FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

awstats -- arbitrary commands execution vulnerability

Affected packages
		awstats	<	7.0,1
0	<	awstats-devel

Details

VuXML ID	ce6ce2f8-34ac-11e0-8103-00215c6a37bb
Discovery	2010-05-01
Entry	2011-02-10

Awstats change log reports:

Security fix (Traverse directory of LoadPlugin)

Security fix (Limit config to defined directory to avoid access to external config file via a nfs or webdav link).

[source]

References

CVE Name	CVE-2010-4367
URL	http://awstats.sourceforge.net/docs/awstats_changelog.txt
URL	http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html