Summary
The remote host is missing an update to mapserver
announced via advisory DSA 2078-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202078-1
Insight
Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications.
The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2010-2539
A stack-based buffer overflow in the msTmpFile function might lead to arbitrary code execution under some conditions.
CVE-2010-2540
It was discovered that the CGI debug command-line arguments which are enabled by default are insecure and may allow a remote attacker to execute arbitrary code. Therefore they have been disabled by default.
For the stable distribution (lenny), this problem has been fixed in version 5.0.3-3+lenny5.
For the testing distribution (squeeze), this problem has been fixed in version 5.6.4-1.
For the unstable distribution (sid), this problem has been fixed in version 5.6.4-1.
We recommend that you upgrade your mapserver packages.
Severity
Classification
-
CVE CVE-2010-2539, CVE-2010-2540 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities