Vulnerability-Lookup

FKIE_CVE-2009-0840

Vulnerability from fkie_nvd - Published: 2009-03-31 18:24 - Updated: 2026-06-16 23:05

Severity

Summary

Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.

References

URL	Tags
cve@mitre.org	http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html	Patch
cve@mitre.org	http://secunia.com/advisories/34520
cve@mitre.org	http://secunia.com/advisories/34603
cve@mitre.org	http://trac.osgeo.org/mapserver/ticket/2943	Vendor Advisory
cve@mitre.org	http://www.debian.org/security/2009/dsa-1914
cve@mitre.org	http://www.positronsecurity.com/advisories/2009-000.html	Exploit
cve@mitre.org	http://www.securityfocus.com/archive/1/502271/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/34306
cve@mitre.org	http://www.securitytracker.com/id?1021952
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/49545
cve@mitre.org	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html
cve@mitre.org	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html	Patch
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/34520
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/34603
af854a3a-2127-422b-91ae-364da2661108	http://trac.osgeo.org/mapserver/ticket/2943	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2009/dsa-1914
af854a3a-2127-422b-91ae-364da2661108	http://www.positronsecurity.com/advisories/2009-000.html	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/502271/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/34306
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1021952
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/49545
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html

Impacted products

Vendor	Product	Version
osgeo	mapserver	4.2.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.1
osgeo	mapserver	4.10.2
osgeo	mapserver	4.10.3
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.1
umn	mapserver	4.0
umn	mapserver	4.0
umn	mapserver	4.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.2.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7362D32E-07AF-4DFB-A7EE-B92A2949FCC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16812C55-8E9F-4035-92E6-D2C7AF4F5B9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "5C11F257-809F-4F7C-B5B1-5D407B983DEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "3AFFE501-B4E0-4352-8C8D-44531E8A6ED3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "426DC6E0-2DA2-4815-B08B-EE2CF20AE3AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBEE70D8-0EC2-4855-81C8-9FECCD9C16BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "FE55464C-FD27-47BF-9941-26EE7968BF70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "E01A6111-3A73-4033-8333-4929A6A22CA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "CE4F9152-4BA9-4742-9041-9707BB4B505F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "7F27BB1D-165E-4414-AB9B-5BBDF4268F73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "9305883D-8626-448C-8B1A-074158F518DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "04D30449-7EEB-42C4-9F11-4E6EE39C18F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "DE53FF73-329B-4384-B636-2F4050778FED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B52B92DB-535F-45B7-AF32-B97216A4C4B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C410FF2E-E1C6-4238-94ED-3EC6389C961D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "279DE3C1-7BEB-43A4-A91B-06D3A53C30A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "279EDC4E-87CC-48ED-B735-84F96DC5796E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "53AB964F-61BD-4EC5-8469-7DB371154455",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "C27C5F5A-6B68-4723-809B-C482238F9647",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "43CFB610-77A2-436E-ADD0-C0D647AF56DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED26BFDF-0C8C-4BEF-BB2D-FA7ADB95AFB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC2E86BD-2358-46D5-BBB5-147168001578",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6257B30-61DC-4838-92E6-D9938224BFA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C661B582-E2F6-4E91-A47C-E91CCB0ECF2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7E60110D-1CED-47BE-8565-FE858BEFF44B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "8B061F26-EF3F-48CC-A974-5B49A622C5FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "0870B801-E121-47D8-9C88-B01C7AB6ED3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "B0F320C0-1A33-4768-9BB1-09C6554A9C8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "81C28558-F40D-48B9-B98C-F30709C89AD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "DCEF61F4-F4CE-4E33-A67C-17B1D0185BC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "65E266D2-C1F2-4400-9E41-AEB2F116C733",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "9161B916-5EED-46C4-8E0C-515A0B6D2902",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9689CB4-A70C-42D7-91E0-68057D9D4779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "6767A7E5-7A2C-452D-A6EB-9C61B43DC39B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "119B427D-87AC-4DD8-AD13-B8CFC847A947",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "57221C0B-EE09-4EB6-AE21-3C31393EB922",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "74EEC8BC-A00F-4DCF-B787-5B95699DBD80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "D9030BE8-663A-4F46-B255-0AEBFD790DFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1DED21A-FA34-4F6A-8ED5-A985671E5653",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:umn:mapserver:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "203F6A08-17BF-4F82-82C5-E0653C2100F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:umn:mapserver:4.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "E939104D-9765-4DBF-AA1D-97EBBE515972",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:umn:mapserver:4.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "93188DA2-4137-4291-9FDC-469D933C9602",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header."
    },
    {
      "lang": "es",
      "value": "Desbordamiento inferior de b\u00fafer  basado en mont\u00edculo en la funci\u00f3n readPostBody en cgiutil.c en mapserv v4.x anterior a v4.10.4 y v5.x anterior a v5.2.2, permite a atacantes remotos tener un impacto desconocido a trav\u00e9s de un valor negativo en la cabecera HTTP Content-Length."
    }
  ],
  "id": "CVE-2009-0840",
  "lastModified": "2026-06-16T23:05:55.503",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-03-31T18:24:45.860",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34520"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34603"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://trac.osgeo.org/mapserver/ticket/2943"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1914"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.positronsecurity.com/advisories/2009-000.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34306"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1021952"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49545"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34520"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34603"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://trac.osgeo.org/mapserver/ticket/2943"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.positronsecurity.com/advisories/2009-000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1021952"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49545"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2009-0840 (GCVE-0-2009-0840)

Vulnerability from cvelistv5 – Published: 2009-03-31 18:00 – Updated: 2024-08-07 04:48

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

12 references

URL	Tags
http://www.positronsecurity.com/advisories/2009-0…	x_refsource_MISC
http://www.securitytracker.com/id?1021952	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/502271/100…	mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/34603	third-party-advisoryx_refsource_SECUNIA
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://www.securityfocus.com/bid/34306	vdb-entryx_refsource_BID
http://secunia.com/advisories/34520	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2009/dsa-1914	vendor-advisoryx_refsource_DEBIAN
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://trac.osgeo.org/mapserver/ticket/2943	x_refsource_CONFIRM
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://lists.osgeo.org/pipermail/mapserver-users/…	mailing-listx_refsource_MLIST

Date Public

2009-03-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:48:52.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.positronsecurity.com/advisories/2009-000.html"
          },
          {
            "name": "1021952",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021952"
          },
          {
            "name": "20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
          },
          {
            "name": "34603",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34603"
          },
          {
            "name": "FEDORA-2009-3383",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
          },
          {
            "name": "34306",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34306"
          },
          {
            "name": "34520",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34520"
          },
          {
            "name": "DSA-1914",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1914"
          },
          {
            "name": "mapserver-contentlength-bo(49545)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49545"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.osgeo.org/mapserver/ticket/2943"
          },
          {
            "name": "FEDORA-2009-3357",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
          },
          {
            "name": "[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-03-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.positronsecurity.com/advisories/2009-000.html"
        },
        {
          "name": "1021952",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021952"
        },
        {
          "name": "20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
        },
        {
          "name": "34603",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34603"
        },
        {
          "name": "FEDORA-2009-3383",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
        },
        {
          "name": "34306",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34306"
        },
        {
          "name": "34520",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34520"
        },
        {
          "name": "DSA-1914",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1914"
        },
        {
          "name": "mapserver-contentlength-bo(49545)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49545"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.osgeo.org/mapserver/ticket/2943"
        },
        {
          "name": "FEDORA-2009-3357",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
        },
        {
          "name": "[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0840",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.positronsecurity.com/advisories/2009-000.html",
              "refsource": "MISC",
              "url": "http://www.positronsecurity.com/advisories/2009-000.html"
            },
            {
              "name": "1021952",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021952"
            },
            {
              "name": "20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
            },
            {
              "name": "34603",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34603"
            },
            {
              "name": "FEDORA-2009-3383",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
            },
            {
              "name": "34306",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34306"
            },
            {
              "name": "34520",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34520"
            },
            {
              "name": "DSA-1914",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1914"
            },
            {
              "name": "mapserver-contentlength-bo(49545)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49545"
            },
            {
              "name": "http://trac.osgeo.org/mapserver/ticket/2943",
              "refsource": "CONFIRM",
              "url": "http://trac.osgeo.org/mapserver/ticket/2943"
            },
            {
              "name": "FEDORA-2009-3357",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
            },
            {
              "name": "[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes",
              "refsource": "MLIST",
              "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0840",
    "datePublished": "2009-03-31T18:00:00.000Z",
    "dateReserved": "2009-03-06T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:48:52.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2009-0840

CVE-2009-0840 (GCVE-0-2009-0840)

Tags

Sightings

Nomenclature

Related by attack behaviour