Re: CVE Request -- MapServer -- Stack based buffer overflow [was: Re: [oss-security] Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.]

[Josh Bressers <bressers () redhat com>]

I'm assigning IDs as such:

CVE-2011-2703 mapserver SQL injection flaws
CVE-2011-2704 mapserver stack based buffer overflows

Thanks.

-- 
    JB

----- Original Message -----
> Alan, Even, thanks for your replies.
>
> Just to clarify this one a bit yet. Two CVE identifiers (one for the
> multiple SQL injection flaws, the other for the stack based buffer
> overflow issue) seem to be necessary in this case (due different
> versions affected):
>
> [1]
> http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
> On 07/19/2011 05:32 PM, Alan Boudreault wrote:
> > I got new from the debian security guy yesterday. I should get the
> > CVE id
> > soon.
> >
> > Thanks,
> > Alan
> >
> > On July 19, 2011 11:28:29 am Even Rouault wrote:
> > > Selon Jan Lieskovsky<jlieskov () redhat com>:
> > >
> > > Jan,
> > >
> > > I believe Alan Boudreault (MapServer team member that I've added to
> > > the CC
> > > list) has already asked the Debian security team to request for a
> > > CVE
> > > number, but without any result for now. Maybe he can confirm.
> > >
> > > Best regards,
> > >
> > > Even
> > >
> > > > Hello Josh, Steve, vendors,
> > > >
> > > >     the following has been brought to our attention:
> > > >     [1] https://bugzilla.redhat.com/show_bug.cgi?id=722545
> > > >     [2] http://trac.osgeo.org/mapserver/ticket/3903
> > > >
> > > > More from [2]:
> > > >
> > > > This ticket is to track fixes to prevent SQL injections through
> > > > OGC
> > > > filter encoding (in WMS, WFS and SOS), as well as a potential SQL
> > > > injection in WMS time support.
> > > >
> > > > Your system may be vulnerable if it has MapServer with OGC
> > > > protocols
> > > > enabled, with layers connecting to an SQL RDBMS backend, either
> > > > natively
> > > > or via OGR.
> > > >
> > > > All versions of MapServer 4.x, 5.x and 6.x are potentially
> > > > vulnerable.
> > > > All users are ** strongly encouraged ** to upgrade to one of the
> > > > latest
> > > > releases with the fixes.
> > > >
> > > > Could you allocate a CVE id for this?
> > > >
> > > > Thank you&& Regards, Jan.
> > > > --
> > > > Jan iankko Lieskovsky / Red Hat Security Response Team