FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

awstats -- arbitrary command execution

Affected packages
		awstats	<	6.4

Details

VuXML ID	fdad8a87-7f94-11d9-a9e7-0001020eed82
Discovery	2005-02-10
Entry	2005-02-16
Modified	2005-02-23

Several input validation errors exist in AWStats that allow a remote unauthenticated attacker to execute arbitrary commands with the priviliges of the web server. These programming errors involve CGI parameters including loadplugin, logfile, pluginmode, update, and possibly others.

Additionally, the debug and other CGI parameters may be used to cause AWStats to disclose AWStats and system configuration information.

References

Bugtraq ID	12543
Bugtraq ID	12545
CVE Name	CVE-2005-0362
CVE Name	CVE-2005-0363
CVE Name	CVE-2005-0435
CVE Name	CVE-2005-0436
CVE Name	CVE-2005-0437
CVE Name	CVE-2005-0438
Message	20050214081040.3370.qmail@www.securityfocus.com
URL	http://awstats.sourceforge.net/docs/awstats_changelog.txt
URL	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488
URL	http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf