Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New mapserver packages fix serveral vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | DSA-1914 | First vendor Publication | 2009-10-22 |
| Vendor | Debian | Last vendor Modification | 2009-10-22 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0843 Missing input validation on a user supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. CVE-2009-0842 A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. CVE-2009-0841 Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn't affect installations on Linux as the fopen() syscall will fail in case a sub path is not readable. CVE-2009-0839 It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters. CVE-2009-0840 An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values. CVE-2009-2281 An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840. For the oldstable distribution (etch), this problem has been fixed in version 4.10.0-5.1+etch4. For the stable distribution (lenny), this problem has been fixed in version 5.0.3-3+lenny4. For the testing distribution (squeeze), this problem has been fixed in version 5.4.2-1. For the unstable distribution (sid), this problem has been fixed in version 5.4.2-1. We recommend that you upgrade your mapserver packages. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1914 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 17 % | CWE-200 | Information Exposure |
| 17 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
| 17 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13568 | |||
| Oval ID: | oval:org.mitre.oval:def:13568 | ||
| Title: | DSA-1914-1 mapserver -- several | ||
| Description: | Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0843 Missing input validation on a user supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. CVE-2009-0842 A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. CVE-2009-0841 Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn’t affect installations on Linux as the fopen syscall will fail in case a sub path is not readable. CVE-2009-0839 It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters. CVE-2009-0840 An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values. CVE-2009-2281 An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840. For the oldstable distribution, this problem has been fixed in version 4.10.0-5.1+etch4. For the stable distribution, this problem has been fixed in version 5.0.3-3+lenny4. For the testing distribution, this problem has been fixed in version 5.4.2-1. For the unstable distribution, this problem has been fixed in version 5.4.2-1. We recommend that you upgrade your mapserver packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1914-1 CVE-2009-0843 CVE-2009-0842 CVE-2009-0841 CVE-2009-0840 CVE-2009-0839 CVE-2009-2281 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | mapserver |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7870 | |||
| Oval ID: | oval:org.mitre.oval:def:7870 | ||
| Title: | DSA-1914 mapserver -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: Missing input validation on a user supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn't affect installations on Linux as the fopen() syscall will fail in case a sub path is not readable. It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters. An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values. An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1914 CVE-2009-0843 CVE-2009-0842 CVE-2009-0841 CVE-2009-0840 CVE-2009-0839 CVE-2009-2281 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | mapserver |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-08-02 | Name : MapServer Buffer Overflow and Unspecified Security Vulnerabilities File : nvt/gb_mapserver_41855.nasl |
| 2009-10-27 | Name : Debian Security Advisory DSA 1914-1 (mapserver) File : nvt/deb_1914_1.nasl |
| 2009-10-26 | Name : MapServer HTTP Request Processing Integer Overflow Vulnerability File : nvt/mapserver_36802.nasl |
| 2009-09-09 | Name : Fedora Core 11 FEDORA-2009-9230 (mapserver) File : nvt/fcore_2009_9230.nasl |
| 2009-09-09 | Name : Fedora Core 10 FEDORA-2009-9243 (mapserver) File : nvt/fcore_2009_9243.nasl |
| 2009-04-15 | Name : Fedora Core 10 FEDORA-2009-3357 (mapserver) File : nvt/fcore_2009_3357.nasl |
| 2009-04-15 | Name : Fedora Core 9 FEDORA-2009-3383 (mapserver) File : nvt/fcore_2009_3383.nasl |
| 2009-04-08 | Name : Multiple Vulnerabilities In MapServer File : nvt/gb_mapserver_mult_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 59284 | MapServer cgiutil.c readPostBody Function Multiple Method HTTP Request Handli... |
| 56333 | MapServer mapserv msLoadQuery Function queryfile Parameter File Enumeration |
| 56332 | MapServer mapserv Crafted Request .map File Content Disclosure |
| 56331 | MapServer on Windows mapserv mapserv.c id Parameter Traversal Arbitrary File ... |
| 56330 | MapServer mapserv cgiutil.c readPostBody Function Content-Length HTTP Header ... |
| 56329 | MapServer mapserv mapserv.c Query Action Multiple Map Attribute Handling Remo... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1914.nasl - Type : ACT_GATHER_INFO |
| 2009-10-27 | Name : The remote web server contains a CGI script that is affected by a buffer over... File : mapserver_5_4_2.nasl - Type : ACT_GATHER_INFO |
| 2009-09-03 | Name : The remote Fedora host is missing a security update. File : fedora_2009-9230.nasl - Type : ACT_GATHER_INFO |
| 2009-09-03 | Name : The remote Fedora host is missing a security update. File : fedora_2009-9243.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3357.nasl - Type : ACT_GATHER_INFO |
| 2009-04-07 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3383.nasl - Type : ACT_GATHER_INFO |
| 2009-04-02 | Name : The remote web server contains a CGI script that is affected by multiple flaws. File : mapserver_5_2_2.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:55 |
|
