Vulnerabilities > CVE-2009-0842 - Information Exposure vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
osgeo
umn
CWE-200
nessus

Summary

mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-3383.NASL
    descriptionThe releases contain fixes for issues discovered in an audit of the CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939 http://trac.osgeo.org/mapserver/ticket/2941 http://trac.osgeo.org/mapserver/ticket/2942 http://trac.osgeo.org/mapserver/ticket/2943 http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support for RFC-56 that addresses tightening up the control of access to mapfiles and templates: http://mapserver.org/development/rfc/ms-rfc-56.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id36091
    published2009-04-07
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36091
    titleFedora 9 : mapserver-5.2.2-1.fc9 (2009-3383)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2009-3383.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(36091);
      script_version ("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:29");
    
      script_cve_id("CVE-2009-0839", "CVE-2009-0840", "CVE-2009-0841", "CVE-2009-0842", "CVE-2009-0843", "CVE-2009-1176", "CVE-2009-1177");
      script_xref(name:"FEDORA", value:"2009-3383");
    
      script_name(english:"Fedora 9 : mapserver-5.2.2-1.fc9 (2009-3383)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The releases contain fixes for issues discovered in an audit of the
    CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The
    issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939
    http://trac.osgeo.org/mapserver/ticket/2941
    http://trac.osgeo.org/mapserver/ticket/2942
    http://trac.osgeo.org/mapserver/ticket/2943
    http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support
    for RFC-56 that addresses tightening up the control of access to
    mapfiles and templates:
    http://mapserver.org/development/rfc/ms-rfc-56.html
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://mapserver.org/development/rfc/ms-rfc-56.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://mapserver.org/development/rfc/ms-rfc-56.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2939"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2941"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2942"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2943"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2944"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=493364"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2009-April/022116.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?51c45a57"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected mapserver package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 22, 119, 200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:9");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/07");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^9([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 9.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC9", reference:"mapserver-5.2.2-1.fc9")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mapserver");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-3357.NASL
    descriptionThe releases contain fixes for issues discovered in an audit of the CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939 http://trac.osgeo.org/mapserver/ticket/2941 http://trac.osgeo.org/mapserver/ticket/2942 http://trac.osgeo.org/mapserver/ticket/2943 http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support for RFC-56 that addresses tightening up the control of access to mapfiles and templates: http://mapserver.org/development/rfc/ms-rfc-56.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id37298
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/37298
    titleFedora 10 : mapserver-5.2.2-1.fc10 (2009-3357)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2009-3357.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(37298);
      script_version ("1.14");
      script_cvs_date("Date: 2019/08/02 13:32:29");
    
      script_cve_id("CVE-2009-0839", "CVE-2009-0840", "CVE-2009-0841", "CVE-2009-0842", "CVE-2009-0843", "CVE-2009-1176", "CVE-2009-1177");
      script_xref(name:"FEDORA", value:"2009-3357");
    
      script_name(english:"Fedora 10 : mapserver-5.2.2-1.fc10 (2009-3357)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The releases contain fixes for issues discovered in an audit of the
    CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944). The
    issues are detailed at: http://trac.osgeo.org/mapserver/ticket/2939
    http://trac.osgeo.org/mapserver/ticket/2941
    http://trac.osgeo.org/mapserver/ticket/2942
    http://trac.osgeo.org/mapserver/ticket/2943
    http://trac.osgeo.org/mapserver/ticket/2944 Also provided is support
    for RFC-56 that addresses tightening up the control of access to
    mapfiles and templates:
    http://mapserver.org/development/rfc/ms-rfc-56.html
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://mapserver.org/development/rfc/ms-rfc-56.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://mapserver.org/development/rfc/ms-rfc-56.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2939"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2941"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2942"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2943"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://trac.osgeo.org/mapserver/ticket/2944"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=493364"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2009-April/022093.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7a686300"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected mapserver package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 22, 119, 200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mapserver");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/04/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^10([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 10.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC10", reference:"mapserver-5.2.2-1.fc10")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mapserver");
    }
    
  • NASL familyCGI abuses
    NASL idMAPSERVER_5_2_2.NASL
    descriptionThe remote host is running MapServer, an open source Internet map server. The installed version of MapServer is affected by multiple flaws : - By creating a map file with overly long IMAGEPATH and/or NAME attribute(s), it may be possible to trigger a stack-based buffer overflow. (CVE-2009-0839) - It may be possible to trigger a heap-based buffer overflow by sending a HTTP POST request with
    last seen2020-06-01
    modified2020-06-02
    plugin id36074
    published2009-04-02
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/36074
    titleMapServer < 5.2.2 / 4.10.4 Multiple Flaws
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
     script_id(36074);
     script_version("1.15");
     script_cvs_date("Date: 2018/11/15 20:50:17");
    
     script_cve_id("CVE-2009-0839",
                   "CVE-2009-0840",
                   "CVE-2009-0841",
                   "CVE-2009-0842",
                   "CVE-2009-0843",
                   "CVE-2009-1176",
                   "CVE-2009-1177");
     script_bugtraq_id(34306);
     script_xref(name:"Secunia", value:"34520");
    
     script_name(english:"MapServer < 5.2.2 / 4.10.4 Multiple Flaws");
     script_summary(english:"Performs a banner check");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote web server contains a CGI script that is affected by
    multiple flaws.");
     script_set_attribute(attribute:"description", value:
    "The remote host is running MapServer, an open source Internet map
    server. The installed version of MapServer is affected by multiple
    flaws :
    
      - By creating a map file with overly long IMAGEPATH and/or
        NAME attribute(s), it may be possible to trigger a
        stack-based buffer overflow. (CVE-2009-0839)
    
      - It may be possible to trigger a heap-based buffer
        overflow by sending a HTTP POST request with
        'CONTENT_LENGTH' attribute set to '-1'. (CVE-2009-0840)
        Note: According to some reports this issue might have
        been incorrectly fixed, see references for more info.
    
      - It may be possible to create arbitrary files by
        specifying file names to the 'id' parameter.
        (CVE-2009-0841)
    
      - Provided an attacker has privileges to create symlinks
        on the file system, it may be possible to partially read
        the contents of arbitrary files. (CVE-2009-0842)
    
      - Provided an attacker has knowledge of a valid map file,
        it may be possible to determine if an arbitrary file
        exists on the remote system. (CVE-2009-0843)
    
      - Sufficient boundary checks are not performed on 'id'
        parameter in mapserver.c. An attacker may exploit
        this issue to trigger a buffer overflow condition
        resulting in arbitrary code execution on the remote
        system. (CVE-2009-1176)
    
      - File maptemplate.c is affected by multiple stack-based
        overflow issues. (CVE-2009-1177)");
     script_set_attribute(attribute:"see_also", value:"https://www.positronsecurity.com/advisories/2009-000.html");
     script_set_attribute(attribute:"see_also", value:"http://permalink.gmane.org/gmane.comp.security.oss.general/1861");
     script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2009/Mar/442");
     script_set_attribute(attribute:"see_also", value:"https://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html");
     script_set_attribute(attribute:"solution", value:"Upgrade to MapServer 5.2.2/4.10.4.");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
     script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"true");
     script_cwe_id(20, 22, 119, 200);
    
     script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/02");
    
     script_set_attribute(attribute:"potential_vulnerability", value:"true");
     script_set_attribute(attribute:"plugin_type", value:"remote");
     script_end_attributes();
    
     script_category(ACT_GATHER_INFO);
     script_family(english:"CGI abuses");
    
     script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
     script_dependencies("mapserver_detect.nasl");
     script_require_ports("Services/www", 80);
     script_require_keys("www/mapserver", "Settings/ParanoidReport");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("http.inc");
    include("misc_func.inc");
    include("webapp_func.inc");
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    app_name = "MapServer";
    port = get_http_port(default:80);
    install = get_install_from_kb(appname:'mapserver', port:port, exit_on_fail:TRUE);
    version = install['ver'];
    url = build_url(port:port, qs:install['dir']);
    
    # Determine fixed version from branch.
    if (version =~ "^[0-4]($|[-\.])") fix = "4.10.4";
    else if (version =~ "^5($|[-\.])") fix = "5.2.2";
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url, version);
    
    if (ver_compare(app:'asterisk', ver:version, fix:fix) == -1 )
    {
      if(report_verbosity > 0)
      {
        report =
          '\n  URL           : ' + url +
          '\n  Version       : ' + version +
          '\n  Fixed version : ' + fix +
          '\n';
        security_hole(port:port,extra:report);
      }
      else security_hole(port);
      exit(0);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url, version);
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1914.NASL
    descriptionSeveral vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0843 Missing input validation on a user-supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. - CVE-2009-0842 A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. - CVE-2009-0841 Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn
    last seen2020-06-01
    modified2020-06-02
    plugin id44779
    published2010-02-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44779
    titleDebian DSA-1914-1 : mapserver - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-1914. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(44779);
      script_version("1.12");
      script_cvs_date("Date: 2019/08/02 13:32:22");
    
      script_cve_id("CVE-2009-0839", "CVE-2009-0840", "CVE-2009-0841", "CVE-2009-0842", "CVE-2009-0843", "CVE-2009-2281");
      script_xref(name:"DSA", value:"1914");
    
      script_name(english:"Debian DSA-1914-1 : mapserver - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in mapserver, a CGI-based
    web framework to publish spatial data and interactive mapping
    applications. The Common Vulnerabilities and Exposures project
    identifies the following problems :
    
      - CVE-2009-0843
        Missing input validation on a user-supplied map
        queryfile name can be used by an attacker to check for
        the existence of a specific file by using the queryfile
        GET parameter and checking for differences in error
        messages.
    
      - CVE-2009-0842
        A lack of file type verification when parsing a map file
        can lead to partial disclosure of content from arbitrary
        files through parser error messages.
    
      - CVE-2009-0841
        Due to missing input validation when saving map files
        under certain conditions it is possible to perform
        directory traversal attacks and to create arbitrary
        files. NOTE: Unless the attacker is able to create
        directories in the image path or there is already a
        readable directory this doesn't affect installations on
        Linux as the fopen() syscall will fail in case a sub
        path is not readable.
    
      - CVE-2009-0839
        It was discovered that mapserver is vulnerable to a
        stack-based buffer overflow when processing certain GET
        parameters. An attacker can use this to execute
        arbitrary code on the server via crafted id parameters.
    
      - CVE-2009-0840
        An integer overflow leading to a heap-based buffer
        overflow when processing the Content-Length header of an
        HTTP request can be used by an attacker to execute
        arbitrary code via crafted POST requests containing
        negative Content-Length values.
    
      - CVE-2009-2281
        An integer overflow when processing HTTP requests can
        lead to a heap-based buffer overflow. An attacker can
        use this to execute arbitrary code either via crafted
        Content-Length values or large HTTP request. This is
        partly because of an incomplete fix for CVE-2009-0840."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0843"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0842"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0841"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0839"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0840"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-2281"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0840"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2009/dsa-1914"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the mapserver packages.
    
    For the oldstable distribution (etch), this problem has been fixed in
    version 4.10.0-5.1+etch4.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 5.0.3-3+lenny4."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 22, 119, 200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mapserver");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/10/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"4.0", prefix:"cgi-mapserver", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"mapserver-bin", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"mapserver-doc", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"perl-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"php4-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"php5-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"python-mapscript", reference:"4.10.0-5.1+etch4")) flag++;
    if (deb_check(release:"5.0", prefix:"cgi-mapserver", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libmapscript-ruby", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libmapscript-ruby1.8", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libmapscript-ruby1.9", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"mapserver-bin", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"mapserver-doc", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"perl-mapscript", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"php5-mapscript", reference:"5.0.3-3+lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"python-mapscript", reference:"5.0.3-3+lenny4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 34306 CVE(CAN) ID: CVE-2009-0839,CVE-2009-0840,CVE-2009-0841,CVE-2009-0843,CVE-2009-0842,CVE-2009-1176,CVE-2009-1177 MapServer是用于创建交互式地图应用的多平台程序。 MapServer中存在多个安全漏洞,可能允许远程攻击者泄露敏感信息、绕过安全限制、导致拒绝服务或入侵有漏洞的系统。 1) 如果远程攻击者向服务器上传了恶意地图文件或通过id参数传送了包含有超过128字节字符串的特制请求的话,就可以在mapserv CGI程序中触发栈溢出,导致执行任意代码。以下是mapserv.c中有漏洞的代码段: 406: strncpy(mapserv-&gt;Id, mapserv-&gt;request-&gt;ParamValues[i], IDSIZE); 1112: int main(int argc, char *argv[]) { 1114: char buffer[1024], *value=NULL; 1783: sprintf(buffer, \&quot;%s%s%s%s\&quot;, mapserv-&gt;map-&gt;web.imagepath, \\ mapserv-&gt;map-&gt;name, mapserv-&gt;Id, MS_QUERY_EXTENSION); 1826: } 2) mapserv CGI程序在处理Content-Length头时存在索引错误,远程攻击者可以通过提交特制的POST请求触发堆溢出,导致越界数组访问。成功攻击要求web服务器没有过滤Content-Length头。 3) 由于没有过滤对mapserv CGI程序所传送的id参数,远程攻击者可以通过目录遍历攻击向任意位置写入文件。以下是有漏洞部分的代码段: [mapserv.c] 1783: sprintf(buffer, \&quot;%s%s%s%s\&quot;, mapserv-&gt;map-&gt;web.imagepath, \\ mapserv-&gt;map-&gt;name, mapserv-&gt;Id, MS_QUERY_EXTENSION); 1784: if((status = msSaveQuery(mapserv-&gt;map, buffer)) != MS_SUCCESS) \\ return status; [mapquery.c] 89: stream = fopen(filename, \&quot;wb\&quot;); 90: if(!stream) { 91: [...] 92: return(MS_FAILURE); 93: } 4) 如果攻击者在.map文件中通过map参数指定了完整路径,则mapserv CGI程序在处理该文件时就会泄露文件中的敏感信息。 5) mapserv CGI程序对系统中是否存在的文件会返回不同的错误消息,远程攻击者可以利用queryfile请求参数判断是否存在特定的文件。 6) 特制的地图文件可以在maptemplate.c的msGenerateImages()函数中触发栈溢出。 University of Minnesota MapServer 5.2.1 University of Minnesota MapServer 4.10.3 University of Minnesota ----------------------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://download.osgeo.org/mapserver/mapserver-4.10.4.tar.gz target=_blank rel=external nofollow>http://download.osgeo.org/mapserver/mapserver-4.10.4.tar.gz</a> <a href=http://download.osgeo.org/mapserver/mapserver-5.2.2.tar.gz target=_blank rel=external nofollow>http://download.osgeo.org/mapserver/mapserver-5.2.2.tar.gz</a>
idSSV:4975
last seen2017-11-19
modified2009-04-02
published2009-04-02
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-4975
titleMapServer mapserv程序多个远程安全漏洞