From: Sune Kloppenborg Jeppesen <jaervosz@gentoo.org.>
To: [email protected]Subject: [ GLSA 200508-07 ] AWStats: Arbitrary code execution using malicious Referrer information
Date: Tue, 16 Aug 2005 07:15:51 +0200
User-Agent: KMail/1.8.1
Cc: [email protected], [email protected],
[email protected]
Organization: Gentoo Linux Security Team
X-GPG-Key: http://home.coming.dk/skj.pub.gpg
MIME-Version: 1.0
Content-Type: multipart/signed;
boundary="nextPart1228729.R0VdVIhLaF";
protocol="application/pgp-signature";
micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <200508160715.57134.jaervosz@gentoo.org.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
--nextPart1228729.R0VdVIhLaF
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200508-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: AWStats: Arbitrary code execution using malicious Referrer
information
Date: August 16, 2005
Bugs: #102145
ID: 200508-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
AWStats fails to validate certain log input, which could lead to the
execution of arbitrary Perl code during the generation of the
statistics.
Background
==========
AWStats is an advanced log file analyzer and statistics generator. In
HTTP reports it parses Referrer information in order to display the
most common Referrer values that caused users to visit the website.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-www/awstats < 6.5 >= 6.5
Description
===========
When using a URLPlugin, AWStats fails to sanitize Referrer URL data
before using them in a Perl eval() routine.
Impact
======
A remote attacker can include arbitrary Referrer information in a HTTP
request to a web server, therefore injecting tainted data in the log
files. When AWStats is run on this log file, this can result in the
execution of arbitrary Perl code with the rights of the user running
AWStats.
Workaround
==========
Disable all URLPlugins in the AWStats configuration.
Resolution
==========
All AWStats users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-www/awstats-6.5"
Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.
References
==========
[ 1 ] CAN-2005-1527
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1527
[ 2 ] iDEFENSE Advisory
http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200508-07.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
--nextPart1228729.R0VdVIhLaF
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQBDAXaNzKC5hMHO6rkRAqrZAJ4uJM5j72WKfphbFt0fZIRFBcJTHQCfb4J8
Wg6EJBjDcTZpwtGXpUNa80c=
=TWmN
-----END PGP SIGNATURE-----
--nextPart1228729.R0VdVIhLaF--
