Test ID:	1.3.6.1.4.1.25623.1.0.66097
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1914-1)
Summary:	The remote host is missing an update for the Debian 'mapserver' package(s) announced via the DSA-1914-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'mapserver' package(s) announced via the DSA-1914-1 advisory. Vulnerability Insight: Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0843 Missing input validation on a user supplied map queryfile name can be used by an attacker to check for the existence of a specific file by using the queryfile GET parameter and checking for differences in error messages. CVE-2009-0842 A lack of file type verification when parsing a map file can lead to partial disclosure of content from arbitrary files through parser error messages. CVE-2009-0841 Due to missing input validation when saving map files under certain conditions it is possible to perform directory traversal attacks and to create arbitrary files. NOTE: Unless the attacker is able to create directories in the image path or there is already a readable directory this doesn't affect installations on Linux as the fopen() syscall will fail in case a sub path is not readable. CVE-2009-0839 It was discovered that mapserver is vulnerable to a stack-based buffer overflow when processing certain GET parameters. An attacker can use this to execute arbitrary code on the server via crafted id parameters. CVE-2009-0840 An integer overflow leading to a heap-based buffer overflow when processing the Content-Length header of an HTTP request can be used by an attacker to execute arbitrary code via crafted POST requests containing negative Content-Length values. CVE-2009-2281 An integer overflow when processing HTTP requests can lead to a heap-based buffer overflow. An attacker can use this to execute arbitrary code either via crafted Content-Length values or large HTTP request. This is partly because of an incomplete fix for CVE-2009-0840. For the oldstable distribution (etch), this problem has been fixed in version 4.10.0-5.1+etch4. For the stable distribution (lenny), this problem has been fixed in version 5.0.3-3+lenny4. For the testing distribution (squeeze), this problem has been fixed in version 5.4.2-1. For the unstable distribution (sid), this problem has been fixed in version 5.4.2-1. We recommend that you upgrade your mapserver packages. Affected Software/OS: 'mapserver' package(s) on Debian 4, Debian 5. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0839 BugTraq ID: 34306 http://www.securityfocus.com/bid/34306 Bugtraq: 20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3 (Google Search) http://www.securityfocus.com/archive/1/502271/100/0/threaded Debian Security Information: DSA-1914 (Google Search) http://www.debian.org/security/2009/dsa-1914 https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html http://www.positronsecurity.com/advisories/2009-000.html http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html http://www.securitytracker.com/id?1021952 http://secunia.com/advisories/34520 http://secunia.com/advisories/34603 Common Vulnerability Exposure (CVE) ID: CVE-2009-0840 XForce ISS Database: mapserver-contentlength-bo(49545) https://exchange.xforce.ibmcloud.com/vulnerabilities/49545 Common Vulnerability Exposure (CVE) ID: CVE-2009-0841 XForce ISS Database: mapserver-mapserv-dir-traversal(49548) https://exchange.xforce.ibmcloud.com/vulnerabilities/49548 Common Vulnerability Exposure (CVE) ID: CVE-2009-0842 Common Vulnerability Exposure (CVE) ID: CVE-2009-0843 Common Vulnerability Exposure (CVE) ID: CVE-2009-1176 Common Vulnerability Exposure (CVE) ID: CVE-2009-2281 http://www.openwall.com/lists/oss-security/2009/07/01/1 http://www.openwall.com/lists/oss-security/2009/07/01/6
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.