Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program.

Chris Schmidt and Daniel Morissette discovered two vulnerabilities in mapserver, a development environment for spatial and mapping applications. The Common Vulnerabilities and Exposures project identifies the following two problems :

  - CVE-2007-4542     Lack of input sanitizing and output escaping in the CGI     mapserver's template handling and error reporting     routines leads to cross-site scripting vulnerabilities.

  - CVE-2007-4629     Missing bounds checking in mapserver's template handling     leads to a stack-based buffer overrun vulnerability,     allowing a remote attacker to execute arbitrary code     with the privileges of the CGI or httpd user.

- Thu Aug 30 2007 Oliver Falk <oliver at linux-kernel.at>     4.10.3-2

    - Add fix to include libmapserver (in some places),       instead of libmap, that doesn't exist (anymore)

  - Thu Aug 30 2007 Oliver Falk <oliver at linux-kernel.at>     4.10.3-1

    - Update to fix bz#256561, CVE-2007-4542

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running MapServer, an open source internet map server.

The installed version of MapServer is affected by multiple cross-site scripting vulnerabilities and to a buffer overflow vulnerability.  To exploit those flaws an attacker needs to send specially crafted requests to the mapserv CGI.

By exploiting the buffer overflow vulnerability, an attacker would be able to execute code on the remote host with the privileges of the web server.

ID	Name	Product	Family	Severity
31809	Debian DSA-1539-1 : mapserver - several vulnerabilities	Nessus	Debian Local Security Checks	high
27745	Fedora 7 : mapserver-4.10.3-2.fc7 (2007-2018)	Nessus	Fedora Local Security Checks	high
26010	MapServer Multiple Remote Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2007-4542

medium

Tenable Plugins

high

high

high