svn commit: r406 - in /release/httpd/patches/apply_to_2.2.21: ./ CVE-2011-3368.patch

[jo...@apache.org]

Author: jorton
Date: Wed Oct  5 14:27:11 2011
New Revision: 406

Log:
- add proposed patch for CVE-2011-3368

Added:
    release/httpd/patches/apply_to_2.2.21/
    release/httpd/patches/apply_to_2.2.21/CVE-2011-3368.patch

Added: release/httpd/patches/apply_to_2.2.21/CVE-2011-3368.patch
==============================================================================
--- release/httpd/patches/apply_to_2.2.21/CVE-2011-3368.patch (added)
+++ release/httpd/patches/apply_to_2.2.21/CVE-2011-3368.patch Wed Oct  5 14:27:11 2011
@@ -0,0 +1,34 @@
+
+SECURITY (CVE-2011-3368): Prevent unintended pattern expansion in some
+reverse proxy configurations by strictly validating the request-URI.
+
+http://svn.apache.org/viewvc?rev=1179239&view=rev
+
+--- httpd-2.2.21/server/protocol.c
++++ httpd-2.2.21/server/protocol.c
+@@ -640,6 +640,25 @@
+ 
+     ap_parse_uri(r, uri);
+ 
++    /* RFC 2616:
++     *   Request-URI    = "*" | absoluteURI | abs_path | authority
++     *
++     * authority is a special case for CONNECT.  If the request is not
++     * using CONNECT, and the parsed URI does not have scheme, and
++     * it does not begin with '/', and it is not '*', then, fail
++     * and give a 400 response. */
++    if (r->method_number != M_CONNECT 
++        && !r->parsed_uri.scheme 
++        && uri[0] != '/'
++        && !(uri[0] == '*' && uri[1] == '\0')) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
++                      "invalid request-URI %s", uri);
++        r->args = NULL;
++        r->hostname = NULL;
++        r->status = HTTP_BAD_REQUEST;
++        r->uri = apr_pstrdup(r->pool, uri);
++    }
++
+     if (ll[0]) {
+         r->assbackwards = 0;
+         pro = ll;