CVE-2009-0843: Input Validation

Published Mar 31, 2009

Updated

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.

Affected Software

42 affected components

OSGeo MapServer=4.2.0-beta1

OSGeo MapServer=4.4.0

OSGeo MapServer=4.4.0-beta1

OSGeo MapServer=4.4.0-beta2

OSGeo MapServer=4.4.0-beta3

OSGeo MapServer=4.6.0

OSGeo MapServer=4.6.0-beta1

OSGeo MapServer=4.6.0-beta2

OSGeo MapServer=4.6.0-beta3

OSGeo MapServer=4.6.0-rc1

OSGeo MapServer=4.8.0-beta1

OSGeo MapServer=4.8.0-beta2

OSGeo MapServer=4.8.0-beta3

OSGeo MapServer=4.8.0-rc1

OSGeo MapServer=4.8.0-rc2

OSGeo MapServer=4.10.0

OSGeo MapServer=4.10.0-beta1

OSGeo MapServer=4.10.0-beta2

OSGeo MapServer=4.10.0-beta3

OSGeo MapServer=4.10.0-rc1

OSGeo MapServer=4.10.1

OSGeo MapServer=4.10.2

OSGeo MapServer=4.10.3

OSGeo MapServer=5.0.0

OSGeo MapServer=5.0.0-beta1

OSGeo MapServer=5.0.0-beta2

OSGeo MapServer=5.0.0-beta3

OSGeo MapServer=5.0.0-beta4

OSGeo MapServer=5.0.0-beta5

OSGeo MapServer=5.0.0-beta6

OSGeo MapServer=5.0.0-rc1

OSGeo MapServer=5.0.0-rc2

OSGeo MapServer=5.2.0

OSGeo MapServer=5.2.0-beta1

OSGeo MapServer=5.2.0-beta2

OSGeo MapServer=5.2.0-beta3

OSGeo MapServer=5.2.0-beta4

OSGeo MapServer=5.2.0-rc1

OSGeo MapServer=5.2.1

Umn Mapserver=4.0

Umn Mapserver=4.0-beta1

Umn Mapserver=4.0-beta2

Remediation

Patch Available

http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html

Event History

Mar 31, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:24 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0843?

CVE-2009-0843 is classified as a moderate severity vulnerability due to the information disclosure it can cause.

How do I fix CVE-2009-0843?

To fix CVE-2009-0843, upgrade to MapServer version 4.10.4 or higher, or 5.2.2 or higher.

What causes CVE-2009-0843?

CVE-2009-0843 is caused by the msLoadQuery function allowing remote attackers to ascertain the existence of files via error messages.

Which software versions are affected by CVE-2009-0843?

CVE-2009-0843 affects MapServer versions 4.x before 4.10.4 and 5.x before 5.2.2.

Is CVE-2009-0843 a critical vulnerability?

No, CVE-2009-0843 is not considered critical; it primarily poses a risk of information disclosure.