Bug#365910: [Pkg-awstats-devel] Bug#365910: AWStats: Malicious config file shell code injection

[Hendrik Weimer]

Charles Fry <debian at frogcircus.org> writes:

> In this case, this report doesn't appear to be an actual security
> vulnerability. The configuration file needs to be placed in
> /etc/awstats, /usr/local/etc/awstats, /etc, or /etc/opt/awstats. This
> can not be done without having root access (nor can the current
> configuration files be modified without root access). Someone with root
> permissions can already execute shell code with broader permissions than
> the webserver, so this "attack" seems like a non-issue to me.

Exploit #2: http://www.example.com/cgi-bin/awstats.pl?configdir=/tmp
with the attached file being placed in /tmp.

Hendrik

-------------- next part --------------
A non-text attachment was scrubbed...
Name: awstats.conf
Type: application/octet-stream
Size: 92 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-awstats-devel/attachments/20060505/33ff2ad6/awstats.obj