Secunia

Hendrik Weimer has discovered a security issue in AWStats, which can be exploited by malicious people to bypass certain security restrictions.

Input passed to the "configdir" parameter in awstats.pl isn't properly verified, before it is used to load configuration files. This can be exploited to load a configuration file with an arbitrary filename from e.g. an arbitrary directory, a NFS share, or a WebDAV share by setting the "configdir" and "config" parameters.

This can further be exploited to inject and execute arbitrary shell commands via the "LogFile" configuration directive and the "|" pipe character.

The loading of an arbitrary configuration file in itself is not a vulnerability and should not pose any direct risk to the system. However, combined with other third-party applications, which allow files to be uploaded to the system by untrusted users, this can be exploited to compromise a vulnerable system.

The problem has been confirmed in version 6.5. Other versions may also be affected.

Solution
Fixed in the CVS repository and version 7.0.

Provided and/or discovered by
Hendrik Weimer

Changelog
Further details available in Customer Area

Original Advisory
Hendrik Weimer:
http://www.debian.org/security/2006/dsa-1075

AWStats:
http://awstats.sourceforge.net/docs/awstats_changelog.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area