[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] Mapserver for Windows (MS4W) Remote Code Execution
From:       Mike Arnold <bruk0ut.sec () gmail ! com>
Date:       2012-05-30 19:20:27
Message-ID: CAO6iudEugE=n9gs+04kkKNSncRn1cLVv02ixMkwotwrcVJGj7Q () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


-------------------
1) Overview

Title: Mapserver for Windows (MS4W) Remote Code Execution
Product: Mapserver for Windows (MS4W)
Product URL: http://maptools.org/ms4w/
Vendor: Gateway Geomatics
Affected Versions: <=3.0.4 through 2.0
Unaffected Versions: <2.0
CVE-ID: CVE-2012-2950
Vendor notified: 22/02/2012
Vendor fix: 26/05/2012
Severity: High
Credit: Mike Arnold
-------------------
2) Product information (quoted from website)

"The purpose of this package is to allow all levels of MapServer users to
quickly install a working environment for MapServer development on Windows.
It is also an environment for packaging and distributing MapServer
applications."
-------------------
3) Advisory detail

A vulnerability has been discovered in the base MS4W package where by an
attacker
can perform an LFI based attack and run arbitrary PHP code with SYSTEM
level privileges.
This vulnerability is present in MS4W installations with the default
configuration.
-------------------
4) Proof of Concept

An attacker can use basic TCP/IP tools (e.g netcat) and a web browser to
achieve remote code execution.
-------------------
4) Solution

Upgrade to version 3.0.6
http://maptools.org/ms4w/index.phtml?page=downloads.html
-------------------

Mike Arnold: bruk0ut.sec .::at::. gmail com
PGP Key ID: 0xC570B9F4

[Attachment #5 (text/html)]

<div>-------------------<br>1) Overview<br><br>Title: Mapserver for Windows (MS4W) Remote Code \
Execution<br>Product: Mapserver for Windows (MS4W)<br>Product URL: <a \
                href="http://maptools.org/ms4w/">http://maptools.org/ms4w/</a><br>
Vendor: Gateway Geomatics<br>Affected Versions: &lt;=3.0.4 through 2.0<br>Unaffected Versions: \
&lt;2.0<br>CVE-ID: CVE-2012-2950<br>Vendor notified: 22/02/2012<br>Vendor fix: \
                26/05/2012<br>Severity: High<br>Credit: Mike Arnold<br>
-------------------<br>2) Product information (quoted from website)<br><br>&quot;The purpose of \
this package is to allow all levels of MapServer users to<br>quickly install a working \
environment for MapServer development on Windows.<br> It is also an environment for packaging \
and distributing MapServer applications.&quot;<br>-------------------<br>3) Advisory \
detail<br><br>A vulnerability has been discovered in the base MS4W package where by an \
attacker<br> can perform an LFI based attack and run arbitrary PHP code with SYSTEM level \
privileges.<br>This vulnerability is present in MS4W installations with the default \
configuration.<br>-------------------<br>4) Proof of Concept<br> <br>An attacker can use basic \
TCP/IP tools (e.g netcat) and a web browser to achieve remote code \
execution.<br>-------------------<br>4) Solution<br><br>Upgrade to version 3.0.6<br><a \
href="http://maptools.org/ms4w/index.phtml?page=downloads.html">http://maptools.org/ms4w/index.phtml?page=downloads.html</a><br>
                
-------------------<br><br>Mike Arnold: bruk0ut.sec .::at::. gmail com<br>PGP Key ID: \
0xC570B9F4</div> <div> </div>



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[prev in list] [next in list] [prev in thread] [next in thread]