TITLE:
AWStats "configdir" Arbitrary Configuration File Loading

SECUNIA ADVISORY ID:
SA20164

VERIFY ADVISORY:
http://secunia.com/advisories/20164/

CRITICAL:
Less critical

IMPACT:
Security Bypass, System access

WHERE:
>From remote

SOFTWARE:
AWStats 6.x
http://secunia.com/product/4490/

DESCRIPTION:
Hendrik Weimer has discovered a security issue in AWStats, which can
be exploited by malicious people to bypass certain security
restrictions.

Input passed to the "configdir" parameter in awstats.pl isn't
properly verified, before it is used to load configuration files.
This can be exploited to load a configuration file with an arbitrary
filename from an arbitrary directory by setting the "configdir" and
"config" parameters.

This can further be exploited to inject and execute arbitrary shell
commands via the "LogFile" configuration directive and the "|" pipe
character.

The loading of an arbitrary configuration file in itself is not a
vulnerability and should not pose any direct risk to the system.
However, combined with other third-party applications, which allow
files to be uploaded to the system by untrusted users, this can be
exploited to compromise a vulnerable system.

The problem has been confirmed in version 6.5. Other versions may
also be affected.

SOLUTION:
Do not allow untrusted users to upload files to affected systems.

PROVIDED AND/OR DISCOVERED BY:
Hendrik Weimer

ORIGINAL ADVISORY:
http://www.debian.org/security/2006/dsa-1075

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------