Vulnerabilities > CVE-2009-0841 - Path Traversal vulnerability in multiple products

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2009-3383.
#

include("compat.inc");

if (description)
{
  script_id(36091);
  script_version ("1.15");
  script_cvs_date("Date: 2019/08/02 13:32:29");

  script_cve_id("CVE-2009-0839", "CVE-2009-0840", "CVE-2009-0841", "CVE-2009-0842", "CVE-2009-0843", "CVE-2009-1176", "CVE-2009-1177");
  script_xref(name:"FEDORA", value:"2009-3383");

  script_name(english:"Fedora 9 : mapserver-5.2.2-1.fc9 (2009-3383)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The releases contain fixes for issues discovered in an audit of the
CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The
issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939
http://trac.osgeo.org/mapserver/ticket/2941
http://trac.osgeo.org/mapserver/ticket/2942
http://trac.osgeo.org/mapserver/ticket/2943
http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support
for RFC-56 that addresses tightening up the control of access to
mapfiles and templates:
http://mapserver.org/development/rfc/ms-rfc-56.html

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://mapserver.org/development/rfc/ms-rfc-56.html
  script_set_attribute(
    attribute:"see_also",
    value:"https://mapserver.org/development/rfc/ms-rfc-56.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2939"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2941"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2942"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2943"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2944"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=493364"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-April/022116.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?51c45a57"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected mapserver package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(20, 22, 119, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:9");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/07");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^9([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 9.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC9", reference:"mapserver-5.2.2-1.fc9")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mapserver");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2009-3357.
#

include("compat.inc");

if (description)
{
  script_id(37298);
  script_version ("1.14");
  script_cvs_date("Date: 2019/08/02 13:32:29");

  script_cve_id("CVE-2009-0839", "CVE-2009-0840", "CVE-2009-0841", "CVE-2009-0842", "CVE-2009-0843", "CVE-2009-1176", "CVE-2009-1177");
  script_xref(name:"FEDORA", value:"2009-3357");

  script_name(english:"Fedora 10 : mapserver-5.2.2-1.fc10 (2009-3357)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The releases contain fixes for issues discovered in an audit of the
CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The
issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939
http://trac.osgeo.org/mapserver/ticket/2941
http://trac.osgeo.org/mapserver/ticket/2942
http://trac.osgeo.org/mapserver/ticket/2943
http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support
for RFC-56 that addresses tightening up the control of access to
mapfiles and templates:
http://mapserver.org/development/rfc/ms-rfc-56.html

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://mapserver.org/development/rfc/ms-rfc-56.html
  script_set_attribute(
    attribute:"see_also",
    value:"https://mapserver.org/development/rfc/ms-rfc-56.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2939"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2941"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2942"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2943"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://trac.osgeo.org/mapserver/ticket/2944"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=493364"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-April/022093.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?7a686300"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected mapserver package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(20, 22, 119, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:10");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^10([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 10.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC10", reference:"mapserver-5.2.2-1.fc10")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mapserver");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
 script_id(36074);
 script_version("1.15");
 script_cvs_date("Date: 2018/11/15 20:50:17");

 script_cve_id("CVE-2009-0839",
               "CVE-2009-0840",
               "CVE-2009-0841",
               "CVE-2009-0842",
               "CVE-2009-0843",
               "CVE-2009-1176",
               "CVE-2009-1177");
 script_bugtraq_id(34306);
 script_xref(name:"Secunia", value:"34520");

 script_name(english:"MapServer < 5.2.2 / 4.10.4 Multiple Flaws");
 script_summary(english:"Performs a banner check");

 script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a CGI script that is affected by
multiple flaws.");
 script_set_attribute(attribute:"description", value:
"The remote host is running MapServer, an open source Internet map
server. The installed version of MapServer is affected by multiple
flaws :

  - By creating a map file with overly long IMAGEPATH and/or
    NAME attribute(s), it may be possible to trigger a
    stack-based buffer overflow. (CVE-2009-0839)

  - It may be possible to trigger a heap-based buffer
    overflow by sending a HTTP POST request with
    'CONTENT_LENGTH' attribute set to '-1'. (CVE-2009-0840)
    Note: According to some reports this issue might have
    been incorrectly fixed, see references for more info.

  - It may be possible to create arbitrary files by
    specifying file names to the 'id' parameter.
    (CVE-2009-0841)

  - Provided an attacker has privileges to create symlinks
    on the file system, it may be possible to partially read
    the contents of arbitrary files. (CVE-2009-0842)

  - Provided an attacker has knowledge of a valid map file,
    it may be possible to determine if an arbitrary file
    exists on the remote system. (CVE-2009-0843)

  - Sufficient boundary checks are not performed on 'id'
    parameter in mapserver.c. An attacker may exploit
    this issue to trigger a buffer overflow condition
    resulting in arbitrary code execution on the remote
    system. (CVE-2009-1176)

  - File maptemplate.c is affected by multiple stack-based
    overflow issues. (CVE-2009-1177)");
 script_set_attribute(attribute:"see_also", value:"https://www.positronsecurity.com/advisories/2009-000.html");
 script_set_attribute(attribute:"see_also", value:"http://permalink.gmane.org/gmane.comp.security.oss.general/1861");
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2009/Mar/442");
 script_set_attribute(attribute:"see_also", value:"https://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html");
 script_set_attribute(attribute:"solution", value:"Upgrade to MapServer 5.2.2/4.10.4.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_cwe_id(20, 22, 119, 200);

 script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/02");

 script_set_attribute(attribute:"potential_vulnerability", value:"true");
 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_family(english:"CGI abuses");

 script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

 script_dependencies("mapserver_detect.nasl");
 script_require_ports("Services/www", 80);
 script_require_keys("www/mapserver", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("http.inc");
include("misc_func.inc");
include("webapp_func.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

app_name = "MapServer";
port = get_http_port(default:80);
install = get_install_from_kb(appname:'mapserver', port:port, exit_on_fail:TRUE);
version = install['ver'];
url = build_url(port:port, qs:install['dir']);

# Determine fixed version from branch.
if (version =~ "^[0-4]($|[-\.])") fix = "4.10.4";
else if (version =~ "^5($|[-\.])") fix = "5.2.2";
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url, version);

if (ver_compare(app:'asterisk', ver:version, fix:fix) == -1 )
{
  if(report_verbosity > 0)
  {
    report =
      '\n  URL           : ' + url +
      '\n  Version       : ' + version +
      '\n  Fixed version : ' + fix +
      '\n';
    security_hole(port:port,extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url, version);

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-1914. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(44779);
  script_version("1.12");
  script_cvs_date("Date: 2019/08/02 13:32:22");

  script_cve_id("CVE-2009-0839", "CVE-2009-0840", "CVE-2009-0841", "CVE-2009-0842", "CVE-2009-0843", "CVE-2009-2281");
  script_xref(name:"DSA", value:"1914");

  script_name(english:"Debian DSA-1914-1 : mapserver - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several vulnerabilities have been discovered in mapserver, a CGI-based
web framework to publish spatial data and interactive mapping
applications. The Common Vulnerabilities and Exposures project
identifies the following problems :

  - CVE-2009-0843
    Missing input validation on a user-supplied map
    queryfile name can be used by an attacker to check for
    the existence of a specific file by using the queryfile
    GET parameter and checking for differences in error
    messages.

  - CVE-2009-0842
    A lack of file type verification when parsing a map file
    can lead to partial disclosure of content from arbitrary
    files through parser error messages.

  - CVE-2009-0841
    Due to missing input validation when saving map files
    under certain conditions it is possible to perform
    directory traversal attacks and to create arbitrary
    files. NOTE: Unless the attacker is able to create
    directories in the image path or there is already a
    readable directory this doesn't affect installations on
    Linux as the fopen() syscall will fail in case a sub
    path is not readable.

  - CVE-2009-0839
    It was discovered that mapserver is vulnerable to a
    stack-based buffer overflow when processing certain GET
    parameters. An attacker can use this to execute
    arbitrary code on the server via crafted id parameters.

  - CVE-2009-0840
    An integer overflow leading to a heap-based buffer
    overflow when processing the Content-Length header of an
    HTTP request can be used by an attacker to execute
    arbitrary code via crafted POST requests containing
    negative Content-Length values.

  - CVE-2009-2281
    An integer overflow when processing HTTP requests can
    lead to a heap-based buffer overflow. An attacker can
    use this to execute arbitrary code either via crafted
    Content-Length values or large HTTP request. This is
    partly because of an incomplete fix for CVE-2009-0840."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0843"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0842"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0841"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0839"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0840"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-2281"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2009-0840"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2009/dsa-1914"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the mapserver packages.

For the oldstable distribution (etch), this problem has been fixed in
version 4.10.0-5.1+etch4.

For the stable distribution (lenny), this problem has been fixed in
version 5.0.3-3+lenny4."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(20, 22, 119, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mapserver");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"4.0", prefix:"cgi-mapserver", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"4.0", prefix:"mapserver-bin", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"4.0", prefix:"mapserver-doc", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"4.0", prefix:"perl-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"4.0", prefix:"php4-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"4.0", prefix:"php5-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"4.0", prefix:"python-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
if (deb_check(release:"5.0", prefix:"cgi-mapserver", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"libmapscript-ruby", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"libmapscript-ruby1.8", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"libmapscript-ruby1.9", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"mapserver-bin", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"mapserver-doc", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"perl-mapscript", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"php5-mapscript", reference:"5.0.3-3+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"python-mapscript", reference:"5.0.3-3+lenny4")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");