Bugtraq mailing list archives
Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?
From: Micah Brandon <brandon () vv com>
Date: Wed, 16 Feb 2005 15:52:00 -0500
I'm going to have to disagree. Execution of Perl functions is still possible in 6.3. You just have to jimmy it a little and try/guess different plugins that may be installed. I got a hit with 'hostinfo'. Try this on your server: http://server/cgi-bin/awstats.pl?config=someconfig&PluginMode=hostinfo+time Unix time shows up just below 'Whois command failed' error message. That's game over in my book. * Jamie Pratt (jpratt () norwich edu) [050216 01:19]:
Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same error. So.. Can we all agree that 6.3 is not vulnerable, because I'd rather not upgrade to a dev/unstable release for no reason... regards, jamie Herman Sheremetyev wrote:It works on mine too, though I still have 6.1. I think you may need to add the config=www.example.com into the url between the '?' and the '&' for it to work properly though. On my linux boxes with apache 2.0 it displays the command output in the page but on openbsd with apache 1.3 it gives a 500 Server Error because the output ends up in the headers somehow. Either way it works though. -Herman
Current thread:
- AWStats <= 6.4 Multiple vulnerabilities GHC (Feb 14)
- Re: AWStats <= 6.4 Multiple vulnerabilities Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Jamie Pratt (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Herman Sheremetyev (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Jamie Pratt (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Thom Craver (Feb 16)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Micah Brandon (Feb 16)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Matt Wilder (Feb 17)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Jamie Pratt (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? twebster (Feb 15)