Nome do pacote
awstats
Data
2011-02-21
ID Alerta
MDVSA-2011:033
Versões afetadas
MES5 i586 , MES5 x86_64

Descrição do problema

Multiple vulnerabilities has been found and corrected in awstats:

awstats.cgi in AWStats before 7.0 accepts a configdir parameter in
the URL, which allows remote attackers to execute arbitrary commands
via a crafted configuration file located on a (1) WebDAV server or
(2) NFS server (CVE-2010-4367).

Directory traversal vulnerability in AWStats before 7.0 allows remote
attackers to have an unspecified impact via a crafted LoadPlugin
directory (CVE-2010-4369).

The updated packages have been upgraded to the latest version to
address these vulnerabilities.

Pacotes atualizados

MES5 i586

 006f905c739b9fd43f45f78f87f92b7e  mes5/i586/awstats-7.0-0.1mdvmes5.1.noarch.rpm 
 cbf5e862976dd286496f051e003bc0d9  mes5/SRPMS/awstats-7.0-0.1mdvmes5.1.src.rpm

MES5 x86_64

 ac591360801eef3536167912e2a26b65  mes5/x86_64/awstats-7.0-0.1mdvmes5.1.noarch.rpm 
 cbf5e862976dd286496f051e003bc0d9  mes5/SRPMS/awstats-7.0-0.1mdvmes5.1.src.rpm

Referências