This is a multipart message in MIME format.
--=_alternative 004E5D88C1256FC8_=
Content-Type: text/plain; charset="us-ascii"

Hi,

We wanted to pass on a security warning about an exploit to the AWstats
package. If any Campsite users are using AWstats, please install the patch
that is available at the project's SourceForge page:
http://awstats.sourceforge.net

This is an article from the Infotex Information Security Portal
(https://my.infotex.com/article.php?story=20050125084306655). - doug

========================================================================================

AWStats Vulnerability and Exploit Code Released Tuesday, January 25 2005 @ 08:43 AM EST
AWStats (Advanced Web Stats) is an open source log stats generation tool.
It can parse web, ftp, mail, proxy, and a number of other log formats and
create very useful reports. There has been a remote exploit made public in
his tool that allows a remote attacker to run code on an affected server.


Normally we wouldn't report a vulnerability in a tool like this, but this
tool is in wide enough use that we feel it's useful. This is a tool that
would often be deployed and then forgotten about. Please take a moment and
make sure that you don't have a vulnerable version of this script running.
There is a patched download available at the awstats website:

http://awstats.sourceforge.net/

There has been exploit code released here:

http://www.k-otik.com/exploits/20050124.awexpl.c.php
http://www.k-otik.com/exploits/20050124.GHCaws.pl.php

With the widespread use of this tool it's likely that an automated worm
may be written from these exploit scripts. We recommend you upgrade
quickly. An attacker would be able to find a large number of vulnerable
servers via Google searches, etc. The upgrade is very quick and easy.



=============================================
Media Development Loan Fund
=============================================
Douglas Arellanes
Head of Research and Development
Center for Advanced Media--Prague (CAMP)
Na vinicnich horach 24a/1834, 160 00 Prague 6
Czech Republic
Tel: + 420 2 3333 5356, Fax: +420 2 2431 5419
Mobile: +420 724 073 364
http://www.mdlf-camp.net
http://www.campware.org
=============================================
http://www.mdlf.org
=============================================
--=_alternative 004E5D88C1256FC8_=
Content-Type: text/html; charset="us-ascii"



Hi,



We wanted to pass on a security warning about an exploit to the AWstats package. If any Campsite users are using AWstats, please install the patch that is available at the project's SourceForge page: http://awstats.sourceforge.net



This is an article from the Infotex Information Security Portal (https://my.infotex.com/article.php?story=20050125084306655). - doug



========================================================================================



AWStats Vulnerability and Exploit Code Released    Tuesday, January 25 2005 @ 08:43 AM EST

AWStats (Advanced Web Stats) is an open source log stats generation tool. It can parse web, ftp, mail, proxy, and a number of other log formats and create very useful reports. There has been a remote exploit made public in his tool that allows a remote attacker to run code on an affected server. Normally we wouldn't report a vulnerability in a tool like this, but this tool is in wide enough use that we feel it's useful. This is a tool that would often be deployed and then forgotten about. Please take a moment and make sure that you don't have a vulnerable version of this script running. There is a patched download available at the awstats website: http://awstats.sourceforge.net/ There has been exploit code released here: http://www.k-otik.com/exploits/20050124.awexpl.c.php http://www.k-otik.com/exploits/20050124.GHCaws.pl.php With the widespread use of this tool it's likely that an automated worm may be written from these exploit scripts. We recommend you upgrade quickly. An attacker would be able to find a large number of vulnerable servers via Google searches, etc. The upgrade is very quick and easy.

=============================================

Media Development Loan Fund

=============================================

Douglas Arellanes

Head of Research and Development

Center for Advanced Media--Prague (CAMP)

Na vinicnich horach 24a/1834, 160 00  Prague 6

Czech Republic

Tel: + 420 2 3333 5356, Fax: +420 2 2431 5419

Mobile: +420 724 073 364

http://www.mdlf-camp.net

http://www.campware.org

=============================================

http://www.mdlf.org

=============================================
--=_alternative 004E5D88C1256FC8_=--

------------------------------------------
Posted to Phorum via PhorumMail