Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?

[Thom Craver <tcraver () corp-com com>]

Jamie Pratt wrote:

> Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. 
> same error. So.. Can we all agree that 6.3 is not vulnerable, because 
> I'd rather not upgrade to a dev/unstable release for no reason...

I can confirm the bug on 6.3 running Apache 2.0.52.

Furthermore, ANY system command inserted in the system() call can be 
executed.  This is a very serious bug.  Unpriviledged user or not, with 
an  .rhosts file on a potential attacker's end, scp would work just 
nicely, then a chmod, then execution of any script they wanted to upload. 

This issue is not to be taken lightly.

Until this issue is resolved, we have commented out the Plugin lines:
# AWStats output is replaced by a plugin output
if ($PluginMode) {
      my $function="BuildFullHTMLOutput_$PluginMode()";
      eval("$function");
      if ($? || $@) { error("$@"); }
      &html_end(0);
      exit 0;
}

If a plugin is called, it is apparently ignored and the stats are displayed.

--
Thom Craver
Corporate Communications, Inc.
www.corp-com.com
585.262.3430