CVE-2011-2703: SQL Injection
Multiple SQL injection flaws and one stack based buffer overflow flaw were found in MapServer: [1] http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
More from [1]:
MapServer developers have discovered flaws in the OGC filter support in MapServer. That code is used in support of WFS, WMS-SLD and SOS specifications.
All versions may be susceptible to SQL injection under certain circumstances. The extent of the vulnerability depends on the MapServer version, relational database and mapfile configuration being used. All users are strongly encouraged to upgrade to these latest releases.
The 5.6.7 and 4.10.7 releases also address one significant potentially exploitable buffer overflow (6.0 branch is not vulneralble).
References: [1] http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html [2] http://trac.osgeo.org/mapserver/ticket/3903 [3] https://bugzilla.redhat.com/showbug.cgi?id=722545 [4] http://www.openwall.com/lists/oss-security/2011/07/19/11 (CVE Request)
Relevant upstream patches: [5] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39036.0.x.patch (for 6.0.x branch) [6] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.6.x.patch (for 5.6.x branch) [7] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.4.x.patch (for 5.4.x branch) [8] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.2.x.patch (for 5.2.x branch) [9] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.0.x.patch (for 5.0.x branch) [10] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39034.10.x.patch (for 4.10.x branch)
Other sources
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2703?
CVE-2011-2703 has a medium severity rating due to the potential exploitation through SQL injection and buffer overflow vulnerabilities.
How do I fix CVE-2011-2703?
To fix CVE-2011-2703, update MapServer to a version later than 4.10.6 or apply the necessary patches provided by the maintainers.
What are the main vulnerabilities associated with CVE-2011-2703?
CVE-2011-2703 includes multiple SQL injection flaws and a stack-based buffer overflow flaw.
Which versions of MapServer are affected by CVE-2011-2703?
CVE-2011-2703 affects MapServer versions up to 4.10.6, as well as specific beta versions prior to 5.0.0.
Is there a workaround for CVE-2011-2703 if I can't upgrade?
While upgrading is the best solution for CVE-2011-2703, implementing input validation and sanitization can serve as a temporary workaround.