[Pkg-apache-commits] r1360 - in /branches/squeeze-apache2: changelog patches/00list patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch

[sf at alioth.debian.org]

Author: sf
Date: Sun Sep 25 22:04:11 2011
New Revision: 1360

URL: http://svn.debian.org/wsvn/pkg-apache/?sc=1&rev=1360
Log:
CVE-2011-3348

Added:
    branches/squeeze-apache2/patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch   (with props)
Modified:
    branches/squeeze-apache2/changelog
    branches/squeeze-apache2/patches/00list

Modified: branches/squeeze-apache2/changelog
URL: http://svn.debian.org/wsvn/pkg-apache/branches/squeeze-apache2/changelog?rev=1360&op=diff
==============================================================================
--- branches/squeeze-apache2/changelog (original)
+++ branches/squeeze-apache2/changelog Sun Sep 25 22:04:11 2011
@@ -1,5 +1,7 @@
 apache2 (2.2.16-6+squeeze2) UNRELEASED; urgency=low
 
+  * Fix CVE-2011-3348: Possible denial of service in mod_proxy_ajp
+    if combined with mod_proxy_balancer.
   * Make exit code of '/etc/init.d/apache2 status' more LSB compatible.
     Closes: #613969
   * Fix typo in init script. Closes: #615866
@@ -12,7 +14,7 @@
   * Make it clear in README.multiple-instances that the MPMs are shipped
     in the apache2.2-bin package.
 
- -- Stefan Fritsch <sf at debian.org>  Sat, 26 Feb 2011 15:06:38 +0100
+ -- Stefan Fritsch <sf at debian.org>  Mon, 26 Sep 2011 00:01:15 +0200
 
 apache2 (2.2.16-6+squeeze1) stable-security; urgency=high
 

Modified: branches/squeeze-apache2/patches/00list
URL: http://svn.debian.org/wsvn/pkg-apache/branches/squeeze-apache2/patches/00list?rev=1360&op=diff
==============================================================================
--- branches/squeeze-apache2/patches/00list (original)
+++ branches/squeeze-apache2/patches/00list Sun Sep 25 22:04:11 2011
@@ -27,6 +27,7 @@
 082_ab_num_requests
 083_mod_ssl_memcpy.dpatch
 084_mod_reqtimeout_CVE-2010-1623.dpatch
+087_mod_proxy_ajp_CVE-2011-3348.dpatch
 099_config_guess_sub_update
 200_cp_suexec.dpatch
 201_build_suexec-custom.dpatch

Added: branches/squeeze-apache2/patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch
URL: http://svn.debian.org/wsvn/pkg-apache/branches/squeeze-apache2/patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch?rev=1360&op=file
==============================================================================
--- branches/squeeze-apache2/patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch (added)
+++ branches/squeeze-apache2/patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch Sun Sep 25 22:04:11 2011
@@ -1,0 +1,20 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: http://svn.apache.org/viewvc?view=revision&revision=1167158
+
+ at DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' squeeze-apache2~/modules/proxy/mod_proxy_ajp.c squeeze-apache2/modules/proxy/mod_proxy_ajp.c
+--- squeeze-apache2~/modules/proxy/mod_proxy_ajp.c	2010-07-12 08:57:41.000000000 +0200
++++ squeeze-apache2/modules/proxy/mod_proxy_ajp.c	2011-09-25 23:57:45.734225690 +0200
+@@ -213,7 +213,9 @@
+                      conn->worker->hostname);
+         if (status == AJP_EOVERFLOW)
+             return HTTP_BAD_REQUEST;
+-        else {
++        else if  (status == AJP_EBAD_METHOD) {
++            return HTTP_NOT_IMPLEMENTED;
++        } else {
+             /*
+              * This is only non fatal when the method is idempotent. In this
+              * case we can dare to retry it with a different worker if we are

Propchange: branches/squeeze-apache2/patches/087_mod_proxy_ajp_CVE-2011-3348.dpatch
------------------------------------------------------------------------------
    svn:executable = *