Ticket #2942 (closed defect: fixed)

Opened 3 years ago

Last modified 3 years ago

CGI "id" parameter not sufficiently validated, could allow for the creation of files on the file system

Reported by: sdlime Owned by: sdlime
Priority: high Milestone: 6.0 release
Component: MapServer C Library Version: unspecified
Severity: normal Keywords:
Cc: jmckenna, dmorissette

Description

The CGI parameter (used for pseudo session handling) is not sufficiently validated and could be used to create files outside of intended locations. The parameter is checked for length but not for content so inserting relative paths alters where MapServer will try to create temporary files.

The fix is to apply a regex pattern to limit an id's value.

Steve

Change History

Changed 3 years ago by sdlime

  • priority changed from normal to high
  • status changed from new to assigned

Changed 3 years ago by sdlime

Note that the current code also has an off-by-one error that doesn't take the null terminating character into consideration so a setting an id of 128 characters will trigger a buffer overflow. The regex check accounts for this by restricting the value to 1 less than IDSIZE as set in maptemplate.h.

Steve

Changed 3 years ago by sdlime

Referencing CVE-2009-0839 and CVE-2009-0841...

Changed 3 years ago by jmckenna

  • cc jmckenna added

Changed 3 years ago by dmorissette

  • cc dmorissette added

Changed 3 years ago by sdlime

  • milestone changed from 5.2.2 release to 5.4 release

Fixed r8805 for MapServer 5.2 branch. Fixed in r8823 for 4.10 branch. Moving to 5.4 now.

Steve

Changed 3 years ago by sdlime

  • milestone changed from 5.4 release to 6.0 release

Fixed in 5.4 branch in r8855, moving to 6.0/trunk.

Steve

Changed 3 years ago by sdlime

  • status changed from assigned to closed
  • resolution set to fixed

Fixed in trunk a while ago. Closing since there are no documentation issues.

Steve

Changed 3 years ago by sdlime

This bug references CVE-2009-1176...

Steve

Changed 3 years ago by aboudreault

Backported to branch-5-0 in r9199

Note: See TracTickets for help on using tickets.