Vulnerabilities > CVE-2007-4629 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in University of Minnesota Mapserver

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
 script_id(26010);
 script_version("1.18");
 script_cvs_date("Date: 2018/06/13 18:56:28");

 script_cve_id("CVE-2007-4542", "CVE-2007-4629");
 script_bugtraq_id(25582);

 script_name(english:"MapServer Multiple Remote Vulnerabilities");
 script_summary(english:"Checks for multiple vulnerabilities in MapServer < 4.10.3");

 script_set_attribute(attribute:"synopsis", value:
"The remote web server contains CGI scripts that are prone to arbitrary
remote command execution and cross-site scripting attacks.");
 script_set_attribute(attribute:"description", value:
"The remote host is running MapServer, an open source internet map
server.

The installed version of MapServer is affected by multiple cross-site
scripting vulnerabilities and to a buffer overflow vulnerability.  To
exploit those flaws an attacker needs to send specially crafted
requests to the mapserv CGI.

By exploiting the buffer overflow vulnerability, an attacker would be
able to execute code on the remote host with the privileges of the web
server.");
 script_set_attribute(attribute:"solution", value:"Upgrade to MapServer 4.10.3.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_cwe_id(79);

 script_set_attribute(attribute:"plugin_publication_date", value:"2007/09/10");

 script_set_attribute(attribute:"potential_vulnerability", value:"true");
 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_family(english:"CGI abuses");

 script_copyright(english:"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.");

 script_dependencies("mapserver_detect.nasl");
 script_require_ports("Services/www", 80);
 script_require_keys("www/mapserver", "Settings/ParanoidReport");
 exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("http.inc");
include("misc_func.inc");
include("webapp_func.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

app_name = "MapServer";
port = get_http_port(default:80);
install = get_install_from_kb(appname:'mapserver', port:port, exit_on_fail:TRUE);
version = install['ver'];
url = build_url(port:port, qs:install['dir']);

# Determine fixed version from branch.
if (version =~ "^[0-4]($|[-\.])") fix = "4.10.3";
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url, version);

if (ver_compare(app:'asterisk', ver:version, fix:fix) == -1 )
{
  if(report_verbosity > 0)
  {
    report =
      '\n  URL           : ' + url +
      '\n  Version       : ' + version +
      '\n  Fixed version : ' + fix +
      '\n';
    security_hole(port:port,extra:report);
  }
  else security_hole(port);
  set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
  exit(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url, version);

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2007-2018.
#

include("compat.inc");

if (description)
{
  script_id(27745);
  script_version ("1.13");
  script_cvs_date("Date: 2019/08/02 13:32:25");

  script_cve_id("CVE-2007-4542", "CVE-2007-4629");
  script_xref(name:"FEDORA", value:"2007-2018");

  script_name(english:"Fedora 7 : mapserver-4.10.3-2.fc7 (2007-2018)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - Thu Aug 30 2007 Oliver Falk <oliver at linux-kernel.at>
    4.10.3-2

    - Add fix to include libmapserver (in some places),
      instead of libmap, that doesn't exist (anymore)

  - Thu Aug 30 2007 Oliver Falk <oliver at linux-kernel.at>
    4.10.3-1

    - Update to fix bz#256561, CVE-2007-4542

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2007-September/003615.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?a30944b3"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_cwe_id(79);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver-java");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php-mapserver");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:7");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/09/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/11/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 7.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC7", reference:"mapserver-4.10.3-2.fc7")) flag++;
if (rpm_check(release:"FC7", reference:"mapserver-debuginfo-4.10.3-2.fc7")) flag++;
if (rpm_check(release:"FC7", reference:"mapserver-java-4.10.3-2.fc7")) flag++;
if (rpm_check(release:"FC7", reference:"mapserver-perl-4.10.3-2.fc7")) flag++;
if (rpm_check(release:"FC7", reference:"mapserver-python-4.10.3-2.fc7")) flag++;
if (rpm_check(release:"FC7", reference:"php-mapserver-4.10.3-2.fc7")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mapserver / mapserver-debuginfo / mapserver-java / mapserver-perl / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-1539. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(31809);
  script_version("1.13");
  script_cvs_date("Date: 2019/08/02 13:32:21");

  script_cve_id("CVE-2007-4542", "CVE-2007-4629");
  script_xref(name:"DSA", value:"1539");

  script_name(english:"Debian DSA-1539-1 : mapserver - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Chris Schmidt and Daniel Morissette discovered two vulnerabilities in
mapserver, a development environment for spatial and mapping
applications. The Common Vulnerabilities and Exposures project
identifies the following two problems :

  - CVE-2007-4542
    Lack of input sanitizing and output escaping in the CGI
    mapserver's template handling and error reporting
    routines leads to cross-site scripting vulnerabilities.

  - CVE-2007-4629
    Missing bounds checking in mapserver's template handling
    leads to a stack-based buffer overrun vulnerability,
    allowing a remote attacker to execute arbitrary code
    with the privileges of the CGI or httpd user."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2007-4542"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2007-4629"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2008/dsa-1539"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the mapserver (4.10.0-5.1+etch2) package.

For the stable distribution (etch), these problems have been fixed in
version 4.10.0-5.1+etch2."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_cwe_id(79);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mapserver");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/04/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/11");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"4.0", prefix:"cgi-mapserver", reference:"4.10.0-5.1+etch2")) flag++;
if (deb_check(release:"4.0", prefix:"mapserver-bin", reference:"4.10.0-5.1+etch2")) flag++;
if (deb_check(release:"4.0", prefix:"mapserver-doc", reference:"4.10.0-5.1+etch2")) flag++;
if (deb_check(release:"4.0", prefix:"perl-mapscript", reference:"4.10.0-5.1+etch2")) flag++;
if (deb_check(release:"4.0", prefix:"php4-mapscript", reference:"4.10.0-5.1+etch2")) flag++;
if (deb_check(release:"4.0", prefix:"php5-mapscript", reference:"4.10.0-5.1+etch2")) flag++;
if (deb_check(release:"4.0", prefix:"python-mapscript", reference:"4.10.0-5.1+etch2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");