Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 102145 - net-www/awstats ShowInfoURL Remote Command Execution Vulnerability (CAN-2005-1527)
Summary: net-www/awstats ShowInfoURL Remote Command Execution Vulnerability (CAN-2005-...
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
Whiteboard: B1? [glsa]
Depends on:
Reported: 2005-08-11 11:09 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2005-08-26 06:09 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-08-11 11:09:47 UTC
Remote exploitation of an input validation vulnerability in AWStats  
allows remote attackers to execute arbitrary commands. 
AWStats is a logfile analysis tool that generates reports for ftp, mail  
and web traffic. The problem specifically exists because of  
insufficient input filtering before passing user-supplied data to an  
eval() function. As part of the statistics reporting function, AWStats  
displays information about the most common referrer values that caused  
users to visit the website. The referrer data is used without proper  
sanitation in an eval() statement, resulting in the execution of  
arbitrary perl code. 
Shown as follows, the $url parameter contains unfiltered user-supplied  
data that is used in a call to the Perl routine eval() on lines 4841  
and 4842 of (version 6.4): 
     my $function="ShowInfoURL_$pluginname('$url')"; 
The malicious referrer value will be included in the referrer  
statistics portion of the AWStats report after AWStats has been run to  
generate a new report including the tainted data. Once a user visits  
the referrer statistics page, the injected perl code will execute with  
permissions of the web service. 
Successful exploitation results in the execution of arbitrary commands  
with permissions of the web service. Exploitation will not occur until  
the stats page has been regenerated with the tainted referrer values  
from the http access log. Note that AWStats is only vulnerable in  
situations where at least one URLPlugin is enabled. 
AWStats is a very commonly used web statistics reporting package. Since  
this attack does not require special privileges, it is recommended that  
users update AWStats to the latest available package. 
iDEFENSE Labs has confirmed the existence of this vulnerability in  
AWStats 6.4. All earlier versions are suspected vulnerable. AWStats 6.5  
has been released since the initial research on this vulnerability.  
AWStats 6.5 has replaced all eval() statements, and has mitigated the  
exposure to this vulnerability.
Comment 1 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-08-11 11:11:45 UTC
web-apps please advise and bump as necessary. 
Comment 2 Aaron Walker (RETIRED) gentoo-dev 2005-08-12 10:05:10 UTC
6.5 in cvs, x86 stable.  ppc when you stable, if you can, please remove the
vulnerable ebuilds (6.3-r2 and 6.4).  Thanks.
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2005-08-12 10:40:12 UTC
In fact this could be considered B2 as it's a passive attack. But since logs
generation is often automatized... I don't know :)
Comment 4 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-08-13 00:28:26 UTC
Stable on ppc.
Comment 5 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-08-15 22:23:52 UTC
GLSA 200508-07 
Comment 6 Frederic Mangeant 2005-08-26 05:07:49 UTC

it looks like AWStats 6.5 is not out yet, I've just received this from the author :

"AWStats 6.5 Beta is ready

This new version is not ready for a production use. It is just a beta
release. AWStats 6.5 beta contains bug fixes and new features"
Comment 7 Thierry Carrez (RETIRED) gentoo-dev 2005-08-26 05:58:29 UTC
Yes, this is quite confusing. Apparently upstream uses the same versioning for
alphas, betas and releases...

ka0ttic, comments ?
Comment 8 Aaron Walker (RETIRED) gentoo-dev 2005-08-26 06:09:10 UTC
if he doesnt want it used in production then he needs to push the security
updates to a stable release.  this is rediculous IMO.