Subject: [Pkg-cacti-maint] Bug#561339: marked as done (CVE-2009-4112: arbitrary command execution)

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sun, 28 Oct 2018 16:09:09 +0000

Your message dated Sun, 28 Oct 2018 16:04:13 +0000
with message-id <[email-masked]>
and subject line Bug#561339: fixed in cacti 1.2.0~beta2+ds1-1
has caused the Debian Bug report #561339,
regarding CVE-2009-4112: arbitrary command execution
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
561339: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=561339
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: CVE-2009-4112: arbitrary command execution
From: Steffen Joeris <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Wed, 16 Dec 2009 12:40:03 +0100

Package: cacti
Severity: grave
Tags: security

Hi Sean

the following CVE (Common Vulnerabilities & Exposures) id was
published for cacti.

CVE-2009-4112[0]:
| Cacti 0.8.7e and earlier allows remote authenticated administrators to
| gain privileges by modifying the "Data Input Method" for the "Linux -
| Get Memory Usage" setting to contain arbitrary commands.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

As discussed with upstream, please make sure that there is a whitelist
policy in place for squeeze.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4112
    http://security-tracker.debian.org/tracker/CVE-2009-4112

Subject: Bug#561339: fixed in cacti 1.2.0~beta2+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sun, 28 Oct 2018 16:04:13 +0000

Source: cacti
Source-Version: 1.2.0~beta2+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sun, 28 Oct 2018 16:00:51 +0100
Source: cacti
Binary: cacti
Architecture: source
Version: 1.2.0~beta2+ds1-1
Distribution: experimental
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 561339 903238
Changes:
 cacti (1.2.0~beta2+ds1-1) experimental; urgency=medium
 .
   * New upstream release 1.2.0-beta1
   * CVE-2009-4112: remote authenticated administrators can gain
     privileges; circumvented via optional whitelisting (Closes: #561339)
   * Refresh patches
   * Drop most of
     enable-system-jqueryui-by-putting-cacti-changes-in-main.css.patch
   * Bump Standards to 4.2.1
   * Bump debhelper compat level
   * [tests] Add mysql-server test back but with
     skip-not-installable. Debian has mariadb-server as
     default-mysql-server so we definitely want to test that. Ubuntu has
     mysql-server, so we also want to test that, but that isn't in
     testing. (Closes: #903238)
   * Drop recursive chown from postins (thanks lintian)
   * Add perl-path.patch to make sh-bang in perl scripts compliant with
     policy (thanks lintian)
   * Add font-awesome-path.patch as the path to the css is slightly
     different in the system version
   * Add fix-update-for-beta-versions.patch to ensure updating works
   * Adapt documentation building as upstream reworked it completely
Checksums-Sha1:
 2c0a9d7841c3448a4b2b5259eeaa929dd8eccfe6 2152 cacti_1.2.0~beta2+ds1-1.dsc
 ab6fbdd7a857da97e278f1d89e65a0d55275cba0 4161168 cacti_1.2.0~beta2+ds1.orig-docs-source.tar.gz
 aa448ec41b5517b85bbe05eec4beb63722da3ae6 4185048 cacti_1.2.0~beta2+ds1.orig.tar.gz
 99cd7edf3304c48dd4ae0be84f616ace23375c6b 52920 cacti_1.2.0~beta2+ds1-1.debian.tar.xz
Checksums-Sha256:
 60676a146e80eae62588ddcd906f86f51a1457968ceb959fe5a6c2aeb9616100 2152 cacti_1.2.0~beta2+ds1-1.dsc
 54e2c07d72b51f8a63a2da516783cceda5997d0f571a61a9f002190127d2cc89 4161168 cacti_1.2.0~beta2+ds1.orig-docs-source.tar.gz
 938e32b8a40caf369dc365c01281a51d2f927241eb1fb4db850f03828cae8847 4185048 cacti_1.2.0~beta2+ds1.orig.tar.gz
 581673d9c075f8ed46cc3894b26b8e25a4ac7b8dab78ef1fb1a753883ff88732 52920 cacti_1.2.0~beta2+ds1-1.debian.tar.xz
Files:
 ed51ae07d31cf9f18b91bd280ee9d235 2152 web optional cacti_1.2.0~beta2+ds1-1.dsc
 30e4988930d401b24693fa8ba862de73 4161168 web optional cacti_1.2.0~beta2+ds1.orig-docs-source.tar.gz
 c92c523912624d7c14b2b2e1ddf3b7c7 4185048 web optional cacti_1.2.0~beta2+ds1.orig.tar.gz
 7f1441859db6079547fac87a506f6778 52920 web optional cacti_1.2.0~beta2+ds1-1.debian.tar.xz