The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.

This update fixes remote code execution vulnerabilities in awstats.
Since backporting awstats fixes is error prone we have upgraded it to upstream version 6.6, which also includes new features. Security issues fixed: - CVE-2006-2237: missing sanitizing of the 'migrate' parameter. #173041 - CVE-2006-2644: missing sanitizing of the 'configdir' parameter. #173041 - Make sure open() only opens files for read/write by adding explicit < and >.

Hendrik Weimer discovered that specially crafted web requests can cause awstats, a powerful and featureful web server log analyzer, to execute arbitrary commands.

The remote host is affected by the vulnerability described in GLSA-200606-06 (AWStats: Remote execution of arbitrary code)

    Hendrik Weimer has found that if updating the statistics via the     web frontend is enabled, it is possible to inject arbitrary code via a     pipe character in the 'migrate' parameter. Additionally, r0t has     discovered that AWStats fails to properly sanitize user-supplied input     in awstats.pl.
  Impact :

    A remote attacker can execute arbitrary code on the server in the     context of the application running the AWStats CGI script if updating     of the statistics via web frontend is allowed. Nonetheless, all     configurations are affected by a cross-site scripting vulnerability in     awstats.pl, allowing a remote attacker to execute arbitrary scripts     running in the context of the victim's browser.
  Workaround :

    Disable statistics updates using the web frontend to avoid code     injection. However, there is no known workaround at this time     concerning the cross-site scripting vulnerability.

AWStats did not properly sanitize the 'migrate' CGI parameter. If the update of the stats via web front-end is allowed, a remote attacker could execute arbitrary commands on the server with the privileges of the AWStats server.

This does not affect AWStats installations which only build static pages.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running AWStats, a free logfile analysis tool written in Perl.

The version of AWStats installed on the remote host fails to sanitize input to the 'migrate' parameter before passing it to a Perl 'open()' function.  Provided 'AllowToUpdateStatsFromBrowser' is enabled in the AWStats site configuration file, an unauthenticated attacker can exploit this issue to execute arbitrary code on the affected host, subject to the privileges of the web server user id.

The remote host is running AWStats, a CGI log analyzer.  There are various content-parsing flaws in the remote version of this software that would allow an attacker to execute code on the remote host.  An attacker exploiting this flaw would only need to be able to generate HTTP requests to the awstats.pl CGI script.  A successful attack would allow the attacker to run system commands with the privileges of the CGI script.

ID	Name	Product	Family	Severity
27163	openSUSE 10 Security Update : awstats (awstats-1612)	Nessus	SuSE Local Security Checks	medium
22600	Debian DSA-1058-1 : awstats - missing input sanitising	Nessus	Debian Local Security Checks	medium
21667	GLSA-200606-06 : AWStats: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
21588	Ubuntu 5.04 / 5.10 : awstats vulnerability (USN-285-1)	Nessus	Ubuntu Local Security Checks	medium
21328	AWStats migrate Parameter Arbitrary Command Execution	Nessus	CGI abuses	medium
3536	AWStats < 6.6 migrate Variable Command Execution	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-2237

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium