Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?

From: Micah Brandon (brandon_at_vv.com)
Date: 02/16/05

  • Next message: Thor (Hammer of God): "Re: [Full-Disclosure] RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185"
    Date: Wed, 16 Feb 2005 15:52:00 -0500
    To: Jamie Pratt <jpratt@norwich.edu>
    
    

            I'm going to have to disagree. Execution of Perl functions
    is still possible in 6.3. You just have to jimmy it a little and
    try/guess different plugins that may be installed. I got a hit
    with 'hostinfo'. Try this on your server:

    http://server/cgi-bin/awstats.pl?config=someconfig&PluginMode=hostinfo+time

            Unix time shows up just below 'Whois command failed' error message.
    That's game over in my book.

    * Jamie Pratt (jpratt@norwich.edu) [050216 01:19]:
    > Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same
    > error. So.. Can we all agree that 6.3 is not vulnerable, because I'd
    > rather not upgrade to a dev/unstable release for no reason...
    >
    > regards,
    > jamie
    >
    > Herman Sheremetyev wrote:
    > >It works on mine too, though I still have 6.1. I think you may need to
    > >add the config=www.example.com into the url between the '?' and the '&'
    > >for it to work properly though. On my linux boxes with apache 2.0 it
    > >displays the command output in the page but on openbsd with apache 1.3
    > >it gives a 500 Server Error because the output ends up in the headers
    > >somehow. Either way it works though.
    > >
    > >-Herman
    > >


  • Next message: Thor (Hammer of God): "Re: [Full-Disclosure] RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185"

    Relevant Pages

    • Re: [opensuse] 11.3 i586 - firefox crash and desktop lockup after updates
      ... safe-mode is only for addons not for plugins. ... Sometimes you have to hit me with a big stick before I get it:p ... the way through the transfer of the mozilla page telling you that firefox was ...
      (SuSE)
    • Re: Firefox and Flash plugin not working
      ... Immediately after I hit the post button, I noticed that I have also got ... It enables you to use plugins on platforms they ... i386 in Mozilla on Linux/x86_64 or other architectures. ... Maybe you have a 64 bit Suse, but a 32 bit firefox. ...
      (alt.os.linux.suse)