kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add improved fix for proxy vulnerability reported in CVE-2011-3368.

Browse source 
This should also fix CVE-2011-3639 and possibly CVE-2011-4317, both
part of SA46987.
This commit is contained in:
tron 2011-12-07 22:58:12 +00:00
parent b8d5a69f21
commit d1e5343c2c
3 changed files with 34 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
www/apache22/Makefile
View file

@ -1,9 +1,9 @@
# $NetBSD: Makefile,v 1.74 2011/12/02 07:13:48 sbd Exp $
# $NetBSD: Makefile,v 1.75 2011/12/07 22:58:12 tron Exp $
DISTNAME= httpd-2.2.21
PKGNAME= ${DISTNAME:S/httpd/apache/}
PKGREVISION= 3
PKGREVISION= 4
CATEGORIES= www
MASTER_SITES= ${MASTER_SITE_APACHE:=httpd/} \
http://archive.apache.org/dist/httpd/ \

4
www/apache22/distinfo
View file

@ -1,4 +1,4 @@
$NetBSD: distinfo,v 1.44 2011/11/11 07:58:03 spz Exp $
$NetBSD: distinfo,v 1.45 2011/12/07 22:58:12 tron Exp $
SHA1 (httpd-2.2.21.tar.bz2) = c02f9b05da9a7e316ff37d9053dc76a57ba51cb4
RMD160 (httpd-2.2.21.tar.bz2) = 6464a03d78ab858b1288ea9eef4cd5f73b60a9f1
@ -16,5 +16,5 @@ SHA1 (patch-am) = ab4a2f7e5a1a3064e908b61157e7fd349c0b0c08
SHA1 (patch-aw) = ca53d67beeb2c2c4d9adb04d3d79e24a8c427fd4
SHA1 (patch-lock.c) = 770ca03f1cb4421879bd5baa5a7c30cc91acb6e1
SHA1 (patch-repos.c) = 0e0361b91d4b0fe6c7c55a12fdfd2e6aacc710e1
SHA1 (patch-server_protocol.c) = 5361b5218d4f2aa22ea79e4ba6534ca0252c6e4e
SHA1 (patch-server_protocol.c) = fc77c3293f6f2f73a40e88098ba1483d3e605b66
SHA1 (patch-server_util.c) = b63f73e2a482facd188eecb0864fc612d1b7b3a5

34
www/apache22/patches/patch-server_protocol.c
View file

@ -1,13 +1,20 @@
$NetBSD: patch-server_protocol.c,v 1.1 2011/10/10 10:13:42 taca Exp $
$NetBSD: patch-server_protocol.c,v 1.2 2011/12/07 22:58:12 tron Exp $
revision 1179239 from http://svn.apache.org/:
SECURITY (CVE-2011-3368): Prevent unintended pattern expansion
in some reverse proxy configurations by strictly validating
the request-URI.
--- server/protocol.c.orig 2011-10-10 09:11:16.000000000 +0000
+++ server/protocol.c
@@ -640,6 +640,25 @@ static int read_request_line(request_rec
revision 1179525 from http://svn.apache.org/:
SECURITY (CVE-2011-3368): Prevent unintended pattern expansion in some
reverse proxy configurations by strictly validating the request-URI:
* server/protocol.c (read_request_line): Send a 400 response if the
request-URI does not match the grammar from RFC 2616. This ensures
the input string for RewriteRule et al really is an absolute path.
--- server/protocol.c.orig 2011-05-07 12:39:29.000000000 +0100
+++ server/protocol.c 2011-12-07 22:48:17.000000000 +0000
@@ -640,6 +640,44 @@
ap_parse_uri(r, uri);
@ -29,6 +36,25 @@ revision 1179239 from http://svn.apache.org/:
+ r->status = HTTP_BAD_REQUEST;
+ r->uri = apr_pstrdup(r->pool, uri);
+ }
+
+ /* RFC 2616:
+ * Request-URI = "*" | absoluteURI | abs_path | authority
+ *
+ * authority is a special case for CONNECT. If the request is not
+ * using CONNECT, and the parsed URI does not have scheme, and
+ * it does not begin with '/', and it is not '*', then, fail
+ * and give a 400 response. */
+ if (r->method_number != M_CONNECT
+ && !r->parsed_uri.scheme
+ && uri[0] != '/'
+ && !(uri[0] == '*' && uri[1] == '\0')) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "invalid request-URI %s", uri);
+ r->args = NULL;
+ r->hostname = NULL;
+ r->status = HTTP_BAD_REQUEST;
+ r->uri = apr_pstrdup(r->pool, uri);
+ }
+
if (ll[0]) {
r->assbackwards = 0;