buffer overflow + insecure mapserv CGI command-line debug args

Alan, thanks for the heads up and your work on this! When submitting debdiffs please follow https://wiki.ubuntu.com/SecurityTeam/SponsorsQueue#Notes%20for%20Contributors to make sure your patches are published in a timely manner. Thanks!

Here the sec update for hardy. Build tested on a clean environment

Here's the sec update for karmic. Build tested on a clean environment

Here's the sec update for lucid. Build tested on a clean environment

We are going to upload MapServer 5.6.4 release in Debian Unstable today. After, Maverick will have to synchronized with debian. I'll add a comment here as soon as the 5.6.4 release is ready to be synched.

Subscribing ubuntu-security-sponsors as per https://wiki.ubuntu.com/SecurityTeam/SponsorsQueue#Notes%20for%20Contributors

ACK for hardy, karmic and lucid, though it's too bad we needed autoconf changes for this (patch is huge). Alan, in the future, please use 'LP: #...' instead of 'LP #...'. Launchpad won't autoclose bugs without the colon. I've fixed it for the upload.

I've uploaded these to the security queue.

This bug was fixed in the package mapserver - 5.6.1-1ubuntu1.1

---------------
mapserver (5.6.1-1ubuntu1.1) lucid-security; urgency=low

  * SECURITY UPDATE: Buffer overflow in msTmpFile function (LP: #603593)
    - debian/patches/01_mstmpfile.dpatch: Fix the buffer overflow.
    [http://trac.osgeo.org/mapserver/ticket/3484]
  * SECURITY UPDATE: Insecure CGI command-line debug args (LP: #603593)
    - debian/patches/02_cl_debug_args.dpatch: Disable insecure mapserv
      CGI command-line debug args.
    [http://trac.osgeo.org/mapserver/ticket/3485]
 -- Alan Boudreault <email address hidden> Fri, 09 Jul 2010 09:36:30 -0400

This bug was fixed in the package mapserver - 5.4.2-1ubuntu0.1

---------------
mapserver (5.4.2-1ubuntu0.1) karmic-security; urgency=low

  * SECURITY UPDATE: Buffer overflow in msTmpFile function (LP: #603593)
    - debian/patches/01_mstmpfile.dpatch: Fix the buffer overflow.
    [http://trac.osgeo.org/mapserver/ticket/3484]
  * SECURITY UPDATE: Insecure CGI command-line debug args (LP: #603593)
    - debian/patches/02_cl_debug_args.dpatch: Disable insecure mapserv
      CGI command-line debug args.
    [http://trac.osgeo.org/mapserver/ticket/3485]
 -- Alan Boudreault <email address hidden> Fri, 09 Jul 2010 09:36:30 -0400

This bug was fixed in the package mapserver - 5.0.0-3ubuntu0.2

---------------
mapserver (5.0.0-3ubuntu0.2) hardy-security; urgency=low

  * SECURITY UPDATE: Buffer overflow in msTmpFile function (LP: #603593)
    - debian/patches/07_mstmpfile.dpatch: Fix the buffer overflow.
    [http://trac.osgeo.org/mapserver/ticket/3484]
  * SECURITY UPDATE: Insecure CGI command-line debug args (LP: #603593)
    - debian/patches/08_cl_debug_args.dpatch: Disable insecure mapserv
      CGI command-line debug args.
    [http://trac.osgeo.org/mapserver/ticket/3485]
 -- Alan Boudreault <email address hidden> Fri, 09 Jul 2010 09:36:30 -0400

Right, I took a note about the "LP: #..." hint. Thanks a lot for those quick uploads.

Marking as patch-accepted-upstream as patches are SRU patches originating from upstream and released in 5.6.4

Please, synchronize mapserver 5.6.5 from debian unstable to Ubuntu Maverick. This release includes sec patches. At the same time, please close that bug: https://bugs.launchpad.net/bugs/607281 (which is asking for that sync too)

This was fixed in maverick some time ago:

mapserver (5.6.5-1) unstable; urgency=low

  * New upstream release with an important bug fix about scale calculation.
  * Added OGC SOS server support.

mapserver (5.6.4-1) unstable; urgency=high

  [ Alan Boudreault ]
  * New upstream release, with important security bug fixes.
  * Fix Buffer overflow in msTmpFile function.
    [http://trac.osgeo.org/mapserver/ticket/3484]
  * Fix insecure mapserv CGI command-line debug args.
    [http://trac.osgeo.org/mapserver/ticket/3485]

  [ Francesco Paolo Lovergine ]
  * Policy bumped to 3.9.4, no changes required.
  * Note that in practice bashisms are avoided due to current options selection.
    (closes: #582098)
  * Urgency set to high due to security fixes included.

mapserver (5.6.3-2) unstable; urgency=low

  * Added palette support for rgba png.
 -- Michael Bienia <email address hidden> Tue, 20 Jul 2010 16:44:16 +0100