← Back to branch summary

~ubuntu-branches/ubuntu/hardy/lighttpd/hardy-security

« back to all changes in this revision

Viewing changes to debian/patches/92_CVE-2008-1531.dpatch

  • Committer: Bazaar Package Importer
  • Author(s): Emanuele Gentili
  • Date: 2008-04-06 00:09:12 UTC
  • Revision ID: james.westby@ubuntu.com-20080406000912-8fch5qc1ahziv5zi
Tags: 1.4.19-0ubuntu3
https://launchpad.net/bugs/209627
* SECURITY UPDATE: (LP: #209627)
 + debian/patches/92_CVE-2008-1531.dpatch
  - lighttpd 1.4.19 and earlier allows remote attackers to cause a denial 
    of service (active SSL connection loss) by triggering an SSL error, 
    such as disconnecting before a download has finished, which causes 
    all active SSL connections to be lost.
* References
 + http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1531
 + http://trac.lighttpd.net/trac/changeset/2136
 + http://trac.lighttpd.net/trac/changeset/2139

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/92_CVE-2008-1531.dpatch
 
1
#! /bin/sh /usr/share/dpatch/dpatch-run
 
2
## 92_CVE-2008-1531.dpatch by Emanuele Gentili <emgent@emanuele-gentili.com>
 
3
##
 
4
## All lines beginning with `## DP:' are a description of the patch.
 
5
## DP: No description.
 
6
 
 
7
@DPATCH@
 
8
diff -urNad lighttpd-1.4.19~/src/connections.c lighttpd-1.4.19/src/connections.c
 
9
--- lighttpd-1.4.19~/src/connections.c  2008-02-28 00:41:35.000000000 +0100
 
10
+++ lighttpd-1.4.19/src/connections.c   2008-04-06 00:07:21.000000000 +0200
 
11
@@ -199,6 +199,7 @@
 
12
 
 
13
        /* don't resize the buffer if we were in SSL_ERROR_WANT_* */
 
14
 
 
15
+       ERR_clear_error();
 
16
        do {
 
17
                if (!con->ssl_error_want_reuse_buffer) {
 
18
                        b = buffer_init();
 
19
@@ -1668,21 +1669,52 @@
 
20
                        }
 
21
 #ifdef USE_OPENSSL
 
22
                        if (srv_sock->is_ssl) {
 
23
-                               int ret;
 
24
+                               int ret, ssl_r;
 
25
+                               unsigned long err;
 
26
+                               ERR_clear_error();
 
27
                                switch ((ret = SSL_shutdown(con->ssl))) {
 
28
                                case 1:
 
29
                                        /* ok */
 
30
                                        break;
 
31
                                case 0:
 
32
-                                       SSL_shutdown(con->ssl);
 
33
-                                       break;
 
34
+                                       ERR_clear_error();
 
35
+                                       if (-1 != (ret = SSL_shutdown(con->ssl))) break;
 
36
+
 
37
+                                       // fall through
 
38
                                default:
 
39
-                                       log_error_write(srv, __FILE__, __LINE__, "sds", "SSL:",
 
40
-                                                       SSL_get_error(con->ssl, ret),
 
41
-                                                       ERR_error_string(ERR_get_error(), NULL));
 
42
-                                       return -1;
 
43
+
 
44
+                                       switch ((ssl_r = SSL_get_error(con->ssl, ret))) {
 
45
+                                       case SSL_ERROR_WANT_WRITE:
 
46
+                                       case SSL_ERROR_WANT_READ:
 
47
+                                               break;
 
48
+                                       case SSL_ERROR_SYSCALL:
 
49
+                                               /* perhaps we have error waiting in our error-queue */
 
50
+                                               if (0 != (err = ERR_get_error())) {
 
51
+                                                       do {
 
52
+                                                               log_error_write(srv, __FILE__, __LINE__, "sdds", "SSL:",
 
53
+                                                                               ssl_r, ret,
 
54
+                                                                               ERR_error_string(err, NULL));
 
55
+                                                       } while((err = ERR_get_error()));
 
56
+                                               } else {
 
57
+                                                       log_error_write(srv, __FILE__, __LINE__, "sddds", "SSL (error):",
 
58
+                                                                       ssl_r, r, errno,
 
59
+                                                                       strerror(errno));
 
60
+                                               }
 
61
+       
 
62
+                                               break;
 
63
+                                       default:
 
64
+                                               while((err = ERR_get_error())) {
 
65
+                                                       log_error_write(srv, __FILE__, __LINE__, "sdds", "SSL:",
 
66
+                                                                       ssl_r, ret,
 
67
+                                                                       ERR_error_string(err, NULL));
 
68
+                                               }
 
69
+       
 
70
+                                               break;
 
71
+                                       }
 
72
+
 
73
                                }
 
74
                        }
 
75
+                       ERR_clear_error();
 
76
 #endif
 
77
 
 
78
                        switch(con->mode) {
 
79
diff -urNad lighttpd-1.4.19~/src/network_openssl.c lighttpd-1.4.19/src/network_openssl.c
 
80
--- lighttpd-1.4.19~/src/network_openssl.c      2008-02-26 17:20:26.000000000 +0100
 
81
+++ lighttpd-1.4.19/src/network_openssl.c       2008-04-06 00:02:26.000000000 +0200
 
82
@@ -85,6 +85,7 @@
 
83
                         *
 
84
                         */
 
85
 
 
86
+                       ERR_clear_error();
 
87
                        if ((r = SSL_write(ssl, offset, toSend)) <= 0) {
 
88
                                unsigned long err;
 
89
 
 
90
@@ -187,6 +188,7 @@
 
91
 
 
92
                                close(ifd);
 
93
 
 
94
+                               ERR_clear_error();
 
95
                                if ((r = SSL_write(ssl, s, toSend)) <= 0) {
 
96
                                        unsigned long err;
 
97