You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rp...@apache.org on 2007/12/28 17:29:41 UTC
svn commit: r607282 - in /httpd/httpd/trunk: CHANGES
modules/generators/mod_status.c
Author: rpluem
Date: Fri Dec 28 08:29:40 2007
New Revision: 607282
URL: http://svn.apache.org/viewvc?rev=607282&view=rev
Log:
* Ensure refresh parameter is numeric to prevent a possible XSS attack caused
by redirecting to other URLs. Reported by SecurityReason.
Submitted by: Mark Cox, Joe Orton
Reviewed by: security@httpd.apache.org
Modified:
httpd/httpd/trunk/CHANGES
httpd/httpd/trunk/modules/generators/mod_status.c
Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=607282&r1=607281&r2=607282&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Fri Dec 28 08:29:40 2007
@@ -2,6 +2,11 @@
Changes with Apache 2.3.0
[ When backported to 2.2.x, remove entry from this file ]
+ *) SECURITY: CVE-2007-6388 (cve.mitre.org)
+ mod_status: Ensure refresh parameter is numeric to prevent
+ a possible XSS attack caused by redirecting to other URLs.
+ Reported by SecurityReason. [Mark Cox, Joe Orton]
+
*) mod_proxy_balancer: Correctly escape the worker route and the worker
redirect string in the HTML output of the balancer manager.
Reported by SecurityReason. [Ruediger Pluem]
Modified: httpd/httpd/trunk/modules/generators/mod_status.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?rev=607282&r1=607281&r2=607282&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/generators/mod_status.c (original)
+++ httpd/httpd/trunk/modules/generators/mod_status.c Fri Dec 28 08:29:40 2007
@@ -71,6 +71,7 @@
#endif
#define APR_WANT_STRFUNC
#include "apr_want.h"
+#include "apr_strings.h"
#ifdef NEXT
#if (NX_CURRENT_COMPILER_RELEASE == 410)
@@ -296,19 +297,18 @@
if ((loc = ap_strstr_c(r->args,
status_options[i].form_data_str)) != NULL) {
switch (status_options[i].id) {
- case STAT_OPT_REFRESH:
- if (*(loc + strlen(status_options[i].form_data_str)) == '='
- && atol(loc + strlen(status_options[i].form_data_str)
- + 1) > 0)
- apr_table_set(r->headers_out,
- status_options[i].hdr_out_str,
- loc +
- strlen(status_options[i].hdr_out_str) +
- 1);
- else
- apr_table_set(r->headers_out,
- status_options[i].hdr_out_str, "1");
+ case STAT_OPT_REFRESH: {
+ apr_size_t len = strlen(status_options[i].form_data_str);
+ long t = 0;
+
+ if (*(loc + len ) == '=') {
+ t = atol(loc + len + 1);
+ }
+ apr_table_set(r->headers_out,
+ status_options[i].hdr_out_str,
+ apr_ltoa(r->pool, t < 1 ? 1 : t));
break;
+ }
case STAT_OPT_NOTABLE:
no_table_report = 1;
break;