MapServer Map File Double Free Remote Denial of Service Vulnerability

Bugtraq ID:	49374
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-2975
Remote:	Yes
Local:	No
Published:	Aug 30 2011 12:00AM
Updated:	Apr 13 2015 10:06PM
Credit:	rouault
Vulnerable:	Regents of the University of Minnesota MapServer 6.0 Regents of the University of Minnesota MapServer 5.6.7 Regents of the University of Minnesota MapServer 5.6.4 Regents of the University of Minnesota MapServer 5.6.3 Regents of the University of Minnesota MapServer 5.4.2 Regents of the University of Minnesota MapServer 5.4.1 Regents of the University of Minnesota MapServer 5.2.3 Regents of the University of Minnesota MapServer 5.2.2 Regents of the University of Minnesota MapServer 5.2.1 Regents of the University of Minnesota MapServer 5.0.3
Not Vulnerable:	Regents of the University of Minnesota MapServer 6.0.1

MapServer Map File Double Free Remote Denial of Service Vulnerability

MapServer is prone to a remote denial-of-service vulnerability due to a double free condition.

Attackers can exploit this issue to crash the application, denying service to legitimate users. Due to the nature of this issue, code execution may be possible; however, this has not been confirmed.

Versions prior to MapServer 6.0.1 are vulnerable.

MapServer Map File Double Free Remote Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/49095.pl

MapServer Map File Double Free Remote Denial of Service Vulnerability

Solution:
The vendor released an update. Please see the references for more information.

MapServer Map File Double Free Remote Denial of Service Vulnerability

References:

• Double-free in msAddImageSymbol() when filename is a http resource (MapServer)
  
• MapServer Homepage (Regents of the University of Minneso)