Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

AWstats Path Disclosure Vulnerability

from [fournaux] Network Security [Permanent Link]
Subject: AWstats Path Disclosure Vulnerability
Date: 26 Aug 2005 01:58:29 -0000 
Good morning all.

"AWStats is a free powerful and featureful tool that generates advanced web, 
streaming, ftp or mail server statistics, graphically. This log analyzer works 
as a CGI or from command line and shows you all possible information your log 
contains, in few graphical web pages."

Once you have setup this tool, you can get statistics of a website with this 
URL :

http://www.server.com/awstats/awstats.pl?config=xxx

You replace xxx by the name you gave to the configuration file of your website 
(You have one file per website)

But if xxx is not an existing name, the path will be disclosed to the user in 
the resulting error message.

I have seen this vulnerability with 6.4 version of AWstats and i think all 
version < 6.4 are also vulnerable.

AWstats is a great tool anyway.

Sorry for my english it is not my primary language.

Have a nice day. Unix will win.

Best regards.

FOURNAUX Nicolas

www.cambodiaoutsourcing.com
www.khmerdev.com
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • AWstats Path Disclosure Vulnerability, fournaux <=
Previous by Date:  Re: [ GLSA 200508-14 ] TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC, Cangrejito Playero
Next by Date:  [security bulletin] SSRT051023 rev.0 - HP Openview Network Node Manager (OV NNM) Remote Unauthorized Access, Boren, Rich (HP SSRT)
Previous by Thread:  MDKSA-2005:152 - Updated php packages fix integer overflow vulnerability, Mandriva Security Team
Next by Thread:  [security bulletin] SSRT051023 rev.0 - HP Openview Network Node Manager (OV NNM) Remote Unauthorized Access, Boren, Rich (HP SSRT)
Indexes:  [Date] [Thread] [Top] [All Lists]