CVE-2009-0840: Buffer Overflow

Published Mar 31, 2009

Updated

Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.

Affected Software

42 affected components

Umn Mapserver=4.0

Umn Mapserver=4.0-beta1

Umn Mapserver=4.0-beta2

OSGeo MapServer=4.2.0-beta1

OSGeo MapServer=4.4.0-beta1

OSGeo MapServer=4.4.0-beta2

OSGeo MapServer=4.6.0-beta1

OSGeo MapServer=4.6.0-beta2

OSGeo MapServer=4.6.0-beta3

OSGeo MapServer=4.8.0-beta2

OSGeo MapServer=4.8.0-beta1

OSGeo MapServer=4.8.0-beta3

OSGeo MapServer=4.8.0-rc2

OSGeo MapServer=4.8.0-rc1

OSGeo MapServer=4.10.0

OSGeo MapServer=4.10.0-beta1

OSGeo MapServer=4.10.0-rc1

OSGeo MapServer=4.10.0-beta3

OSGeo MapServer=4.10.0-beta2

OSGeo MapServer=4.10.2

OSGeo MapServer=4.10.1

OSGeo MapServer=4.10.3

OSGeo MapServer=5.0.0-beta5

OSGeo MapServer=5.0.0-beta6

OSGeo MapServer=5.0.0-beta3

OSGeo MapServer=5.0.0-beta4

OSGeo MapServer=5.0.0-beta1

OSGeo MapServer=5.0.0-beta2

OSGeo MapServer=5.0.0-rc1

OSGeo MapServer=5.2.0

OSGeo MapServer=5.2.0-beta2

OSGeo MapServer=5.2.0-beta1

OSGeo MapServer=5.2.0-beta3

OSGeo MapServer=5.2.0-beta4

OSGeo MapServer=5.2.0-rc1

OSGeo MapServer=5.2.1

OSGeo MapServer=4.6.0

OSGeo MapServer=4.6.0-rc1

OSGeo MapServer=5.0.0-rc2

OSGeo MapServer=5.0.0

OSGeo MapServer=4.4.0

OSGeo MapServer=4.4.0-beta3

Remediation

Patch Available

http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html

Event History

Mar 31, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:24 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0840?

CVE-2009-0840 has a high severity rating due to its potential to cause buffer underflows, leading to denial of service or remote code execution.

How do I fix CVE-2009-0840?

To fix CVE-2009-0840, upgrade to MapServer version 5.2.2 or later or update to the latest stable version that has addressed this vulnerability.

What systems are affected by CVE-2009-0840?

CVE-2009-0840 affects MapServer versions 4.x prior to 4.10.4 and 5.x prior to 5.2.2.

What type of vulnerability is CVE-2009-0840?

CVE-2009-0840 is classified as a heap-based buffer underflow vulnerability.

Can CVE-2009-0840 be exploited remotely?

Yes, CVE-2009-0840 can be exploited remotely by attackers through manipulated HTTP headers.