CVE-2009-0843
Publication date 31 March 2009
Last updated 24 July 2024
Ubuntu priority
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
Status
Package | Ubuntu Release | Status |
---|---|---|
mapserver | 9.10 karmic |
Not affected
|
9.04 jaunty |
Fixed 5.0.3-3ubuntu0.1
|
|
8.10 intrepid |
Fixed 5.0.3-2ubuntu0.1
|
|
8.04 LTS hardy |
Fixed 5.0.0-3ubuntu0.1
|
|
7.10 gutsy | Ignored end of life, was needed | |
6.06 LTS dapper | Ignored end of life |
Notes
jdstrand
this can only probe for files that are not present, useless when not in combination with another attack