httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From m..@apache.org
Subject svn commit: r356278 - in /httpd/httpd/branches/1.3.x/src: CHANGES main/util.c modules/standard/mod_imap.c
Date Mon, 12 Dec 2005 16:37:08 GMT
Author: mjc
Date: Mon Dec 12 08:36:54 2005
New Revision: 356278

URL: http://svn.apache.org/viewcvs?rev=356278&view=rev
Log:
Fix moderate security issue CVE-2005-3352 mod_imap cross-site scripting flaw

Submitted by: Mark Cox <mjc apache.org>
Reviewed by: jorton, mjc, fielding
PR: 37874

Modified:
    httpd/httpd/branches/1.3.x/src/CHANGES
    httpd/httpd/branches/1.3.x/src/main/util.c
    httpd/httpd/branches/1.3.x/src/modules/standard/mod_imap.c

Modified: httpd/httpd/branches/1.3.x/src/CHANGES
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/1.3.x/src/CHANGES?rev=356278&r1=356277&r2=356278&view=diff
==============================================================================
--- httpd/httpd/branches/1.3.x/src/CHANGES (original)
+++ httpd/httpd/branches/1.3.x/src/CHANGES Mon Dec 12 08:36:54 2005
@@ -1,5 +1,11 @@
 Changes with Apache 1.3.35
 
+  *) SECURITY: CVE-2005-3352 (cve.mitre.org)
+     mod_imap: Escape untrusted referer header before outputting in HTML
+     to avoid potential cross-site scripting.  Change also made to
+     ap_escape_html so we escape quotes.  Reported by JPCERT.
+     [Mark Cox]
+
   *) mod_cgi: Remove block on OPTIONS method so that scripts can
      respond to OPTIONS directly rather than via server default.
      [Roy Fielding] PR 15242

Modified: httpd/httpd/branches/1.3.x/src/main/util.c
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/1.3.x/src/main/util.c?rev=356278&r1=356277&r2=356278&view=diff
==============================================================================
--- httpd/httpd/branches/1.3.x/src/main/util.c (original)
+++ httpd/httpd/branches/1.3.x/src/main/util.c Mon Dec 12 08:36:54 2005
@@ -1722,6 +1722,8 @@
 	    j += 3;
 	else if (s[i] == '&')
 	    j += 4;
+	else if (s[i] == '"')
+	    j += 5;
 
     if (j == 0)
 	return ap_pstrndup(p, s, i);
@@ -1739,6 +1741,10 @@
 	else if (s[i] == '&') {
 	    memcpy(&x[j], "&amp;", 5);
 	    j += 4;
+	}
+	else if (s[i] == '"') {
+	    memcpy(&x[j], "&quot;", 6);
+	    j += 5;
 	}
 	else
 	    x[j] = s[i];

Modified: httpd/httpd/branches/1.3.x/src/modules/standard/mod_imap.c
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/1.3.x/src/modules/standard/mod_imap.c?rev=356278&r1=356277&r2=356278&view=diff
==============================================================================
--- httpd/httpd/branches/1.3.x/src/modules/standard/mod_imap.c (original)
+++ httpd/httpd/branches/1.3.x/src/modules/standard/mod_imap.c Mon Dec 12 08:36:54 2005
@@ -328,7 +328,7 @@
     if (!strcasecmp(value, "referer")) {
         referer = ap_table_get(r->headers_in, "Referer");
         if (referer && *referer) {
-	    return ap_pstrdup(r->pool, referer);
+	    return ap_escape_html(r->pool, referer);
         }
         else {
 	    /* XXX:  This used to do *value = '\0'; ... which is totally bogus



Mime
View raw message