Re: Stronghold 2.4 and chunked encoding vulnerability

>Has anyone sucessfully upgraded a stronghold 2.4 installation to be secure
>against this attack?  I attempted the function renaming suggested on this
>list, but it still threw errors.  Any help would be appreciated.
>
>Thanks
>John Darin Holloway
>Web Developer and System Administrator
>Bluegrass Network, LLC
>

I modified two Stronghold 2.4.2 servers by downloading the patch for 
Stronghold 3 and applying the patch by hand to 
src/main/httpd_protocol.c.  I was able to  ./Configure and recompile 
a new binary on both Linux and Solaris, albeit with some minor 
fiddling of the src/main/Makefile (Solaris) and making a soft link to 
an include file (Linux).

The chunk.patch file follows below:

--- main/http_protocol.c.chunk	Tue Jun 18 15:33:47 2002
+++ main/http_protocol.c	Tue Jun 18 15:33:51 2002
@@ -1922,6 +1922,12 @@
          }

          r->remaining = atol(lenp);
+        if (r->remaining < 0) {
+            ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r,
+              "Request content-length of %s maps to negative number %ld",
+              lenp, r->remaining);
+            return HTTP_BAD_REQUEST;
+        }
      }

      if ((r->read_body == REQUEST_NO_BODY) &&
@@ -1972,21 +1978,34 @@
  static long get_chunk_size(char *b)
  {
      long chunksize = 0;
+    long chunkbits = sizeof(long) * 8;
+
+    /* Skip leading zeros */
+    while (*b == '0') {
+        ++b;
+    }

-    while (ap_isxdigit(*b)) {
+    while (ap_isxdigit(*b) && (chunkbits > 0)) {
          int xvalue = 0;

-	/* This works even on EBCDIC. */
-        if (*b >= '0' && *b <= '9')
+        if (*b >= '0' && *b <= '9') {
              xvalue = *b - '0';
-        else if (*b >= 'A' && *b <= 'F')
+        }
+        else if (*b >= 'A' && *b <= 'F') {
              xvalue = *b - 'A' + 0xa;
-        else if (*b >= 'a' && *b <= 'f')
+        }
+        else if (*b >= 'a' && *b <= 'f') {
              xvalue = *b - 'a' + 0xa;
+        }

          chunksize = (chunksize << 4) | xvalue;
+        chunkbits -= 4;
          ++b;
      }
+    if (ap_isxdigit(*b) && (chunkbits <= 0)) {
+        /* overflow */
+        return -1;
+    }

      return chunksize;
  }
@@ -2070,6 +2089,10 @@
              }
              r->remaining = -1;  /* Indicate footers in-progress */
          }
+        else if (len_to_read < 0) {
+            r->connection->keepalive = -1;
+            return -1;
+        }
          else {
              r->remaining = len_to_read;
          }






-- 


####################################################

Raynard A. Jong

University of California
Lawrence Livermore National Laboratory
P.O. Box 808  / L-637
Livermore, CA 94551-9900

Internet E-mail :		[email protected]
Telephone (with voice mail) :	(925) 423-0498
FAX :			(925) 424-6401