AWStats Remote Command Execution Vulnerability (configdir)

[bornonline]

Analysis:
Successful exploitation allows remote attackers to execute arbitrary commands under the privileges of the web server. This can lead to further compromise as it provides remote attackers with local
access.
AwStats Vuln

Is this a global config or will it need to be changed for each domain?

[projectandrew]

cPanel has AWstats 6.2 installed, which is the current stable version. The author has only released 6.3 as a development release.

It should be possible to centrally upgrade awstats.


http://secunia.com/advisories/13893/

Solution:
Update to version 6.3.
http://awstats.sourceforge.net/#DOWNLOAD

[projectandrew]

You could follow this link, and adjust for 6.3:

http://forums.cpanel.net/showthread....pgrade+awstats

[bornonline]

Thanks for the link man!