awstats -- missing input sanitising

2005-11-10T00:00:00
ID DSA-892
Type debian
Reporter Debian
Modified 2005-11-10T00:00:00

Description

Peter Vreugdenhil discovered that awstats, a featureful web server log analyser, passes user-supplied data to an eval() function, allowing remote attackers to execute arbitrary Perl commands.

The old stable distribution (woody) is not affected by this problem.

For the stable distribution (sarge) this problem has been fixed in version 6.4-1sarge1.

For the unstable distribution (sid) this problem has been fixed in version 6.4-1.1.

We recommend that you upgrade your awstats package.