AWStats awstats.pl plugin shell command execution (HTTP_AWStats_PluginMode_Exec)

About this signature or vulnerability

BlackICE Agent for Server, BlackICE Server Protection, BlackICE PC Protection, RealSecure Network, RealSecure Server Sensor, Proventia Network MFS, IBM Security Server Protection for Windows, Proventia Network IDS, Proventia Desktop, Proventia-G 1.1 and earlier, RealSecure Desktop, RealSecure Desktop Protector 3.6, Proventia Network IPS, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware:

This signature detects an HTTP GET request to AWStats that could be an attacker trying to execute arbitrary commands or cause a denial of service attack.

Default risk level

 High

Sensors that have this signature

BlackICE Agent for Server: 3.6eof, BlackICE Server Protection: 3.6.cpa, BlackICE PC Protection: 3.6cpa, RealSecure Network: XPU 24.4, RealSecure Server Sensor: XPU 24.4, Proventia Network MFS: XPU 1.43, IBM Security Server Protection for Windows: 2.1.14.2400, IBM Security Server Protection for Windows: 1.0.914.0, Proventia Network IDS: XPU 24.4, Proventia Desktop: 8.0.614.1, Proventia-G 1.1 and earlier: XPU 24.4, RealSecure Desktop: eoe, RealSecure Desktop Protector 3.6: eoe, Proventia Network IPS: XPU 1.43, Proventia Server IPS for Linux technology: 1.0, Virtual Server Protection for Vmware: 1.0

Systems affected

SCO SCO UnixWare: 2.0.x, Gentoo Linux, AWStats AWStats: prior to 6.3

Type

Unauthorized Access Attempt

Vulnerability description

How to remove this vulnerability

References