mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.

- Update to 5.6.5, for various fixes described at:
    http://trac.osgeo.org/mapserver/browser/tags/rel-5-6-5/m     apserver/HISTORY.TXT Also fixes CVE-2010-2539,     CVE-2010-2540, per bz #617301 and #617312.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-2539     A stack-based buffer overflow in the msTmpFile function     might lead to arbitrary code execution under some     conditions.

  - CVE-2010-2540     It was discovered that the CGI debug command-line     arguments which are enabled by default are insecure and     may allow a remote attacker to execute arbitrary code.
    Therefore they have been disabled by default.

The version of MapServer installed on the remote host allows the use of several insecure command-line debug arguments that are affected by unspecified vulnerabilities.

The remote web server hosts MapServer, an open source platform for publishing spacial data and interactive mapping applications to the web.  

Versions of MapServer earlier than 5.6.4, or 4.10.6 are potentially affected by multiple vulnerabilities :

  - A buffer overflow vulnerability in the 'ForcedTmpBase' parameter of 'msTmpFile()'. (Ticket 3484)

  - Unspecified security vulnerabilities in multiple debug command-line arguments. (Ticket 3485)

ID	Name	Product	Family	Severity
48746	Fedora 13 : mapserver-5.6.5-1.fc13 (2010-12266)	Nessus	Fedora Local Security Checks	critical
48222	Debian DSA-2079-1 : mapserver - several vulnerabilities	Nessus	Debian Local Security Checks	critical
47861	MapServer Insecure MapServ CGI Command-line Debug Args	Nessus	CGI abuses	critical
5611	MapServer < 5.6.4 / 4.10.6 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2010-2540

critical

Tenable Plugins

critical

critical

critical

high