AWStats "ShowInfoURL" Remote Command Execution Vulnerability

[TJ]

* Technical Description *

A vulnerability was identified in AWStats, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to an input validation error in the "awstats.pl" script that does not properly filter a specially crafted "url" parameter (in "ShowInfoURL_$pluginname") before calling the "eval()" function, which can be exploited by remote attackers to inject and execute arbitrary Perl commands via the referrer statistics page.

 * Affected Products *

AWStats version 6.4 and prior

 * Solution *

Upgrade to AWStats version 6.5 (Development) :
http://awstats.sourceforge.net/#DOWNLOAD

 * References *

http://www.frsirt.com/english/advisories/2005/1352
http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities