Multiple vulnerabilities have been found in AWStats, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-misc/awstats | * | < 7.8 | >= 7.8 |
AWStats is an advanced log file analyzer and statistics generator.
Multiple vulnerabilities have been discovered in AWStats. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All AWStats users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-misc/awstats-7.8"
AWStats contains a bug in the sanitization of the input parameters which can lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-misc/awstats | * | < 6.5-r1 | >= 6.5-r1 |
AWStats is an advanced log file analyzer and statistics generator.
Hendrik Weimer has found that if updating the statistics via the web frontend is enabled, it is possible to inject arbitrary code via a pipe character in the "migrate" parameter. Additionally, r0t has discovered that AWStats fails to properly sanitize user-supplied input in awstats.pl.
A remote attacker can execute arbitrary code on the server in the context of the application running the AWStats CGI script if updating of the statistics via web frontend is allowed. Nonetheless, all configurations are affected by a cross-site scripting vulnerability in awstats.pl, allowing a remote attacker to execute arbitrary scripts running in the context of the victim's browser.
Disable statistics updates using the web frontend to avoid code injection. However, there is no known workaround at this time concerning the cross-site scripting vulnerability.
All AWStats users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-misc/awstats-6.5-r1"
AWStats fails to validate certain log input, which could lead to the execution of arbitrary Perl code during the generation of the statistics.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-misc/awstats | * | < 6.5 | >= 6.5 |
AWStats is an advanced log file analyzer and statistics generator. In HTTP reports it parses Referrer information in order to display the most common Referrer values that caused users to visit the website.
When using a URLPlugin, AWStats fails to sanitize Referrer URL data before using them in a Perl eval() routine.
A remote attacker can include arbitrary Referrer information in a HTTP request to a web server, therefore injecting tainted data in the log files. When AWStats is run on this log file, this can result in the execution of arbitrary Perl code with the rights of the user running AWStats.
Disable all URLPlugins in the AWStats configuration.
All AWStats users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-misc/awstats-6.5"
Note: Users with the vhosts USE flag set should manually use webapp-config to finalize the update.
AWStats fails to validate certain input, which could lead to the remote execution of arbitrary code or to the leak of information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-misc/awstats | * | < 6.3-r2 | >= 6.3-r2 |
AWStats is an advanced log file analyzer and statistics generator.
When 'awstats.pl' is run as a CGI script, it fails to validate specific inputs which are used in a Perl open() function call. Furthermore, a user could read log file content even when plugin rawlog was not enabled.
A remote attacker could supply AWStats malicious input, potentially allowing the execution of arbitrary code with the rights of the web server. He could also access raw log contents.
Making sure that AWStats does not run as a CGI script will avoid the issue, but we recommend that users upgrade to the latest version, which fixes these bugs.
All AWStats users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-misc/awstats-6.3-r2"
Note: Users with the vhosts USE flag set should manually use webapp-config to finalize the update.