bugtraq - Re: AWStats <= 6.4 Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42135CEB.2070308@corp-com.com>
Date: Wed, 16 Feb 2005 09:47:07 -0500
From: Thom Craver <tcraver@...p-com.com>
To: bugtraq@...urityfocus.com
Subject: Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in
 6.3?

Jamie Pratt wrote:

> Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. 
> same error. So.. Can we all agree that 6.3 is not vulnerable, because 
> I'd rather not upgrade to a dev/unstable release for no reason...

I can confirm the bug on 6.3 running Apache 2.0.52.

Furthermore, ANY system command inserted in the system() call can be 
executed.  This is a very serious bug.  Unpriviledged user or not, with 
an  .rhosts file on a potential attacker's end, scp would work just 
nicely, then a chmod, then execution of any script they wanted to upload. 

This issue is not to be taken lightly.

Until this issue is resolved, we have commented out the Plugin lines:
# AWStats output is replaced by a plugin output
if ($PluginMode) {
       my $function="BuildFullHTMLOutput_$PluginMode()";
       eval("$function");
       if ($? || $@) { error("$@"); }
       &html_end(0);
       exit 0;
}

If a plugin is called, it is apparently ignored and the stats are displayed.

-- 
Thom Craver
Corporate Communications, Inc.
www.corp-com.com
585.262.3430