102145 2005-08-11 11:09 0000 net-www/awstats ShowInfoURL Remote Command Execution Vulnerability (CAN-2005-1527) 2005-08-26 06:09:10 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities&flashstatus=false B1? [glsa] P2 major --- 1 jaervosz@gentoo.org security@gentoo.org frederic.mangeant@gmail.com ka0ttic@gentoo.org rockoo@gmail.com web-apps@gentoo.org jaervosz@gentoo.org 2005-08-11 11:09:47 0000 II. DESCRIPTION Remote exploitation of an input validation vulnerability in AWStats allows remote attackers to execute arbitrary commands. AWStats is a logfile analysis tool that generates reports for ftp, mail and web traffic. The problem specifically exists because of insufficient input filtering before passing user-supplied data to an eval() function. As part of the statistics reporting function, AWStats displays information about the most common referrer values that caused users to visit the website. The referrer data is used without proper sanitation in an eval() statement, resulting in the execution of arbitrary perl code. Shown as follows, the $url parameter contains unfiltered user-supplied data that is used in a call to the Perl routine eval() on lines 4841 and 4842 of awstats.pl (version 6.4): my $function="ShowInfoURL_$pluginname('$url')"; eval("$function"); The malicious referrer value will be included in the referrer statistics portion of the AWStats report after AWStats has been run to generate a new report including the tainted data. Once a user visits the referrer statistics page, the injected perl code will execute with permissions of the web service. III. ANALYSIS Successful exploitation results in the execution of arbitrary commands with permissions of the web service. Exploitation will not occur until the stats page has been regenerated with the tainted referrer values from the http access log. Note that AWStats is only vulnerable in situations where at least one URLPlugin is enabled. AWStats is a very commonly used web statistics reporting package. Since this attack does not require special privileges, it is recommended that users update AWStats to the latest available package. IV. DETECTION iDEFENSE Labs has confirmed the existence of this vulnerability in AWStats 6.4. All earlier versions are suspected vulnerable. AWStats 6.5 has been released since the initial research on this vulnerability. AWStats 6.5 has replaced all eval() statements, and has mitigated the exposure to this vulnerability. jaervosz@gentoo.org 2005-08-11 11:11:45 0000 web-apps please advise and bump as necessary. ka0ttic@gentoo.org 2005-08-12 10:05:10 0000 6.5 in cvs, x86 stable. ppc when you stable, if you can, please remove the vulnerable ebuilds (6.3-r2 and 6.4). Thanks. koon@gentoo.org 2005-08-12 10:40:12 0000 In fact this could be considered B2 as it's a passive attack. But since logs generation is often automatized... I don't know :) hansmi@gentoo.org 2005-08-13 00:28:26 0000 Stable on ppc. jaervosz@gentoo.org 2005-08-15 22:23:52 0000 GLSA 200508-07 frederic.mangeant@gmail.com 2005-08-26 05:07:49 0000 Hi it looks like AWStats 6.5 is not out yet, I've just received this from the author : "AWStats 6.5 Beta is ready This new version is not ready for a production use. It is just a beta release. AWStats 6.5 beta contains bug fixes and new features" koon@gentoo.org 2005-08-26 05:58:29 0000 Yes, this is quite confusing. Apparently upstream uses the same versioning for alphas, betas and releases... ka0ttic, comments ? ka0ttic@gentoo.org 2005-08-26 06:09:10 0000 if he doesnt want it used in production then he needs to push the security updates to a stable release. this is rediculous IMO.