You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by "Roy T. Fielding" <fi...@apache.org> on 2002/06/21 03:24:11 UTC
[PATCH httpd 1.2] chunk size overflow
This patch should be sufficient to fix the security hole for most
versions of Apache httpd 1.2. Should we put it up on dist/httpd?
....Roy
Re: [PATCH httpd 1.2] chunk size overflow
Posted by "Roy T. Fielding" <fi...@apache.org>.
> This patch should be sufficient to fix the security hole for most
> versions of Apache httpd 1.2. Should we put it up on dist/httpd?
It turns out that this small patch is sufficient to plug the hole
on all 1.2 and 1.3.* versions up until 1.3.24 if mod_proxy is in use.
I have placed it in the relevant dist/httpd/patches directories.
It probably should have been sent to CERT along with the advisory,
or at least linked from our info file. I'll leave that to others.
....Roy
Re: [PATCH httpd 1.2] chunk size overflow
Posted by Graham Leggett <mi...@sharp.fm>.
William A. Rowe, Jr. wrote:
>> > What about the proxy?
>> >
>>
>> Not really a problem with 1.2, or other non HTTP/1.1 proxies I think :)
>
>
> Not a problem, IIRC, until we introduced 1.3.24 with the HTTP/1.1 proxy.
As far as I remember, proxy uses the existing chunking functions in
http_protocol.c to do chunking.
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm
"There's a moon
over Bourbon Street
tonight..."
Re: [PATCH httpd 1.2] chunk size overflow
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
At 09:49 PM 6/20/2002, Jim Jagielski wrote:
>Cliff Woolley wrote:
> >
> > On Thu, 20 Jun 2002, Roy T. Fielding wrote:
> >
> > > This patch should be sufficient to fix the security hole for most
> > > versions of Apache httpd 1.2. Should we put it up on dist/httpd?
> >
> > What about the proxy?
> >
>
>Not really a problem with 1.2, or other non HTTP/1.1 proxies I think :)
Not a problem, IIRC, until we introduced 1.3.24 with the HTTP/1.1 proxy.
Bill
Re: [PATCH httpd 1.2] chunk size overflow
Posted by Cliff Woolley <jw...@virginia.edu>.
On Thu, 20 Jun 2002, Roy T. Fielding wrote:
> This patch should be sufficient to fix the security hole for most
> versions of Apache httpd 1.2. Should we put it up on dist/httpd?
What about the proxy?
--Cliff