Subject: [Pkg-cacti-maint] Bug#743565: cacti: CVE-2014-2708 CVE-2014-2709

From: Salvatore Bonaccorso <[email-masked]>
Date: Thu, 03 Apr 2014 21:30:56 +0200

Package: cacti
Severity: grave
Tags: security upstream

Dear cacti maintainers

Two more vulnerabilities were published/CVE assigned for cacti.

CVE-2014-2708[0] and CVE-2014-2709[1]. Fore the CVE assignment details
see [2]. For these there is upstream commit [3] (both CVE addressed in
same commit).

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2708
    https://security-tracker.debian.org/tracker/CVE-2014-2708
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2709
    https://security-tracker.debian.org/tracker/CVE-2014-2709
[2] http://seclists.org/oss-sec/2014/q2/15
[3] http://svn.cacti.net/viewvc?view=rev&revision=7439

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sat, 05 Apr 2014 07:42:07 +0000

Processing control commands:

> found -1 0.8.7g-1+squeeze3
Bug #743565 [cacti] cacti: CVE-2014-2708 CVE-2014-2709
Marked as found in versions cacti/0.8.7g-1+squeeze3.
> found 742768 0.8.7g-1+squeeze3
Bug #742768 [cacti] cacti: CVE-2014-2326 CVE-2014-2327 CVE-2014-2328
Marked as found in versions cacti/0.8.7g-1+squeeze3.

-- 
742768: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
743565: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743565
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Paul Gevers <[email-masked]>
Date: Sat, 05 Apr 2014 09:38:56 +0200

Control: found -1 0.8.7g-1+squeeze3
Control: found 742768 0.8.7g-1+squeeze3

> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

Hi security team,

Do you consider these vulnerabilities severe enough to require fixing
through security updates, or is the update via (old-)stable-updates good
enough? The last fix CVE-2014-2327 is still being made, but I can (and
am preparing) upload fixes for the other four current CVE issues. Do you
want me to get the current fixes already in, or wait one more week to
get all five fixes into Debian in one go. (For the record, I will upload
the four fixes to sid real soon anyways).

Paul

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sat, 05 Apr 2014 12:51:05 +0000

Your message dated Sat, 05 Apr 2014 12:48:28 +0000
with message-id <[email-masked]>
and subject line Bug#743565: fixed in cacti 0.8.8b+dfsg-4
has caused the Debian Bug report #743565,
regarding cacti: CVE-2014-2708 CVE-2014-2709
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: CVE-2014-2708 CVE-2014-2709
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Thu, 03 Apr 2014 21:30:56 +0200

Package: cacti
Severity: grave
Tags: security upstream

Dear cacti maintainers

Regards,
Salvatore

Subject: Bug#743565: fixed in cacti 0.8.8b+dfsg-4
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sat, 05 Apr 2014 12:48:28 +0000

Source: cacti
Source-Version: 0.8.8b+dfsg-4

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sat, 05 Apr 2014 13:03:22 +0200
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.8b+dfsg-4
Distribution: unstable
Urgency: high
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description: 
 cacti      - web interface for graphing of monitoring systems
Closes: 743565
Changes: 
 cacti (0.8.8b+dfsg-4) unstable; urgency=high
 .
   * Security update (Closes: 743565)
     - CVE-2014-2326 Cross-site scripting (XSS) vulnerability
     - CVE-2014-2328 Unspecified Remote Command Execution Vulnerability
     - CVE-2014-2708 SQL injection
     - CVE-2014-2709 Unspecified Remote Command Execution Vulnerability
   * Bump standards (no changes needed)
   * Fix VCS-Browser field
   * Fix license paragraph of jstree (Thanks lintian)
Checksums-Sha1: 
 5b1322e3283bd3bbf536a4ee496f84b81e3bc71f 1647 cacti_0.8.8b+dfsg-4.dsc
 bdefb6a140c87202a4cd6eef5911de15caaa4981 96224 cacti_0.8.8b+dfsg-4.debian.tar.xz
 5a01ed5aec578f9e2497edeeda512696ccd40e7d 1886376 cacti_0.8.8b+dfsg-4_all.deb
Checksums-Sha256: 
 bc3fd95653d2e5f69d9beb87d4e617b4750eb5b094bd0b74988c205a01b3803a 1647 cacti_0.8.8b+dfsg-4.dsc
 211560566e2e9649ade19929bf28461781ac090d06765131e4f6008b9651e429 96224 cacti_0.8.8b+dfsg-4.debian.tar.xz
 540aa80708b5ea1ec0498c57b8d259cb4d4ddc0a89ad7c1d46963efbf78edf52 1886376 cacti_0.8.8b+dfsg-4_all.deb
Files: 
 1deaa9d0bfa3c31c14c0de8ada258e46 1647 web extra cacti_0.8.8b+dfsg-4.dsc
 dca44600cfad9c2b77891087e1082948 96224 web extra cacti_0.8.8b+dfsg-4.debian.tar.xz
 d4feaf8a466b735f114e8f578d0344ab 1886376 web extra cacti_0.8.8b+dfsg-4_all.deb