- observium - lists.observium.org

SQL Injection?
by Hamilton, Kent 05 Oct '20

05 Oct '20

I noted these on this weeks CERT vulnerability report have they been addressed? I don't see anything about them on the mailing list, site or bug tracker, I could have overlooked them I guess. observium -- observium An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username[0] to the default URI, because of includes/authenticate.inc.php. 2020-09-25 7.5<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMzcsInVy…> CVE-2020-25147<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMzgsInVy…> MISC<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMzksInVy…> observium -- observium An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php. 2020-09-25 7.5<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxNDAsInVy…> CVE-2020-25132<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxNDEsInVy…> MISC<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxNDIsInVy…> ________________________________ This e-mail and any documents accompanying it may contain legally privileged and/or confidential information belonging to Exegy, Inc. Such information may be protected from disclosure by law. The information is intended for use by only the addressee. If you are not the intended recipient, you are hereby notified that any disclosure or use of the information is strictly prohibited. If you have received this e-mail in error, please immediately contact the sender by e-mail or phone regarding instructions for return or destruction and do not use or disclose the content to others.

2 3

observium distributed
by Arnoldo Vidal Bravo 02 Oct '20

02 Oct '20

We are configuring and testing observium distributed.... it works fine !, but when i add a new device on web interface i must check skip ICMP echo checks. if not i get a message Could not ping X.X.X.X in observium main config.php is installed fping 3-10 $config['fping'] = "usr/local/sbin/fping"; in poller too is installed fping 3-10 $config['fping'] = "usr/local/sbin/fping"; -- Saluda cordialmente

3 4

Aggregated graphs howto?
by José Manuel Giner 01 Oct '20

01 Oct '20

Hello we've just installed Observium Premium. it's possible to create aggregated graphs? We want to put in the same graph different network ports. and can make the graph public? or can we automate to download the graph image? Thanks! -- José Manuel Giner https://ginernet.com

1 0

SNMP timeout adjustment
by Lars Joergensen 01 Oct '20

01 Oct '20

Hi I get "WARNING! Ports snmpwalk did not complete. Try to increase SNMP timeout on the device properties page." on one of my devices. Then I went to the device page and entered "300" as SNMP timeout, hit save and got told "Device SNMP configuration update is not required". What's next? Best regards Lars Joergensen IT Manager - Network Team - Global IT Chr. Hansen A/S - Boege Alle 10-12 - 2970 Hoersholm - Denmark Phone: +45 52 18 05 22 dklarj(a)chr-hansen.com<mailto:dklarj@chr-hansen.com> - www.chr-hansen.com<http://www.chr-hansen.com/> [cid:image001.gif@01D690BF.ECC49DB0] ________________________________ Disclaimer: This e-mail, including any attachments, is for the intended recipient only. If you have received this e-mail by mistake please notify the sender immediately by return e-mail and delete this e-mail and any attachments, without opening the attachments, from your system. Access, disclosure, copying, distribution or reliance on any part of this e-mail by anyone else is prohibited. This e-mail is confidential and may be legally privileged. Chr. Hansen does not represent and/or warrant that the information sent and/or received by or with this e-mail is correct and does not accept any liability for damages related thereto. https://www.chr-hansen.com/en/legal-notice

3 4

RRD max value
by Marian Rychtecky 01 Oct '20

01 Oct '20

Hi all, I would like to ask you for help in order to resolve an issue with RRD. I do have port-channel with max speed of 400Gbit/s (correctly detected by Observium), however when traffic will reach 100G it will not be shown. I believe there is max limit on that RRD, as some other port-channels works good. Of course I don't want to loose history if possible. Other monitoring systems using same MIBs are working as expected. Not working one: Working one (different host): Thank you Marian -- Marian Rychtecký mr(a)nix.cz Phone +420 724 397 441 NIX.CZ z.s.p.o. Americká 23, Praha 2 130 52 Czech Republic http://www.nix.cz

2 1

Sensor blues
by Lars Joergensen 01 Oct '20

01 Oct '20

Hi I'm having trouble with sensors on SFPs in Aruba switches. Looking at the switch, I get this: Transceiver in 3/49 Interface Index : 155 Type : SFP+LR Model : J9151A Connector Type : LC Wavelength : 1310nm Transfer Distance : 10.0km (9um), Diagnostic Support : DOM Serial Number : AX07SL0130407 Status Temperature : 26.289C Voltage : 3.3408V Tx Bias : 41.728mA Tx Power : 0.6339mW, -1.980dBm Rx Power : 0.4225mW, -3.742dBm But looking in Observium, I get this: [cid:image002.png@01D697E4.402E6B90] There's no data for RX power (which is the most interesting) and the data for TX power is wrong. I think this is an OEM SFP (the serial number looks weird), but if the switch can see the data, shouldn't Observium be able to pull it too? Temperature, voltage and current graphs are correct. ... and just now, when I clicked around, the correct values are now showing for TX and RX power in the graphs. What's going on? Lars ________________________________ Disclaimer: This e-mail, including any attachments, is for the intended recipient only. If you have received this e-mail by mistake please notify the sender immediately by return e-mail and delete this e-mail and any attachments, without opening the attachments, from your system. Access, disclosure, copying, distribution or reliance on any part of this e-mail by anyone else is prohibited. This e-mail is confidential and may be legally privileged. Chr. Hansen does not represent and/or warrant that the information sent and/or received by or with this e-mail is correct and does not accept any liability for damages related thereto. https://www.chr-hansen.com/en/legal-notice

1 0

Re: [Observium] MariaDB upgrade
by Scott Driemeier-Showers 30 Sep '20

30 Sep '20

We upgraded from MariaDB 5.5.65 to 10.3.23-1 on CentOS 7.8 at the end of July following the steps given here: https://www.liquidweb.com/kb/how-to-upgrade-mariadb-5-5-to-mariadb-10-0-on-…

1 0

MariaDB upgrade
by Edvinas Kairys 30 Sep '20

30 Sep '20

Hello, Could someone provide a guide on Centos to upgrade MariaDB from 5.5 to 10.x ? Thanks

2 1

Observium deleting switch entries instead of alerting
by Pisano, Anthony D. 30 Sep '20

30 Sep '20

Hello, I ran into a weird situation today that I’m unsure of how to proceed with. Due to a power failure we lost power to 3 of 4 switches in a Cisco 9300 Stack. At 10:57am yesterday in the event log of this switch I can see the OperStatus of the Stack Ports go down. I have an alert configured against the status of “Switch Stack Failure” does not equal OK. However this alert did not go off at the time of the outage, it has for other switch stacks though. Then at 5am this morning the logs of the device indicate it went through and essentially removed switches 2-4 of this stack. We are currently running 20.7.10549. I know we need to update, but our linux team has not gotten around to it. Is there anyway to look into this? Anthony Pisano | Network Design Engineer | IMSS anthony.pisano(a)caltech.edu<mailto:anthony.pisano@caltech.edu> | (626) 395-4255<tel:(626)%20395-4255> | Caltech | caltech.edu<http://caltech.edu/>

1 0

HTML Base tag appears wrong when using IPv6
by Pieter De Wit 29 Sep '20

29 Sep '20

Hi, Yes, this is “wrong” but I have an internal server which happens to have IPv6 and no DNS. If I access my Observium installation using the address, the generated HTML is as follow: <!DOCTYPE html> <html lang="en"> <head> <base href="http://[[2406:xxxx:xxxx:3300::202]]/"/> <meta http-equiv="content-type" content="text/html; charset=utf-8”/> The base setting has double brackets which breaks loading. (Yes, I can override this in the config :) ) Cheers, Pieter

2 1