PT-2009-3735 · Mapserver · Mapserver

Joe Testa · Publicado 2009-03-31 · Atualizado 2021-06-07 · CVE-2009-1176

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MapServer versions 4.x through 4.10.3 MapServer versions 5.x through 5.2.1

Description The issue allows remote attackers to conduct buffer-overflow attacks via a long id parameter in a query action, due to the failure of mapserv.c in mapserv to ensure that the string holding the id parameter ends in a '0' character.

Recommendations For MapServer versions 4.x through 4.10.3, update to version 4.10.4 or later. For MapServer versions 5.x through 5.2.1, update to version 5.2.2 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-1176

DSA-1914-1

Produtos afetados

Mapserver

Referências · 13

• 🔥 http://positronsecurity.com/advisories/2009-000.html · Exploit
• http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1176 · Aviso do Fabricante
• http://securityfocus.com/bid/34306 · Nota
• http://secunia.com/advisories/34603 · Nota
• http://securityfocus.com/archive/1/502271/100/0/threaded · Nota
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00147.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2009-1176 · Aviso do Fabricante
• http://securitytracker.com/id?1021952 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00170.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-1176 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1176 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1176 · Nota