diff --git a/cacti.spec b/cacti.spec index 8c0121b..de88c3c 100644 --- a/cacti.spec +++ b/cacti.spec @@ -1,6 +1,6 @@ Name: cacti Version: 0.8.6j -Release: 8%{?dist} +Release: 9%{?dist} Summary: An rrd based graphing tool Group: Applications/System @@ -13,6 +13,11 @@ Source3: cacti.README.Fedora Patch1: cacti-0.8.6h-dbcfg.patch Patch2: CVE-2007-3112.patch +Patch3: ping_php_version4_snmpgetnext.patch +Patch4: tree_console_missing_hosts.patch +Patch5: thumbnail_graphs_not_working.patch +Patch6: graph_debug_lockup_fix.patch +Patch7: snmpwalk_fix.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -34,6 +39,11 @@ used to creating traffic graphs with MRTG. %setup -q %patch1 -p0 %patch2 -p3 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 echo "#*/5 * * * * cacti %{_bindir}/php %{_datadir}/%{name}/poller.php > /dev/null 2>&1" >cacti.cron @@ -105,6 +115,9 @@ fi %attr(0644,root,root) %{_localstatedir}/lib/%{name}/lib %changelog +* Fri Sep 21 2007 Mike McGrath - 0.8.6j-9 +- Added rest of official patches + * Fri Sep 14 2007 Mike McGrath - 0.8.6j-8 - Fix for CVE-2007-3112 bz#243592 diff --git a/dec06-vulnerability-poller-0.8.6i.patch b/dec06-vulnerability-poller-0.8.6i.patch deleted file mode 100644 index f19c555..0000000 --- a/dec06-vulnerability-poller-0.8.6i.patch +++ /dev/null @@ -1,137 +0,0 @@ -diff -ruBbd cacti-0.8.6i/cmd.php cacti-0.8.6i-patch/cmd.php ---- cacti-0.8.6i/cmd.php 2006-10-09 00:06:00.000000000 -0400 -+++ cacti-0.8.6i-patch/cmd.php 2007-01-01 12:27:15.328125000 -0500 -@@ -26,7 +26,7 @@ - */ - - /* do NOT run this script through a web browser */ --if (!isset($_SERVER["argv"][0])) { -+if (!isset($_SERVER["argv"][0]) || isset($_SERVER['REQUEST_METHOD']) || isset($_SERVER['REMOTE_ADDR'])) { - die("
This script is only meant to run at the command line."); - } - -@@ -70,6 +71,10 @@ - $print_data_to_stdout = false; - if ($_SERVER["argc"] == "3") { - if ($_SERVER["argv"][1] <= $_SERVER["argv"][2]) { -+ /* address potential exploits */ -+ input_validate_input_number($_SERVER["argv"][1]); -+ input_validate_input_number($_SERVER["argv"][2]); -+ - $hosts = db_fetch_assoc("select * from host where (disabled = '' and " . - "id >= " . - $_SERVER["argv"][1] . -diff -ruBbd cacti-0.8.6i/copy_cacti_user.php cacti-0.8.6i-patch/copy_cacti_user.php ---- cacti-0.8.6i/copy_cacti_user.php 2006-10-09 00:06:00.000000000 -0400 -+++ cacti-0.8.6i-patch/copy_cacti_user.php 2007-01-01 12:27:15.312500000 -0500 -@@ -25,9 +25,10 @@ - */ - - /* do NOT run this script through a web browser */ --if (! isset($_SERVER["argv"][0])) { -- die("This script is only meant to run at the command line.\n"); -+if (!isset($_SERVER["argv"][0]) || isset($_SERVER['REQUEST_METHOD']) || isset($_SERVER['REMOTE_ADDR'])) { -+ die("
This script is only meant to run at the command line."); - } -+ - if (empty($_SERVER["argv"][2])) { - die("\nSyntax:\n php copy_cacti_user.php