Mapserver for Windows本地文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1172728 漏洞类型 Input Validation Error
发布时间 2012-05-30 更新时间 2012-05-30
CVE编号 CVE-2012-2950 CNNVD-ID CNNVD-201205-542
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://www.securityfocus.com/bid/53737
https://cxsecurity.com/issue/WLB-2012050231
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201205-542
|漏洞详情
MapServer是由美国明尼苏达大学(Minnesota)所研发的一个基于C语言的开源地图数据渲染引擎,它能够用来显示空间数据并在网络上实现交互式地图应用(例如创建“地理影像地图”)。MapserverforWindows中存在未明本地文件包含漏洞,该漏洞源于对用户提供的输入未经充分过滤。攻击者可利用该漏洞查看文件,以受影响应用程序的权限执行任意本地PHP脚本。MapserverforWindows2.0版本至3.0.4版本中存在该漏洞。
|漏洞EXP
-------------------
1) Overview

Title: Mapserver for Windows (MS4W) Remote Code Execution
Product: Mapserver for Windows (MS4W)
Product URL: http://maptools.org/ms4w/
Vendor: Gateway Geomatics
Affected Versions: <=3.0.4 through 2.0
Unaffected Versions: <2.0
CVE-ID: CVE-2012-2950
Vendor notified: 22/02/2012
Vendor fix: 26/05/2012
Severity:  High
Credit: Mike Arnold
-------------------
2) Product information (quoted from website)

"The purpose of this package is to allow all levels of MapServer users to
quickly install a working environment for MapServer development on Windows.
It is also an environment for packaging and distributing MapServer applications."
-------------------
3) Advisory detail

A vulnerability has been discovered in the base MS4W package where by an attacker
can perform an LFI based attack and run arbitrary PHP code with SYSTEM level privileges.
This vulnerability is present in MS4W installations with the default configuration.
-------------------
4) Proof of Concept

An attacker can use basic TCP/IP tools (e.g netcat) and a web browser to achieve remote code execution.
-------------------
4) Solution

Upgrade to version 3.0.6
http://maptools.org/ms4w/index.phtml?page=downloads.html
-------------------

Mike Arnold: bruk0ut.sec  .::at::.  gmail com
PGP Key ID: 0xC570B9F4
|受影响的产品
Gateway Geomatics MapServer for Windows 3.0.4 Gateway Geomatics MapServer for Windows 2.0
|参考资料

来源:BID
名称:53737
链接:http://www.securityfocus.com/bid/53737