Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-2281 | First vendor Publication | 2009-10-23 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2281 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13568 | |||
| Oval ID: | oval:org.mitre.oval:def:13568 | ||
| Title: | DSA-1914-1 mapserver -- several | ||
| Description: | Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0843 Missing input validation on a user supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. CVE-2009-0842 A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. CVE-2009-0841 Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn’t affect installations on Linux as the fopen syscall will fail in case a sub path is not readable. CVE-2009-0839 It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters. CVE-2009-0840 An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values. CVE-2009-2281 An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840. For the oldstable distribution, this problem has been fixed in version 4.10.0-5.1+etch4. For the stable distribution, this problem has been fixed in version 5.0.3-3+lenny4. For the testing distribution, this problem has been fixed in version 5.4.2-1. For the unstable distribution, this problem has been fixed in version 5.4.2-1. We recommend that you upgrade your mapserver packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1914-1 CVE-2009-0843 CVE-2009-0842 CVE-2009-0841 CVE-2009-0840 CVE-2009-0839 CVE-2009-2281 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | mapserver |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7870 | |||
| Oval ID: | oval:org.mitre.oval:def:7870 | ||
| Title: | DSA-1914 mapserver -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: Missing input validation on a user supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn't affect installations on Linux as the fopen() syscall will fail in case a sub path is not readable. It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters. An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values. An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1914 CVE-2009-0843 CVE-2009-0842 CVE-2009-0841 CVE-2009-0840 CVE-2009-0839 CVE-2009-2281 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | mapserver |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-27 | Name : Debian Security Advisory DSA 1914-1 (mapserver) File : nvt/deb_1914_1.nasl |
| 2009-10-26 | Name : MapServer HTTP Request Processing Integer Overflow Vulnerability File : nvt/mapserver_36802.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 59284 | MapServer cgiutil.c readPostBody Function Multiple Method HTTP Request Handli... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1914.nasl - Type : ACT_GATHER_INFO |
| 2009-10-27 | Name : The remote web server contains a CGI script that is affected by a buffer over... File : mapserver_5_4_2.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:10:06 |
|
| 2024-11-28 12:19:18 |
|
| 2021-06-25 12:05:56 |
|
| 2021-06-08 01:40:20 |
|
| 2021-06-08 01:05:54 |
|
| 2021-06-07 21:23:28 |
|
| 2021-06-01 17:23:08 |
|
| 2021-05-29 01:40:12 |
|
| 2021-05-29 01:05:53 |
|
| 2021-05-29 00:23:08 |
|
| 2021-05-04 12:09:45 |
|
| 2021-04-22 01:10:06 |
|
| 2020-05-23 00:23:58 |
|
| 2014-02-17 10:50:38 |
|
| 2013-05-10 23:53:18 |
|
