Debian DSA-1914-1 : mapserver - several vulnerabilities

critical Nessus Plugin ID 44779

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2009-0843 Missing input validation on a user-supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages.

- CVE-2009-0842 A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages.

- CVE-2009-0841 Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn't affect installations on Linux as the fopen() syscall will fail in case a sub path is not readable.

- CVE-2009-0839 It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters.

- CVE-2009-0840 An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values.

- CVE-2009-2281 An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840.

Solution

Upgrade the mapserver packages.

For the oldstable distribution (etch), this problem has been fixed in version 4.10.0-5.1+etch4.

For the stable distribution (lenny), this problem has been fixed in version 5.0.3-3+lenny4.

Plugin Details

Severity: Critical

ID: 44779

File Name: debian_DSA-1914.nasl

Version: 1.13

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 2/24/2010

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:mapserver, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 10/22/2009

Reference Information

CVE: CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-2281

CWE: 119, 20, 200, 22

DSA: 1914

Detections

Analytics