Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors.

The releases contain fixes for issues discovered in an audit of the CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939 http://trac.osgeo.org/mapserver/ticket/2941 http://trac.osgeo.org/mapserver/ticket/2942 http://trac.osgeo.org/mapserver/ticket/2943 http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support for RFC-56 that addresses tightening up the control of access to mapfiles and templates:
http://mapserver.org/development/rfc/ms-rfc-56.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running MapServer, an open source Internet map server. The installed version of MapServer is affected by multiple flaws :

  - By creating a map file with overly long IMAGEPATH and/or     NAME attribute(s), it may be possible to trigger a     stack-based buffer overflow. (CVE-2009-0839)

  - It may be possible to trigger a heap-based buffer     overflow by sending a HTTP POST request with     'CONTENT_LENGTH' attribute set to '-1'. (CVE-2009-0840)     Note: According to some reports this issue might have     been incorrectly fixed, see references for more info.

  - It may be possible to create arbitrary files by     specifying file names to the 'id' parameter.
    (CVE-2009-0841)

  - Provided an attacker has privileges to create symlinks     on the file system, it may be possible to partially read     the contents of arbitrary files. (CVE-2009-0842)

  - Provided an attacker has knowledge of a valid map file,     it may be possible to determine if an arbitrary file     exists on the remote system. (CVE-2009-0843)

  - Sufficient boundary checks are not performed on 'id'     parameter in mapserver.c. An attacker may exploit     this issue to trigger a buffer overflow condition     resulting in arbitrary code execution on the remote     system. (CVE-2009-1176)

  - File maptemplate.c is affected by multiple stack-based     overflow issues. (CVE-2009-1177)

ID	Name	Product	Family	Severity
37298	Fedora 10 : mapserver-5.2.2-1.fc10 (2009-3357)	Nessus	Fedora Local Security Checks	critical
36091	Fedora 9 : mapserver-5.2.2-1.fc9 (2009-3383)	Nessus	Fedora Local Security Checks	critical
36074	MapServer < 5.2.2 / 4.10.4 Multiple Flaws	Nessus	CGI abuses	high

Detections

Analytics

CVE-2009-1177

critical

Tenable Plugins

critical

critical

high