Nessus Plugin #16427

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200501-36] AWStats: Remote code execution

Family:

Gentoo Local Security Checks

Category:

infos

Copyright:

(C) 2005 Michel Arboi

Summary:

AWStats: Remote code execution

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

GLSA:200501-36

Description:

The remote host is affected by the vulnerability described in GLSA-200501-36
(AWStats: Remote code execution)


When 'awstats.pl' is run as a CGI script, it fails to validate specific
inputs which are used in a Perl open() function call.

Impact

A remote attacker could supply AWStats malicious input, potentially
allowing the execution of arbitrary code with the rights of the web
server.

Workaround

Making sure that AWStats does not run as a CGI script will avoid the
issue, but we recommend that users upgrade to the latest version, which
fixes these bugs.

References:
http://awstats.sourceforge.net/docs/awstats_changelog.txt
http://www.idefense.com/application/poi/display?id=185


Solution:
All AWStats users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-www/awstats-6.3"
Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.


Risk factor : High