<<< Date Index >>>     <<< Thread Index >>>

Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?



Jamie Pratt wrote:

Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same error. So.. Can we all agree that 6.3 is not vulnerable, because I'd rather not upgrade to a dev/unstable release for no reason...

I can confirm the bug on 6.3 running Apache 2.0.52.

Furthermore, ANY system command inserted in the system() call can be executed. This is a very serious bug. Unpriviledged user or not, with an .rhosts file on a potential attacker's end, scp would work just nicely, then a chmod, then execution of any script they wanted to upload.
This issue is not to be taken lightly.

Until this issue is resolved, we have commented out the Plugin lines:
# AWStats output is replaced by a plugin output
if ($PluginMode) {
      my $function="BuildFullHTMLOutput_$PluginMode()";
      eval("$function");
      if ($? || $@) { error("$@"); }
      &html_end(0);
      exit 0;
}

If a plugin is called, it is apparently ignored and the stats are displayed.

--
Thom Craver
Corporate Communications, Inc.
www.corp-com.com
585.262.3430