PublicDateAtUSN: 2018-01-03
Candidate: CVE-2017-1000501
PublicDate: 2018-01-03 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501
 https://ubuntu.com/security/notices/USN-3518-1
Description:
 Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in
 the handling of the "config" and "migrate" parameters resulting in
 unauthenticated remote code execution.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=885835
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_awstats:
 upstream: https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899
 upstream: https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651
upstream_awstats: needs-triage
precise/esm_awstats: DNE
trusty_awstats: released (7.2+dfsg-1ubuntu0.1)
trusty/esm_awstats: DNE (trusty was released [7.2+dfsg-1ubuntu0.1])
xenial_awstats: released (7.4+dfsg-1ubuntu0.2)
esm-infra/xenial_awstats: released (7.4+dfsg-1ubuntu0.2)
zesty_awstats: released (7.6+dfsg-1ubuntu0.17.04.1)
artful_awstats: released (7.6+dfsg-1ubuntu0.17.10.1)
devel_awstats: released (7.6+dfsg-1ubuntu1)