bugtraq - Re: AWStats <= 6.4 Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <eb743f98050217110164a4bcc8@mail.gmail.com>
Date: Thu, 17 Feb 2005 14:01:33 -0500
From: Matt Wilder <grewaru@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?


Awstats version 5.6 is not succeptable to this as it does not have the
same plugin architecture.  Could this be a >= 6.0 bug?

Matt


On Wed, 16 Feb 2005 15:52:00 -0500, Micah Brandon <brandon@...com> wrote:
> 
> 
>         I'm going to have to disagree.  Execution of Perl functions
> is still possible in 6.3.  You just have to jimmy it a little and
> try/guess different plugins that may be installed.  I got a hit
> with 'hostinfo'.  Try this on your server:
> 
> http://server/cgi-bin/awstats.pl?config=someconfig&PluginMode=hostinfo+time
> 
>         Unix time shows up just below 'Whois command failed' error message.
> That's game over in my book.
> 
> * Jamie Pratt (jpratt@...wich.edu) [050216 01:19]:
> > Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same
> > error. So.. Can we all agree that 6.3 is not vulnerable, because I'd
> > rather not upgrade to a dev/unstable release for no reason...
> >
> > regards,
> > jamie
> >
> > Herman Sheremetyev wrote:
> > >It works on mine too, though I still have 6.1.  I think you may need to
> > >add the config=www.example.com into the url between the '?' and the '&'
> > >for it to work properly though.  On my linux boxes with apache 2.0 it
> > >displays the command output in the page but on openbsd with apache 1.3
> > >it gives a 500 Server Error because the output ends up in the headers
> > >somehow.  Either way it works though.
> > >
> > >-Herman
> > >
> 
>