AWStats 'awstats.pl' Cross-Site Scripting Vulnerability

Bugtraq ID:	30730
Class:	Input Validation Error
CVE:	CVE-2008-3714 CVE-2008-5080
Remote:	Yes
Local:	No
Published:	Aug 18 2008 12:00AM
Updated:	Apr 13 2015 09:30PM
Credit:	Morgan Todd
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 AWStats AWStats 6.8
Not Vulnerable:	AWStats AWStats 6.9 beta

AWStats 'awstats.pl' Cross-Site Scripting Vulnerability

AWStats is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AWStats 6.8 is vulnerable; other versions may also be affected.

AWStats 'awstats.pl' Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following example URI is available:

http://www.example.com/awstats/awstats.pl?config=www.example.com&%22onload=%22alert(document.domain)//

AWStats 'awstats.pl' Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu awstats_6.6+dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg -1ubuntu0.1_all.deb

Debian Linux 4.0 arm

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu awstats_6.7.dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -1ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu awstats_6.7.dfsg-5ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -5ubuntu0.1_all.deb

Debian Linux 4.0 powerpc

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu awstats_6.7.dfsg-5ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -5ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu awstats_6.7.dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -1ubuntu0.1_all.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva awstats-6.8-1.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 m68k

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu awstats_6.5-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubu ntu1.3_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu awstats_6.7.dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -1ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu awstats_6.5-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubu ntu1.3_all.deb

MandrakeSoft Enterprise Server 5

• Mandriva awstats-6.8-1.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu awstats_6.6+dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg -1ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu awstats_6.7.dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -1ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu awstats_6.5-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubu ntu1.3_all.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu awstats_6.6+dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg -1ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu awstats_6.7.dfsg-5ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -5ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu awstats_6.6+dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg -1ubuntu0.1_all.deb

Debian Linux 4.0 amd64

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu awstats_6.5-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubu ntu1.3_all.deb

Debian Linux 4.0 ia-32

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Debian Linux 4.0 hppa

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Debian Linux 4.0 sparc

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Debian Linux 4.0 s/390

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu awstats_6.7.dfsg-5ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -5ubuntu0.1_all.deb

Debian Linux 4.0 alpha

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu awstats_6.6+dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg -1ubuntu0.1_all.deb

MandrakeSoft Corporate Server 4.0

• Mandriva awstats-6.4-4.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva awstats-6.4-4.2.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu awstats_6.7.dfsg-1ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -1ubuntu0.1_all.deb

Debian Linux 4.0

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Debian Linux 4.0 mipsel

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu awstats_6.7.dfsg-5ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg -5ubuntu0.1_all.deb

Debian Linux 4.0 ia-64

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

Debian Linux 4.0 mips

• Debian awstats_6.5+dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfs g-1+etch1_all.deb

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva awstats-6.4-4.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva awstats-6.4-4.2.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/

AWStats 'awstats.pl' Cross-Site Scripting Vulnerability

References:

• AWStats Homepage (AWStats)
  
• CVE-2008-5080 awstats: incomplete fix for CVE-2008-3714 XSS issue (Red Hat)
  
• AWStats [ 2001151 ] XSS Issue (AWStats)