Bug 17730 - cacti new security issue CVE-2016-2313
Summary: cacti new security issue CVE-2016-2313
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/675369/
Whiteboard: has_procedure advisory MGA5-64-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-02-10 20:51 CET by David Walser
Modified: 2016-02-17 20:21 CET (History)
4 users (show)

See Also:
Source RPM: cacti-0.8.8f-1.2.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-02-10 20:51:06 CET
A CVE has been assigned for a security issue fixed upstream in cacti:
http://openwall.com/lists/oss-security/2016/02/10/5

Patched packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated cacti package fixes security vulnerability:

Authentication using web authentication as a user not in the cacti database
allows complete access (CVE-2016-2313).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2313
http://openwall.com/lists/oss-security/2016/02/10/5
========================

Updated packages in core/updates_testing:
========================
cacti-0.8.8f-1.3.mga5

from cacti-0.8.8f-1.3.mga5.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2016-02-10 20:51:31 CET
Procedure in bug 13930

Whiteboard: (none) => has_procedure

Comment 2 Len Lawrence 2016-02-11 18:08:53 CET
mga5  x86_64  Mate

Having been involved with cacti testing before thought it worth a try.

# urpmi mysql
# systemctl start mysqld.service
# urpmi cacti                      = cacti-0.8.8f-1.2

As user:

$ mysqladmin --user=root create cacti
$ mysql cacti < cacti.sql
cacti.sql: No such file or directory.
$ sudo updatedb
$ locate cacti.sql
/usr/share/cacti/sql/cacti.sql
$ mysql cacti < /usr/share/cacti/sql/cacti.sql
[mysql]> GRANT ALL ON cacti.* TO lcl@localhost IDENTIFIED BY 'rumpelstiltskin';
[mysql]> flush privileges;

As root:

# cd /usr/share/cacti/
# ln -s ../../../var/log/cacti log
And this is where I discovered that it has to be a real user...
# chown -R lcl rra/ log/ 
# edit config.php
// relevant sections here:
/* make sure these values refect your actual database/host/user/password */
$database_type = "mysql";
$database_default = "cacti";
$database_hostname = "localhost";
$database_username = "lcl";
$database_password = "rumpelstiltskin";
$database_port = "3306";
$database_ssl = false;

/*
   Edit this to point to the default URL of your Cacti install
   ex: if your cacti install as at http://serverip/cacti/ this
   would be set to /cacti/
*/
$url_path = "/usr/share/cacti/";

/* Default session name - Session name must contain alpha characters */
$cacti_session_name = "Cacti";
$config["library_path"] = '/usr/share/cacti/lib';
$config["rra_path"] = '/var/lib/cacti';
$config['url_path'] = '/cacti/';

# locate poller.php
/usr/share/cacti/poller.php
/usr/share/cacti/lib/api_poller.php
/usr/share/cacti/lib/poller.php
# edit /etc/crontab
Added the line:
*/5 * * * * lcl php /usr/share/cacti/poller.php > /dev/null 2>&1
But not sure of the cacti path....
Quote: "your full Cacti path".

Pointed firefox at http://localhost/usr/share/cacti/
and raised a 404 error, Not Found.

Have to give up on this - cannot even get to first base.

CC: (none) => tarazed25

Comment 3 William Kenney 2016-02-11 19:37:25 CET
IMO this is an on going issue with cacti. The procedures are not written
detailed enough to "get to first base". They assume you are a seasoned
user of cacti. The procedure(s) should be written such that a complete
novice can start from a blank sheet and get to "first base".
The error I get is:
FATAL: Cannot connect to MySQL server on 'localhost'. Please make sure you have specified a valid MySQL database name in '/etc/cacti.conf'

CC: (none) => wilcal.int

Comment 4 Len Lawrence 2016-02-11 19:57:55 CET
+1
And well versed in mysql syntax and terminology.
I agree that the tests could be better outlined; there are ambiguities as they stand.
Comment 5 Len Lawrence 2016-02-11 20:31:31 CET
I vaguely remembered that phpmyadmin is needed in this context.  It was missing but installing it did not help.  404 error again in firefox.
Comment 6 Len Lawrence 2016-02-11 20:41:37 CET
@wilcal comment #3.  /etc/cacti.conf specifies the default 'cacti' so it is puzzling that it cannot find your database.  The mysql commands seem to work OK; the commands all return "Query OK".  However, I am going to try them again with certain items quoted.
Comment 7 William Kenney 2016-02-11 20:58:57 CET
Here are my notes for testing this:

Procedures can be found at:
http://www.cacti.net/downloads/docs/html/unix_configure_cacti.html

Once installed you can browse to http://localhost/cacti and look at the graphs,
use the console to add more graphs or other devices.

install: cacti mariadb & phpmyadmin

Install and setup mariadb
In root terminal: systemctl start mysqld.service
Set password to: cactiuser
[root@localhost wilcal]# mysqladmin -u root password
type password "cactiuser" twice
localhost/phpmyadmin
user: root
PW: cactiuser
remember password

# mysql -p cacti < /usr/share/cacti/sql/cacti.sql

Edited /usr/share/cacti/include/config.php to add the database details.
Defaults to database cacti, user cactiuser, password cactiuser.
Comment 8 Len Lawrence 2016-02-11 22:53:04 CET
This just gets worse.  I moved to the machine which I had used before for cacti,
reinstalled cacti and ...

# systemctl start mysqld.service
# mysqladmin -u root password
mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'root'@'localhost' (using password: NO)'

Going back to the other machine to try to reset the root password.
Comment 9 Len Lawrence 2016-02-11 23:28:57 CET
[root@belexeuli lcl]# mysqladmin -u root password
New password: 
Confirm new password: 

That worked but...
[root@belexeuli lcl]# mysql cacti < /usr/share/cacti/sql/cacti.sql
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

$ exit
[lcl@belexeuli qa]$ mysql
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

Right.  Searched around for a mysql configuration file and found a likely one in /etc - /etc/my.cnf

At the start was this stanza:

# The following options will be passed to all MySQL clients
[client]
user            = root
#password        = your-password-here
port            = 3306
socket          = /var/lib/mysql/mysql.sock

Uncommented password and replaced the dummy string by the actual password and away it went, back to square one.

Granted access to cacti for lcl with my login password but web access still failed.
Comment 10 Len Lawrence 2016-02-11 23:30:04 CET
The question is: does a user have to have a mysql password set?
Comment 11 Len Lawrence 2016-02-11 23:36:15 CET
[lcl@belexeuli ~]$ mysqladmin -u lcl password
mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'lcl'@'localhost' (using password: YES)'
[lcl@belexeuli ~]$ sudo mysqladmin -u lcl password
mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'lcl'@'localhost' (using password: YES)'
Comment 12 David Walser 2016-02-12 19:24:09 CET
OpenSuSE has issued an advisory for this today (February 12):
http://lists.opensuse.org/opensuse-updates/2016-02/msg00077.html

URL: (none) => http://lwn.net/Vulnerabilities/675369/

Comment 13 Lewis Smith 2016-02-13 12:59:25 CET
Testing M5 x64 with MariaDB (for MySQL)

I already have Cacti installed & operational - within my meagre knowledge of how to drive it.

The update to cacti-0.8.8f-1.3.mga5 was without incident.
http://localhost/cacti/ admin login, view graphs, user management all appeared to function as usual. (Which includes things not working as hoped due to lack of know-how).

@Len @Bill
I will try & find my own instructions in Bugzilla for installing this thing & getting it working. Bill already found the main thing:
 http://www.cacti.net/downloads/docs/html/unix_configure_cacti.html

CC: (none) => lewyssmith
Whiteboard: has_procedure => has_procedure MGA5-64-OK

Comment 14 Lewis Smith 2016-02-13 13:21:48 CET
How to install Cacti for MySQL/MariaDB (re-hash from Bug 16202 Comment 11).
-------------------------------------
[I found all the instructions/procedures referred to directly & indirectly previously more confusing than helpful.
In
 http://www.cacti.net/downloads/docs/html/unix_configure_cacti.html
steps 6/7 in particular do not seem necessary, and I could not find any of the configuration elements cited.
In
 https://bugs.mageia.org/show_bug.cgi?id=13930#c4
the /etc/my.cnf note did not seem necessary].

1) Install Cacti (and its dependancies). This pre-defines in /etc/cacti.conf
 $database_type = "mysql";
 $database_default = "cacti";
 $database_hostname = "localhost";
 $database_username = "cactiuser";
 $database_password = "cactiuser";
It is OK to leave these as they are, but define different values if you wish.

2) For MariaDB/MySQL, either from its command line or phpMyAdmin
- Create a database user 'cactiuser' [or whatever];
- Assign its password 'cactiuser' [or whatever];
- Create a database 'cacti';

3) Import the issued Cacti database:
 # mysql -p cacti < /usr/share/cacti/sql/cacti.sql

4) Make sure the cactiuser user has all rights; if you have database connection problems, try:
 mysql> GRANT ALL ON cacti.* TO cactiuser@localhost IDENTIFIED BY 'cactiuser';
 mysql> flush privileges;

5) Go to http://localhost/cacti/
and click through the initial configuration confirmation. There is a pre-defined Cacti user 'admin' with the same password initially, which you are forced to change at your first login. Do that, note it! This URL is the entry to Cacti.

You do not seem to have to do anything for Cacti to work, other than leaving it running long enough to have graphs to view (View your new graphs). It produces a few basic graphs without having to add anything. You can play with it sooner by logging in, defining data sources etc as invited on the basic Console screen.

System Utilities/View Cacti Log File showed disconcerting cron-related errors, which did not seem to matter however.
Comment 15 claire robinson 2016-02-15 13:14:22 CET
Well done Lewis. Validating. Advisory uploaded.

Please push to 5 updates, thanks.

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-64-OK => has_procedure advisory MGA5-64-OK
CC: (none) => sysadmin-bugs

Comment 16 Mageia Robot 2016-02-17 20:21:53 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0068.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.