Description
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.7b-1 | — |
| Debian 13 | cacti | 0.8.7b-1 | — |
| Debian 12 | cacti | 0.8.7b-1 | — |
References
- FEDORA-2008-1737 vendor-advisory
- 29242 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=432758
- 3657 third-party-advisory
- SUSE-SR:2008:005 vendor-advisory
- GLSA-200803-18 vendor-advisory
- 28872 third-party-advisory
- MDVSA-2008:052 vendor-advisory
- http://www.cacti.net/release_notes_0_8_7b.php
- 29274 third-party-advisory
- 20080212 cacti -- Multiple security vulnerabilities have been discovered mailing-list
- ADV-2008-0540 vdb-entry
- 27749 vdb-entry
- 28976 third-party-advisory
- FEDORA-2008-1699 vendor-advisory
- 1019414 vdb-entry
- 20080212 Cacti 0.8.7a Multiple Vulnerabilities mailing-list