You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by sc...@apache.org on 2007/07/14 19:03:18 UTC
svn commit: r556298 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS
server/mpm_common.c
Author: sctemme
Date: Sat Jul 14 10:03:18 2007
New Revision: 556298
URL: http://svn.apache.org/viewvc?view=rev&rev=556298
Log:
Backport of 2.0.x PID table problem fix
Modified:
httpd/httpd/branches/2.0.x/CHANGES
httpd/httpd/branches/2.0.x/STATUS
httpd/httpd/branches/2.0.x/server/mpm_common.c
Modified: httpd/httpd/branches/2.0.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/CHANGES?view=diff&rev=556298&r1=556297&r2=556298
==============================================================================
--- httpd/httpd/branches/2.0.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.0.x/CHANGES [utf-8] Sat Jul 14 10:03:18 2007
@@ -6,6 +6,11 @@
server-status page and ExtendedStatus enabled, for browsers which
perform charset "detection". Reported by Stefan Esser. [Joe Orton]
+ *) SECURITY: CVE-2007-3304 (cve.mitre.org)
+ scoreboard pid protection fixes -- the only fix for 2.0.x is
+ to ensure a valid positive pid is passed to apr_proc_wait();
+ the MPMs do not kill children directly as in 2.2.x.
+
*) mod_so: Solve dev's confusion by reporting expected/seen module
magic signatures when failing with a 'garbled' message, and solve
user's confusion by pointing out 'perhaps compiled for a different
Modified: httpd/httpd/branches/2.0.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/STATUS?view=diff&rev=556298&r1=556297&r2=556298
==============================================================================
--- httpd/httpd/branches/2.0.x/STATUS (original)
+++ httpd/httpd/branches/2.0.x/STATUS Sat Jul 14 10:03:18 2007
@@ -123,16 +123,6 @@
http://people.apache.org/~mjc/cve-2007-1863-2.0.patch
+1: mjc, rpluem, jorton
- * SECURITY: CVE-2007-3304
- scoreboard pid protection fixes -- the only fix for 2.0.x is
- to ensure a valid positive pid is passed to apr_proc_wait();
- the MPMs do not kill children directly as in 2.2.x.
- trunk commit:
- http://svn.apache.org/viewvc?view=rev&rev=551843
- patch for 2.0.x:
- http://people.apache.org/~jorton/httpd-2.0.x-CVE-2007-3304.patch
- +1: jorton, jim, rpluem
-
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
[ please place SVN revisions from trunk here, so it is easy to
identify exactly what the proposed changes are! Add all new
Modified: httpd/httpd/branches/2.0.x/server/mpm_common.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/server/mpm_common.c?view=diff&rev=556298&r1=556297&r2=556298
==============================================================================
--- httpd/httpd/branches/2.0.x/server/mpm_common.c (original)
+++ httpd/httpd/branches/2.0.x/server/mpm_common.c Sat Jul 14 10:03:18 2007
@@ -110,6 +110,11 @@
apr_proc_t proc;
apr_status_t waitret;
+ /* Ensure pid sanity. */
+ if (pid < 1) {
+ return 1;
+ }
+
proc.pid = pid;
waitret = apr_proc_wait(&proc, NULL, NULL, APR_NOWAIT);
if (waitret != APR_CHILD_NOTDONE) {
Re: svn commit: r556298 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS server/mpm_common.c
Posted by Joe Orton <jo...@redhat.com>.
On Thu, Jul 19, 2007 at 09:06:39AM -0400, Jeff Trawick wrote:
> On 7/19/07, Joe Orton <jo...@redhat.com> wrote:
> >On Thu, Jul 19, 2007 at 08:30:37AM -0400, Jeff Trawick wrote:
> >> assert(
> >> CVE-2007-3304 does not apply to 2.0.x. This commit is a fix in the
> >> same general area as the 2.2.x vulnerability and should not have the
> >> SECURITY/CVE label.
> >> )
> >
> >I erroneously claimed that originally, then later found an attack vector
> >for -3304 which did work for 2.0.x:
> >
> >http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e
> >
> >The wording above is not really appropriate for CHANGES, I've just fixed
> >that.
>
> thanks for the big clues; any need to fix mitre.org text?
Ah, I didn't realise they had the versions referenced. I've send them a
note.
joe
Re: svn commit: r556298 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS server/mpm_common.c
Posted by Jeff Trawick <tr...@gmail.com>.
On 7/19/07, Joe Orton <jo...@redhat.com> wrote:
> On Thu, Jul 19, 2007 at 08:30:37AM -0400, Jeff Trawick wrote:
> > On 7/14/07, sctemme@apache.org <sc...@apache.org> wrote:
> > >Author: sctemme
> > >Date: Sat Jul 14 10:03:18 2007
> > >New Revision: 556298
> > >
> > >URL: http://svn.apache.org/viewvc?view=rev&rev=556298
> > >Log:
> > >Backport of 2.0.x PID table problem fix
> >
> > >+ *) SECURITY: CVE-2007-3304 (cve.mitre.org)
> > >+ scoreboard pid protection fixes -- the only fix for 2.0.x is
> > >+ to ensure a valid positive pid is passed to apr_proc_wait();
> > >+ the MPMs do not kill children directly as in 2.2.x.
> >
> > assert(
> > CVE-2007-3304 does not apply to 2.0.x. This commit is a fix in the
> > same general area as the 2.2.x vulnerability and should not have the
> > SECURITY/CVE label.
> > )
>
> I erroneously claimed that originally, then later found an attack vector
> for -3304 which did work for 2.0.x:
>
> http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e
>
> The wording above is not really appropriate for CHANGES, I've just fixed
> that.
thanks for the big clues; any need to fix mitre.org text?
Re: svn commit: r556298 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS server/mpm_common.c
Posted by Joe Orton <jo...@redhat.com>.
On Thu, Jul 19, 2007 at 08:30:37AM -0400, Jeff Trawick wrote:
> On 7/14/07, sctemme@apache.org <sc...@apache.org> wrote:
> >Author: sctemme
> >Date: Sat Jul 14 10:03:18 2007
> >New Revision: 556298
> >
> >URL: http://svn.apache.org/viewvc?view=rev&rev=556298
> >Log:
> >Backport of 2.0.x PID table problem fix
>
> >+ *) SECURITY: CVE-2007-3304 (cve.mitre.org)
> >+ scoreboard pid protection fixes -- the only fix for 2.0.x is
> >+ to ensure a valid positive pid is passed to apr_proc_wait();
> >+ the MPMs do not kill children directly as in 2.2.x.
>
> assert(
> CVE-2007-3304 does not apply to 2.0.x. This commit is a fix in the
> same general area as the 2.2.x vulnerability and should not have the
> SECURITY/CVE label.
> )
I erroneously claimed that originally, then later found an attack vector
for -3304 which did work for 2.0.x:
http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e
The wording above is not really appropriate for CHANGES, I've just fixed
that.
Regards,
joe
Re: svn commit: r556298 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS server/mpm_common.c
Posted by Jeff Trawick <tr...@gmail.com>.
On 7/14/07, sctemme@apache.org <sc...@apache.org> wrote:
> Author: sctemme
> Date: Sat Jul 14 10:03:18 2007
> New Revision: 556298
>
> URL: http://svn.apache.org/viewvc?view=rev&rev=556298
> Log:
> Backport of 2.0.x PID table problem fix
> + *) SECURITY: CVE-2007-3304 (cve.mitre.org)
> + scoreboard pid protection fixes -- the only fix for 2.0.x is
> + to ensure a valid positive pid is passed to apr_proc_wait();
> + the MPMs do not kill children directly as in 2.2.x.
assert(
CVE-2007-3304 does not apply to 2.0.x. This commit is a fix in the
same general area as the 2.2.x vulnerability and should not have the
SECURITY/CVE label.
)