Bug#378960: [Pkg-awstats-devel] Bug#378960: awstats: CVE-2006-3681 CVE-2006-3682: multiple vulnerabilities

[Charles Fry]

Hi Laurent,

Can you please comment on these vulnerabilities, especially
CVE-2006-3681? Are these fixed in 6.6? When do you expect to release
6.6?

thanks,
Charles

-----Original Message-----
> From: Alec Berryman <alec at thened.net>
> Subject: [Pkg-awstats-devel] Bug#378960: awstats: CVE-2006-3681
> 	CVE-2006-3682: multiple vulnerabilities
> Date: Wed, 19 Jul 2006 22:32:54 -0400
> To: Debian Bug Tracking System <submit at bugs.debian.org>
> Reply-To: Alec Berryman <alec at thened.net>, 378960 at bugs.debian.org
> 
> Package: awstats
> Version: 6.5-2
> Severity: serious
> Tags: security
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> CVE-2006-3681: "Multiple cross-site scripting (XSS) vulnerabilities in
> awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers
> to inject arbitrary web script or HTML via the (1) refererpagesfilter,
> (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5)
> hostfilter, or (6) hostfilterex parameters, a different set of vectors
> than CVE-2006-1945."
> 
> CVE-2006-3682: "awstats.pl in AWStats 6.5 build 1.857 and earlier allows
> remote attackers to obtain the installation path via the (1) year, (2)
> pluginmode or (3) month parameters."
> 
> I have not verified either vulnerability.  The original advisory [1]
> has sample exploits.
> 
> This is not the same as #364443 or #365909.  Sarge is probably affected.
> 
> Please mention the CVEs in your changelog.
> 
> Thanks,
> 
> Alec
> 
> [1] http://pridels.blogspot.com/2006/04/awstats-65x-multiple-vuln.html
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (GNU/Linux)
> 
> iD8DBQFEvutWAud/2YgchcQRAnO4AJkBYfNZSWE6zHKPGArOpX3eNnH9AwCfYtf7
> 5nTPB7EkA5xCCZLPv6xgF7I=
> =AN2l
> -----END PGP SIGNATURE-----
> 
> 
> _______________________________________________
> Pkg-awstats-devel mailing list
> Pkg-awstats-devel at lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-awstats-devel

-- 
Unless
Your face
Is stinger free
You'd better let
Your honey be
Burma-Shave
http://burma-shave.org/jingles/1951/unless
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-awstats-devel/attachments/20060719/d297435d/attachment.pgp