CVE-2009-0841: Path Traversal

Published Mar 31, 2009

Updated

Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.

Affected Software

42 affected components

Umn Mapserver=4.0

Umn Mapserver=4.0-beta1

Umn Mapserver=4.0-beta2

OSGeo MapServer=4.2.0-beta1

OSGeo MapServer=4.4.0-beta1

OSGeo MapServer=4.4.0-beta2

OSGeo MapServer=4.6.0-beta1

OSGeo MapServer=4.6.0-beta2

OSGeo MapServer=4.6.0-beta3

OSGeo MapServer=4.8.0-beta2

OSGeo MapServer=4.8.0-beta1

OSGeo MapServer=4.8.0-beta3

OSGeo MapServer=4.8.0-rc2

OSGeo MapServer=4.8.0-rc1

OSGeo MapServer=4.10.0

OSGeo MapServer=4.10.0-beta1

OSGeo MapServer=4.10.0-rc1

OSGeo MapServer=4.10.0-beta3

OSGeo MapServer=4.10.0-beta2

OSGeo MapServer=4.10.2

OSGeo MapServer=4.10.1

OSGeo MapServer=4.10.3

OSGeo MapServer=5.0.0-beta5

OSGeo MapServer=5.0.0-beta6

OSGeo MapServer=5.0.0-beta3

OSGeo MapServer=5.0.0-beta4

OSGeo MapServer=5.0.0-beta1

OSGeo MapServer=5.0.0-beta2

OSGeo MapServer=5.0.0-rc1

OSGeo MapServer=5.2.0

OSGeo MapServer=5.2.0-beta2

OSGeo MapServer=5.2.0-beta1

OSGeo MapServer=5.2.0-beta3

OSGeo MapServer=5.2.0-beta4

OSGeo MapServer=5.2.0-rc1

OSGeo MapServer=5.2.1

OSGeo MapServer=4.6.0

OSGeo MapServer=4.6.0-rc1

OSGeo MapServer=5.0.0-rc2

OSGeo MapServer=5.0.0

OSGeo MapServer=4.4.0

OSGeo MapServer=4.4.0-beta3

Remediation

Patch Available

http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html

Event History

Mar 31, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:24 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0841?

CVE-2009-0841 is considered a medium-severity vulnerability due to its potential to allow unauthorized access to create arbitrary files.

Which versions are affected by CVE-2009-0841?

CVE-2009-0841 affects MapServer versions 4.x before 4.10.4 and 5.x before 5.2.2 running on Windows with Cygwin.

How do I fix CVE-2009-0841?

To fix CVE-2009-0841, you should upgrade MapServer to at least version 4.10.4 or 5.2.2.

What type of attack can exploit CVE-2009-0841?

CVE-2009-0841 can be exploited through directory traversal attacks, allowing attackers to manipulate file paths.

Is there a workaround for CVE-2009-0841 if I can't upgrade?

A possible workaround for CVE-2009-0841 is to restrict access to the MapServer application or filter out the id parameter.