[CVE-2007-3112, CVE-2007-3113] post-authentication DoS

Debian Bug report logs - #429224
[CVE-2007-3112, CVE-2007-3113] post-authentication DoS

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: submit@bugs.debian.org

Subject: [CVE-2007-3112, CVE-2007-3113] post-authentication DoS

Date: Sat, 16 Jun 2007 12:58:25 +0200

Package: cacti
Tags: security

Two (apparently) related post-authentication DoS bugs have been
disclosed in cacti:

<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3112>
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3113>

(I'm not sure if those warrant a security update for stable.)

Please mention the respective names in the changelog when fixing these
bugs.

Message #10 received at 429224@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: 429224@bugs.debian.org

Subject: patch for DoS

Date: Fri, 3 Aug 2007 22:23:05 +1000

[Message part 1 (text/plain, inline)]

Hi

I attached an NMU, including upstream's patch to fix this DoS.
Do you want me to upload this NMU or do you want to take care of this 
yourself?
Enjoy the rest of your holidays :)

Cheers
Steffen

[nmu.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 429224@bugs.debian.org (full text, mbox, reply):

From: sean finney <seanius@debian.org>

To: Steffen Joeris <steffen.joeris@skolelinux.de>, 429224@bugs.debian.org

Subject: Re: Bug#429224: patch for DoS

Date: Fri, 3 Aug 2007 18:23:06 +0200

[Message part 1 (text/plain, inline)]

hey steffen,

go ahead and NMU this, i won't have enough time to get to this for another 
week or so otherwise.


thanks,
	sean

On Friday 03 August 2007 02:23:05 pm Steffen Joeris wrote:
> Hi
>
> I attached an NMU, including upstream's patch to fix this DoS.
> Do you want me to upload this NMU or do you want to take care of this
> yourself?
> Enjoy the rest of your holidays :)
>
> Cheers
> Steffen

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 429224-close@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <white@security.skolelinux.no>

To: 429224-close@bugs.debian.org

Subject: Bug#429224: fixed in cacti 0.8.6j-1.1

Date: Fri, 03 Aug 2007 17:47:03 +0000

Source: cacti
Source-Version: 0.8.6j-1.1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive:

cacti_0.8.6j-1.1.diff.gz
  to pool/main/c/cacti/cacti_0.8.6j-1.1.diff.gz
cacti_0.8.6j-1.1.dsc
  to pool/main/c/cacti/cacti_0.8.6j-1.1.dsc
cacti_0.8.6j-1.1_all.deb
  to pool/main/c/cacti/cacti_0.8.6j-1.1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 429224@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steffen Joeris <white@security.skolelinux.no> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri,  3 Aug 2007 19:27:17 +0200
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.6j-1.1
Distribution: unstable
Urgency: high
Maintainer: sean finney <seanius@debian.org>
Changed-By: Steffen Joeris <white@security.skolelinux.no>
Description: 
 cacti      - Frontend to rrdtool for monitoring systems and services
Closes: 429224
Changes: 
 cacti (0.8.6j-1.1) unstable; urgency=high
 .
   * Non-maintainer upload with the permission of the maintainer
   * Fix DoS caused by large values passed to the graph_height,
     graph_width, graph_start and graph_end parameter parameters
     (Closes: #429224) Fixes: CVE-2007-3112, CVE-2007-3113
Files: 
 71970460da70b55e2da32d561d29a68f 581 web extra cacti_0.8.6j-1.1.dsc
 94024d53937adfe7f6e993d7c0102426 32921 web extra cacti_0.8.6j-1.1.diff.gz
 316900d2bed5f3940ba36bc6c5b09ae4 963652 web extra cacti_0.8.6j-1.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGs2do62zWxYk/rQcRAqkqAJ9B2zDYAt1aJmxR2NPep3FfjawlTQCfXG4d
xCsC7W4sOhwzCPy4K5DuzEg=
=EmIB
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.