Use Debian's patch for CVE-2008-3714 (rh#474396)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Add upstream patch for CVE-2008-3714

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

Morgan Todd has discovered a vulnerability in AWStats, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed in the URL to awstats.pl is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the application is running as a CGI script.

Morgan Todd discovered that AWStats did not correctly strip quotes from certain parameters, allowing for an XSS attack when running as a CGI. If a user was tricked by a remote attacker into following a specially crafted URL, the user's authentication information could be exposed for the domain where AWStats was hosted.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Morgan Todd discovered a cross-site scripting vulnerability in awstats, a log file analyzer, involving the 'config' request parameter (and possibly others; CVE-2008-3714 ).

ID	名稱	產品	系列	已發布	已更新	嚴重性
35065	Fedora 9 : awstats-6.8-3.fc9 (2008-10962)	Nessus	Fedora Local Security Checks	2008/12/9	2021/1/11	medium
34140	Fedora 9 : awstats-6.8-2.fc9 (2008-7663)	Nessus	Fedora Local Security Checks	2008/9/10	2021/1/11	medium
35290	FreeBSD : awstats -- multiple XSS vulnerabilities (27d78386-d35f-11dd-b800-001b77d09812)	Nessus	FreeBSD Local Security Checks	2009/1/5	2021/1/6	medium
34144	Fedora 8 : awstats-6.8-2.fc8 (2008-7684)	Nessus	Fedora Local Security Checks	2008/9/10	2021/1/11	medium
36652	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : awstats vulnerability (USN-686-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
36742	Fedora 10 : awstats-6.8-3.fc10 (2008-10950)	Nessus	Fedora Local Security Checks	2009/4/23	2021/1/11	medium
35032	Debian DSA-1679-1 : awstats - XSS	Nessus	Debian Local Security Checks	2008/12/4	2021/1/4	medium
35063	Fedora 8 : awstats-6.8-3.fc8 (2008-10938)	Nessus	Fedora Local Security Checks	2008/12/9	2021/1/11	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium