Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0078
AWStats vulnerability
25 January 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: awstats
Publisher: Ubuntu
Operating System: Ubuntu
Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2010-4369
Original Bulletin:
http://www.ubuntu.com/usn/usn-1047-1
Comment: This advisory references vulnerabilities in products which run on
platforms other than Ubuntu. It is recommended that administrators
running awstats check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
===========================================================
Ubuntu Security Notice USN-1047-1 January 24, 2011
awstats vulnerability
CVE-2010-4369
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
awstats 6.5-1ubuntu1.4
Ubuntu 8.04 LTS:
awstats 6.7.dfsg-1ubuntu0.2
Ubuntu 9.10:
awstats 6.9~dfsg-1ubuntu3.9.10.1
Ubuntu 10.04 LTS:
awstats 6.9~dfsg-1ubuntu3.10.04.1
Ubuntu 10.10:
awstats 6.9.5~dfsg-3ubuntu0.1
In general, a standard system update will make all the necessary changes.
Details follow:
It was discovered that AWStats did not correctly filter the LoadPlugin
configuration option. A local attacker on a shared system could use this
to inject arbitrary code into AWStats.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubun=
tu1.4.diff.gz
Size/MD5: 20512 a821b60de3f940338b9e43e5ff5d29f1
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubun=
tu1.4.dsc
Size/MD5: 1426 403908718ed4d34bb4c728223e810a12
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5.orig.=
tar.gz
Size/MD5: 1051780 aef00b2ff5c5413bd2a868299cabd69a
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubun=
tu1.4_all.deb
Size/MD5: 853586 4c2853cd9169247899b6036dc7cfa198
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-=
1ubuntu0.2.diff.gz
Size/MD5: 23771 4776192ee160583ce30b21f5fbe66003
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-=
1ubuntu0.2.dsc
Size/MD5: 1620 492ba4f3e2f2ffe51aa9a97fca7783c6
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg.=
orig.tar.gz
Size/MD5: 1093568 98a5fad9c379ac4884d7af90db6e087b
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-=
1ubuntu0.2_all.deb
Size/MD5: 908096 e8f1bd0f9db064a57cf9c23a3fe20686
Updated packages for Ubuntu 9.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg-=
1ubuntu3.9.10.1.diff.gz
Size/MD5: 45789 b44d3b7fcf2d4bc5a0eeda3dec3fc412
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg-=
1ubuntu3.9.10.1.dsc
Size/MD5: 2198 82f778a33dc5bc99d38e270902caf233
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg.=
orig.tar.gz
Size/MD5: 1127895 460c03a07b2e4d9a9ada6a7f320d46e8
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg-=
1ubuntu3.9.10.1_all.deb
Size/MD5: 951444 83e6faf9324669b08ba9ce95dc5ecc00
Updated packages for Ubuntu 10.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg-=
1ubuntu3.10.04.1.diff.gz
Size/MD5: 45789 f21c60b02413fc47263702e37bbd317c
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg-=
1ubuntu3.10.04.1.dsc
Size/MD5: 2202 2536cf6fe0fbec527f16cf6e5e3ada47
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg.=
orig.tar.gz
Size/MD5: 1127895 460c03a07b2e4d9a9ada6a7f320d46e8
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9~dfsg-=
1ubuntu3.10.04.1_all.deb
Size/MD5: 951338 abc39ddeee9b7efd15c68baf255fa419
Updated packages for Ubuntu 10.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9.5~dfs=
g-3ubuntu0.1.debian.tar.gz
Size/MD5: 39502 4b1e14b2bdf3439924c392b6a18d8cd6
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9.5~dfs=
g-3ubuntu0.1.dsc
Size/MD5: 2184 8ea4ef44ccb7af39a7cbf04505e05f6f
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9.5~dfs=
g.orig.tar.gz
Size/MD5: 1145006 af006dff266dfebd66baf5361350a805
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.9.5~dfs=
g-3ubuntu0.1_all.deb
Size/MD5: 973788 4178bd568c444de4508131d828f43322
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFNPklK/iFOrG6YcBERAt0QAKDMWApyIh0ent7O4sLDpScsTRr6FgCg2NGS
YL8tKID33DqDO34ETz2giW4=
=oZIV
-----END PGP SIGNATURE-----