Subject: [Pkg-cacti-maint] Bug#926700: cacti: CVE-2019-11025

From: Salvatore Bonaccorso <[email-masked]>
Date: Tue, 09 Apr 2019 12:28:58 +0200

Source: cacti
Version: 1.2.2+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/2581

Hi,

The following vulnerability was published for cacti.

CVE-2019-11025[0]:
| In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping
| occurs before printing out the value of the SNMP community string
| (SNMP Options) in the View poller cache, leading to XSS.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-11025
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11025
[1] https://github.com/Cacti/cacti/issues/2581

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: Paul Gevers <[email-masked]>
Date: Tue, 9 Apr 2019 20:26:31 +0200

Control: found -1 0.8.8h+ds1-10 0.8.8b+dfsg-8+deb8u6

Hi Salvatore,

> Please adjust the affected versions in the BTS as needed.

Doing so now. Thanks for the report.

Paul

---

From: "Chris Lamb" <[email-masked]>
Date: Wed, 10 Apr 2019 10:51:33 -0400

retitle 926700 cacti: CVE-2019-11025 - XSS in utilities.php
thanks

Hi all,

I've attached a patch that I intend to upload to jessie LTS. May I
also prepare an update for stretch based on this?

Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      [email-masked] 🍥 chris-lamb.co.uk
       `-

Backport from https://github.com/Cacti/cacti/commit/c373e66a6a224e221a1db037164144ce59b20736

--- cacti-0.8.8b+dfsg.orig/utilities.php
+++ cacti-0.8.8b+dfsg/utilities.php
@@ -1164,7 +1164,7 @@ function utilities_view_snmp_cache() {
 							}
 							if (sizeof($hosts) > 0) {
 							foreach ($hosts as $host) {
-								print "<option value='" . $host["id"] . "'"; if (get_request_var_request("host_id") == $host["id"]) { print " selected"; } print ">" . $host["description"] . "</option>\n";
+								print "<option value='" . $host["id"] . "'"; if (get_request_var_request("host_id") == $host["id"]) { print " selected"; } print ">" . htmlspecialchars($host["description"]) . "</option>\n";
 							}
 							}
 							?>
@@ -1305,7 +1305,7 @@ function utilities_view_snmp_cache() {
 		form_alternate_row_color($colors["form_alternate1"],$colors["form_alternate2"],$i);
 		?>
 		<td>
-			Host: <?php print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["description"])) : $item["description"]);?>
+			Host: <?php print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", htmlspecialchars($item["description"]))) : htmlspecialchars($item["description"]));?>
 			, SNMP Query: <?php print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["name"])) : $item["name"]);?>
 		</td>
 		</tr>
@@ -1313,7 +1313,7 @@ function utilities_view_snmp_cache() {
 		form_alternate_row_color($colors["form_alternate1"],$colors["form_alternate2"],$i);
 		?>
 		<td>
-			Index: <?php print $item["snmp_index"];?>
+			Index: <?php print htmlspecialchars($item["snmp_index"]);?>
 			, Field Name: <?php print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["field_name"])) : $item["field_name"]);?>
 			, Field Value: <?php print (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["field_value"])) : $item["field_value"]);?>
 		</td>
@@ -1559,12 +1559,12 @@ function utilities_view_poller_cache() {
 				if ($item["snmp_version"] != 3) {
 					$details =
 						"SNMP Version: " . $item["snmp_version"] . ", " .
-						"Community: " . $item["snmp_community"] . ", " .
+						"Community: " . htmlspecialchars($item["snmp_community"]) . ", " .
 						"OID: " . (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["arg1"])) : $item["arg1"]);
 				}else{
 					$details =
 						"SNMP Version: " . $item["snmp_version"] . ", " .
-						"User: " . $item["snmp_username"] . ", OID: " . $item["arg1"];
+						"User: " . htmlspecialchars($item["snmp_username"]) . ", OID: " . $item["arg1"];
 				}
 			}elseif ($item["action"] == 1) {
 					$details = "Script: " . (strlen(get_request_var_request("filter")) ? (preg_replace("/(" . preg_quote(get_request_var_request("filter"), "/") . ")/i", "<span style='background-color: #F8D93D;'>\\1</span>", $item["arg1"])) : $item["arg1"]);
@@ -1583,7 +1583,7 @@ function utilities_view_poller_cache() {
 			<td>
 			</td>
 			<td>
-				RRD: <?php print $item["rrd_path"];?>
+				RRD: <?php print htmlspecialchars($item["rrd_path"]);?>
 			</td>
 		</tr>
 		<?php

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Wed, 10 Apr 2019 14:54:07 +0000

> retitle 926700 cacti: CVE-2019-11025 - XSS in utilities.php
Bug #926700 [src:cacti] cacti: CVE-2019-11025
Changed Bug title to 'cacti: CVE-2019-11025 - XSS in utilities.php' from 'cacti: CVE-2019-11025'.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
926700: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926700
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Paul Gevers <[email-masked]>
Date: Wed, 10 Apr 2019 20:41:23 +0200

Hi Chris,

> also prepare an update for stretch based on this?

I guess it doesn't matter for stable, but you have my blessing.

Paul

PS: I uploaded to sid yesterday, but I fear my key on the Debian keyring
was still marked as expired and the package was dropped.

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Thu, 11 Apr 2019 12:06:03 +0000

Your message dated Thu, 11 Apr 2019 12:03:41 +0000
with message-id <[email-masked]>
and subject line Bug#926700: fixed in cacti 1.2.2+ds1-2
has caused the Debian Bug report #926700,
regarding cacti: CVE-2019-11025 - XSS in utilities.php
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: CVE-2019-11025
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Tue, 09 Apr 2019 12:28:58 +0200

Source: cacti
Version: 1.2.2+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2019-11025[0]:

Regards,
Salvatore

Subject: Bug#926700: fixed in cacti 1.2.2+ds1-2
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Thu, 11 Apr 2019 12:03:41 +0000

Source: cacti
Source-Version: 1.2.2+ds1-2

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Tue, 09 Apr 2019 20:42:38 +0200
Source: cacti
Architecture: source
Version: 1.2.2+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 926700
Changes:
 cacti (1.2.2+ds1-2) unstable; urgency=medium
 .
   * Add 0001-Resolving-Issue-2581.patch from upstream (Closes: #926700)
     CVE-2019-11025: In clearFilter() in utilities.php no escaping occurs
     before printing out the value of the SNMP community string (SNMP
     Options) in the View poller cache, leading to XSS.
Checksums-Sha1:
 30c70832c01af1d76c00868eeedbb02ebdcb4eb1 2451 cacti_1.2.2+ds1-2.dsc
 a93f3f3c6739f420a8beda701b43d7e89e07e476 53228 cacti_1.2.2+ds1-2.debian.tar.xz
Checksums-Sha256:
 cae011f5bdad9a85e93b430fd198563ab8d98880f9baf9c86f6d53513739f5d5 2451 cacti_1.2.2+ds1-2.dsc
 2f59bed7085bc5f9b0430bedb407ee15ea7efd123973d372358eb6728fd5f3e7 53228 cacti_1.2.2+ds1-2.debian.tar.xz
Files:
 9b8b58f46f6e379940cf2e4117af223f 2451 web optional cacti_1.2.2+ds1-2.dsc
 bb8df17986ac931fa8b231bf43f03d09 53228 web optional cacti_1.2.2+ds1-2.debian.tar.xz

---

From: "Chris Lamb" <[email-masked]>
Date: Mon, 15 Apr 2019 11:23:36 -0400

> also prepare an update for stretch based on this?

Ping on this, security team?

Paul, looks like your upload landed in the end:

  https://bugs.debian.org/926700#31

Regards,

---

From: Moritz Mühlenhoff <[email-masked]>
Date: Mon, 15 Apr 2019 22:59:19 +0200

> also prepare an update for stretch based on this?

I doubt this really warrants a DSA, but could be fixed in the
forthcoming stable update (or we postpone it for the next more
severe Cacti issue)

Cheers,
        Moritz