AWSTATS Security Hole

Upgrade to latest release - or else...

[PhraSEOlogy]

Warning, a security hole was recently found in AWStats versions from 5.0 to 6.2 when AWStats is used as a CGI: A remote user can execute arbitrary commands on your server using permissions of your web server user (in most cases user "nobody").

[awstats.sourceforge.net ]

My server was hacked using this security hole and I just wanted to let you guys know.

[nuevojefe]

We had one go down as well. It's definitely a threat so take PhraSEOlogy's advice and get the fix if needbe.

[BwanaZulia]

Also a good reason to run AWstats cgi behind a apache username and password.

BZ