Locale-Dependent Decimal Corruption in Cacti

Executive Summary

This vulnerability exists in Cacti versions 1.2.30 and below, where the function rrdtool_function_update() improperly handles locale-dependent decimal formatting. Specifically, when the server's locale uses a comma as the decimal separator (such as in de_DE), PHP converts float values like 1.5 into the string "1,5". However, RRDtool expects a period as the decimal separator. Because of this mismatch, metric data can be shifted into incorrect columns or silently dropped, causing data corruption.

The issue arises because the function uses PHP string interpolation without resetting the locale, and it only checks if values are numeric without correcting the decimal format. This leads to a data integrity problem but is not remotely exploitable and requires server locale misconfiguration.

The vulnerability was fixed in Cacti version 1.2.31.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a data integrity issue by corrupting RRDtool metric values due to locale-dependent decimal formatting. However, it is not remotely exploitable and requires server locale misconfiguration.

There is no direct information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing corruption of RRDtool metric values in Cacti. Specifically, metric data may be shifted into wrong columns or silently dropped due to incorrect decimal formatting caused by locale settings.

As a result, the performance and fault management data collected and reported by Cacti may be inaccurate or incomplete, potentially leading to incorrect monitoring insights or decisions.

However, this issue is not remotely exploitable and requires a server locale misconfiguration to occur.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from locale-dependent decimal formatting in the rrdtool_function_update() function in Cacti versions 1.2.30 and below. Detection involves verifying if the server locale is misconfigured to use a comma as the decimal separator (e.g., de_DE) which causes metric corruption.

You can check the current locale settings on your server by running the command:

• locale | grep LC_NUMERIC

If LC_NUMERIC is set to a locale that uses a comma as the decimal separator, such as de_DE, this indicates potential exposure to the vulnerability.

Additionally, reviewing Cacti version can be done by checking the installed version:

• cacti -v

If the version is 1.2.30 or below and the locale is misconfigured, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Cacti to version 1.2.31 or later where the issue has been fixed.

Alternatively, ensure that the server locale LC_NUMERIC is set to use a decimal point (.) as the decimal separator rather than a comma (,). This can be done by setting the locale to en_US or another suitable locale.

• Set the locale temporarily in the shell with: export LC_NUMERIC=en_US.UTF-8
• Or configure the system locale permanently to use a dot as decimal separator.

These steps prevent the locale-dependent decimal formatting issue that corrupts RRDtool metric values.

Useful 0 Not Useful 0