Overview
A lack of input validation in AWStats may allow a remote attacker to execute arbitrary commands.
Description
AWStats is a Perl CGI script that collects and graphically displays statistics from web, FTP, and mail servers. The configdir parameter, within the awstats.pl Perl script, is supplied user-controlled data and then passed as a parameter to the Perl routine open(). A lack of input validation on the configdir parameter may allow an attacker to compromise a vulnerable server. If an attacker supplies this parameter with arbitrary commands prefixed with the '|' character, those commands will be executed on the server. Please note that according to public reports, this vulnerability is being actively exploited. |
Impact
If a remote attacker supplies AWStats with specially crafted input, that attacker may be able to execute arbitrary commands with the privileges of the attacked server process, in most cases user nobody. |
Solution
Upgrade |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported by iDEFENSE.
This document was written by Jeff Gennari.
Other Information
| CVE IDs: | CVE-2005-0116 |
| Severity Metric: | 13.39 |
| Date Public: | 2005-01-18 |
| Date First Published: | 2005-02-10 |
| Date Last Updated: | 2005-02-21 16:39 UTC |
| Document Revision: | 44 |