplicate assignment with CVE-2015-8377?
> 
> http://seclists.org/fulldisclosure/2015/Dec/att-57/cacti_sqli%281%29.txt
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1291222
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8377
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8377

Theree are two different vulnerabilities here, see second comment in
http://bugs.cacti.net/view.php?id=2652 which describe both, the
CVE-2015-8377 and the new assigned one (CVE-2015-8604).

Does this helps?

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.