RE: Stronghold 2.4 and chunked encoding vulner ability

Here is a difference list between a patched 2.4 http_protocol.c and an
unpatched one:

1411a1412,1417
> 	if (r->remaining < 0) {
> 		ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r,
> 		 "Request content-length of %s maps to negative number %ld",
> 		 lenp, r->remaining);
> 		return HTTP_BAD_REQUEST;
> 	}
1444a1451
>     long chunkbits = sizeof(long) * 8;
1446c1453,1458
<     while (isxdigit(*b)) {
---
>     /* Skip leading zeros */
>     while (*b == '0') {
> 	++b;
>     }
> 
>     while (isxdigit(*b) && (chunkbits > 0)) {
1449c1461
<         if (*b >= '0' && *b <= '9')
---
>         if (*b >= '0' && *b <= '9') {
1451c1463,1464
<         else if (*b >= 'A' && *b <= 'F')
---
> 	}
>         else if (*b >= 'A' && *b <= 'F') {
1453c1466,1467
<         else if (*b >= 'a' && *b <= 'f')
---
> 	}
>         else if (*b >= 'a' && *b <= 'f') {
1454a1469
> 	}
1456a1472
> 	chunkbits -= 4;
1459a1476,1480
>     if (isxdigit(*b) && (chunkbits <= 0)) {
> 	/* overflow */
> 	return -1;
>     }
> 
1526a1548,1551
> 	else if (len_to_read < 0) {
> 	    r->connection->keepalive = -1;
> 	    return -1;
> 	}

Thanks,

Jon Horner, CISSP
SAIC WebPool
[email protected]
Office:  (865) 425-5178
Pager:  (865) 417-5012


> -----Original Message-----
> From: John Darin Holloway [mailto:[email protected]]
> Sent: Monday, July 01, 2002 10:19 AM
> To: [email protected]
> Subject: [Stronghold-users] Stronghold 2.4 and chunked encoding
> vulnerability
> 
> 
> Has anyone sucessfully upgraded a stronghold 2.4 installation 
> to be secure
> against this attack?  I attempted the function renaming 
> suggested on this
> list, but it still threw errors.  Any help would be appreciated.
> 
> Thanks
> John Darin Holloway
> Web Developer and System Administrator
> Bluegrass Network, LLC
> 
> 
> 
> _______________________________________________
> Stronghold-users mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/stronghold-users
>