Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?
From: Micah Brandon (brandon_at_vv.com)
Date: Wed, 16 Feb 2005 15:52:00 -0500 To: Jamie Pratt <firstname.lastname@example.org>
I'm going to have to disagree. Execution of Perl functions
is still possible in 6.3. You just have to jimmy it a little and
try/guess different plugins that may be installed. I got a hit
with 'hostinfo'. Try this on your server:
Unix time shows up just below 'Whois command failed' error message.
That's game over in my book.
* Jamie Pratt (email@example.com) [050216 01:19]:
> Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same
> error. So.. Can we all agree that 6.3 is not vulnerable, because I'd
> rather not upgrade to a dev/unstable release for no reason...
> Herman Sheremetyev wrote:
> >It works on mine too, though I still have 6.1. I think you may need to
> >add the config=www.example.com into the url between the '?' and the '&'
> >for it to work properly though. On my linux boxes with apache 2.0 it
> >displays the command output in the page but on openbsd with apache 1.3
> >it gives a 500 Server Error because the output ends up in the headers
> >somehow. Either way it works though.