RE: Apache HTTP Server Chunk Encoding Vulnerab ility

I don't quite agree.  In Stronghold 2.4.2, the function 'ap_log_rerror'
(referenced in the patch) was called 'ap_log_error', and the 'ap_isxdigit'
function referenced in the patch was called 'isxdigit'.  When you patch the
source code, you will fail to remake unless you rename the function calls to
the older names.  It is a small issue, but one that will cause heartburn.
I'm not sure if a previous security patch caused the team to rewrite and
rename from 'isxdigit' to 'ap_isxdigit' and if using the old functions
causes some risks.  Please see the in-line diff from a stronghold 2.4 box:

1411a1412,1417
> 	if (r->remaining < 0) {
> 		ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r,
> 		 "Request content-length of %s maps to negative number %ld",
> 		 lenp, r->remaining);
> 		return HTTP_BAD_REQUEST;
> 	}
1444a1451
>     long chunkbits = sizeof(long) * 8;
1446c1453,1458
<     while (isxdigit(*b)) {
---
>     /* Skip leading zeros */
>     while (*b == '0') {
> 	++b;
>     }
> 
>     while (isxdigit(*b) && (chunkbits > 0)) {
1449c1461
<         if (*b >= '0' && *b <= '9')
---
>         if (*b >= '0' && *b <= '9') {
1451c1463,1464
<         else if (*b >= 'A' && *b <= 'F')
---
> 	}
>         else if (*b >= 'A' && *b <= 'F') {
1453c1466,1467
<         else if (*b >= 'a' && *b <= 'f')
---
> 	}
>         else if (*b >= 'a' && *b <= 'f') {
1454a1469
> 	}
1456a1472
> 	chunkbits -= 4;
1459a1476,1480
>     if (isxdigit(*b) && (chunkbits <= 0)) {
> 	/* overflow */
> 	return -1;
>     }
> 
1526a1548,1551
> 	else if (len_to_read < 0) {
> 	    r->connection->keepalive = -1;
> 	    return -1;
> 	}

Thanks,

Jon Horner, CISSP
SAIC WebPool
[email protected]
Office:  (865) 425-5178
Pager:  (865) 417-5012


> -----Original Message-----
> From: Mark J Cox [mailto:[email protected]]
> Sent: Thursday, June 20, 2002 4:09 PM
> To: [email protected]
> Subject: Re: [Stronghold-users] Apache HTTP Server Chunk Encoding
> Vulnerability
> 
> 
> The patch may need to be applied by hand for older versions 
> of Apache but
> it should be fairly straightforward; the affected code hasn't 
> changed much
> since Apache 1.2 days.
> 
> Cheers, Mark
> 
> > Get the Red Hat patch for Stronghold 3.0 from:
> > 
> > http://stronghold.redhat.com/sh3/errata-2002-118
> > 
> > and apply the patch to Stronghold 2.4.2 by hand
> > yourself. I guess that's the only way since Stronghold
> > 2.4.2 is no longer supported. Else upgrade to the
> > latest version of Stronghold.
> 
> 
> 
> _______________________________________________
> Stronghold-users mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/stronghold-users
>