CVE-2014-6262

Python module in RRDtool, used in Zenoss Core before 4.2.5, multiple format string vulnerabilities in rrdtool.graph function (, ZEN-15415)

• CVSS 7.5
• CWE-134 Use of Externally-Controlled Format String
• Memory Corruption
• Remote

Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related issue to CVE-2013-2131.

CVE

CVE-2014-6262

CWE

CWE-134 Use of Externally-Controlled Format String

CVSS base score

7.5

Published

2020-02-12

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Buffer Overflows

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update RRDtool to version 1.4.9 or higher.

import rrdtool

def graph(filename, title, data):
    rrdtool.graph(filename,
                  title=title,
                  data=data)

graph('output.png', 'Sample Graph', 'Data: %s' % 'Sample data')

import rrdtool
import os

def sanitize_filename(filename):
    if '..' in filename or filename.startswith('/'):
        raise ValueError("Invalid filename")
    return filename

def graph(filename, title, data):
    filename = sanitize_filename(filename)
    title = str(title)
    data = str(data)

    try:
        rrdtool.graph(filename,
                      title=title,
                      data=data)
    except rrdtool.OperationalError as e:
        print(f"Error creating graph: {e}")
        return None

graph('output.png', 'Sample Graph', 'Data: %s' % 'Sample data')

@misc{vaitp:cve20146262,
  title        = {{Python module in RRDtool, used in Zenoss Core before 4.2.5, multiple format string vulnerabilities in rrdtool.graph function (, ZEN-15415)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-6262},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-6262/}}
}