Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.

Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0843     Missing input validation on a user-supplied map     queryfile name can be used by an attacker to check for     the existence of a specific file by using the queryfile     GET parameter and checking for differences in error     messages.

  - CVE-2009-0842     A lack of file type verification when parsing a map file     can lead to partial disclosure of content from arbitrary     files through parser error messages.

  - CVE-2009-0841     Due to missing input validation when saving map files     under certain conditions it is possible to perform     directory traversal attacks and to create arbitrary     files. NOTE: Unless the attacker is able to create     directories in the image path or there is already a     readable directory this doesn't affect installations on     Linux as the fopen() syscall will fail in case a sub     path is not readable.

  - CVE-2009-0839     It was discovered that mapserver is vulnerable to a     stack-based buffer overflow when processing certain GET     parameters. An attacker can use this to execute     arbitrary code on the server via crafted id parameters.

  - CVE-2009-0840     An integer overflow leading to a heap-based buffer     overflow when processing the Content-Length header of an     HTTP request can be used by an attacker to execute     arbitrary code via crafted POST requests containing     negative Content-Length values.

  - CVE-2009-2281     An integer overflow when processing HTTP requests can     lead to a heap-based buffer overflow. An attacker can     use this to execute arbitrary code either via crafted     Content-Length values or large HTTP request. This is     partly because of an incomplete fix for CVE-2009-0840.

The remote web server is running a version of MapServer earlier than 4.10.5 / 5.2.3 / 5.4.2.  Such versions are potentially affected by an integer-overflow vulnerability when the application handles large HTTP requests containing specially crafted 'Content-Length' values.

The remote host is running MapServer, an open source Internet map server. The installed version reportedly contains an incomplete fix for the vulnerability referenced by CVE-2009-0840. An attacker may be able to exploit this issue to cause a denial of service condition or execute arbitrary code on the remote system.

The releases contain fixes for issues discovered in an audit of the CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939 http://trac.osgeo.org/mapserver/ticket/2941 http://trac.osgeo.org/mapserver/ticket/2942 http://trac.osgeo.org/mapserver/ticket/2943 http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support for RFC-56 that addresses tightening up the control of access to mapfiles and templates:
http://mapserver.org/development/rfc/ms-rfc-56.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running MapServer, an open source Internet map server. The installed version of MapServer is affected by multiple flaws :

  - By creating a map file with overly long IMAGEPATH and/or     NAME attribute(s), it may be possible to trigger a     stack-based buffer overflow. (CVE-2009-0839)

  - It may be possible to trigger a heap-based buffer     overflow by sending a HTTP POST request with     'CONTENT_LENGTH' attribute set to '-1'. (CVE-2009-0840)     Note: According to some reports this issue might have     been incorrectly fixed, see references for more info.

  - It may be possible to create arbitrary files by     specifying file names to the 'id' parameter.
    (CVE-2009-0841)

  - Provided an attacker has privileges to create symlinks     on the file system, it may be possible to partially read     the contents of arbitrary files. (CVE-2009-0842)

  - Provided an attacker has knowledge of a valid map file,     it may be possible to determine if an arbitrary file     exists on the remote system. (CVE-2009-0843)

  - Sufficient boundary checks are not performed on 'id'     parameter in mapserver.c. An attacker may exploit     this issue to trigger a buffer overflow condition     resulting in arbitrary code execution on the remote     system. (CVE-2009-1176)

  - File maptemplate.c is affected by multiple stack-based     overflow issues. (CVE-2009-1177)

ID	Name	Product	Family	Severity
44779	Debian DSA-1914-1 : mapserver - several vulnerabilities	Nessus	Debian Local Security Checks	critical
5210	MapServer < 4.10.5/5.2.3/5.4.2 Integer Overflow Vulnerability	Nessus Network Monitor	CGI	medium
42262	MapServer < 5.4.2 / 5.2.3 / 4.10.5 Buffer Overflow	Nessus	CGI abuses	critical
37298	Fedora 10 : mapserver-5.2.2-1.fc10 (2009-3357)	Nessus	Fedora Local Security Checks	critical
36091	Fedora 9 : mapserver-5.2.2-1.fc9 (2009-3383)	Nessus	Fedora Local Security Checks	critical
36074	MapServer < 5.2.2 / 4.10.4 Multiple Flaws	Nessus	CGI abuses	high

Detections

Analytics

CVE-2009-0840

critical

Tenable Plugins

critical

medium

critical

critical

critical

high