← Back to branch summary

~ubuntu-branches/ubuntu/natty/tomcat6/natty-proposed

« back to all changes in this revision

Viewing changes to debian/patches/0015-CVE-2011-2204.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2011-09-26 11:27:14 UTC
  • Revision ID: package-import@ubuntu.com-20110926112714-ngfuvuxfnr5oe2x8
Tags: 6.0.28-10ubuntu2.2
https://launchpad.net/bugs/843701
* SECURITY UPDATE: information disclosure via log file
  - debian/patches/0015-CVE-2011-2204.patch: fix logging in
    java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java,
    java/org/apache/catalina/users/MemoryUserDatabase.java,
    java/org/apache/catalina/users/MemoryUser.java.
  - CVE-2011-2204
* SECURITY UPDATE: file restriction bypass or denial of service via
  untrusted web application.
  - debian/patches/0016-CVE-2011-2526.patch: check canonical name in
    java/org/apache/catalina/connector/LocalStrings.properties,
    java/org/apache/catalina/connector/Request.java,
    java/org/apache/catalina/servlets/DefaultServlet.java,
    java/org/apache/coyote/http11/Http11AprProcessor.java,
    java/org/apache/coyote/http11/LocalStrings.properties,
    java/org/apache/tomcat/util/net/AprEndpoint.java,
    java/org/apache/tomcat/util/net/NioEndpoint.java.
  - CVE-2011-2526
* SECURITY UPDATE: AJP request spoofing and authentication bypass
  (LP: #843701)
  - debian/patches/0017-CVE-2011-3190.patch: Properly handle request
    bodies in java/org/apache/coyote/ajp/AjpAprProcessor.java,
    java/org/apache/coyote/ajp/AjpProcessor.java.
  - CVE-2011-3190
* SECURITY UPDATE: HTTP DIGEST authentication weaknesses
  - debian/patches/0018-CVE-2011-1184.patch: add new nonce options in
    java/org/apache/catalina/authenticator/DigestAuthenticator.java,
    java/org/apache/catalina/authenticator/LocalStrings.properties,
    java/org/apache/catalina/authenticator/mbeans-descriptors.xml,
    java/org/apache/catalina/realm/RealmBase.java,
    webapps/docs/config/valve.xml.
  - CVE-2011-1184

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0015-CVE-2011-2204.patch
 
1
Description: fix information disclosure via log file
 
2
Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1140071
 
3
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632882
 
4
 
 
5
Index: tomcat6-6.0.28/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java
 
6
===================================================================
 
7
--- tomcat6-6.0.28.orig/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java    2011-09-20 10:25:53.391591677 -0400
 
8
+++ tomcat6-6.0.28/java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java 2011-09-20 10:26:28.931591394 -0400
 
9
@@ -180,7 +180,7 @@
 
10
             MBeanUtils.createMBean(group);
 
11
         } catch (Exception e) {
 
12
             IllegalArgumentException iae = new IllegalArgumentException
 
13
-                ("Exception creating group " + group + " MBean");
 
14
+                ("Exception creating group [" + groupname + "] MBean");
 
15
             iae.initCause(e);
 
16
             throw iae;
 
17
         }
 
18
@@ -203,7 +203,7 @@
 
19
             MBeanUtils.createMBean(role);
 
20
         } catch (Exception e) {
 
21
             IllegalArgumentException iae = new IllegalArgumentException
 
22
-                ("Exception creating role " + role + " MBean");
 
23
+                ("Exception creating role [" + rolename + "] MBean");
 
24
             iae.initCause(e);
 
25
             throw iae;
 
26
         }
 
27
@@ -228,7 +228,7 @@
 
28
             MBeanUtils.createMBean(user);
 
29
         } catch (Exception e) {
 
30
             IllegalArgumentException iae = new IllegalArgumentException
 
31
-                ("Exception creating user " + user + " MBean");
 
32
+                ("Exception creating user [" + username + "] MBean");
 
33
             iae.initCause(e);
 
34
             throw iae;
 
35
         }
 
36
@@ -256,7 +256,7 @@
 
37
             return (oname.toString());
 
38
         } catch (MalformedObjectNameException e) {
 
39
             IllegalArgumentException iae = new IllegalArgumentException
 
40
-                ("Cannot create object name for group " + group);
 
41
+                ("Cannot create object name for group [" + groupname + "]");
 
42
             iae.initCause(e);
 
43
             throw iae;
 
44
         }
 
45
@@ -283,7 +283,7 @@
 
46
             return (oname.toString());
 
47
         } catch (MalformedObjectNameException e) {
 
48
             IllegalArgumentException iae = new IllegalArgumentException
 
49
-                ("Cannot create object name for role " + role);
 
50
+                ("Cannot create object name for role [" + rolename + "]");
 
51
             iae.initCause(e);
 
52
             throw iae;
 
53
         }
 
54
@@ -310,7 +310,7 @@
 
55
             return (oname.toString());
 
56
         } catch (MalformedObjectNameException e) {
 
57
             IllegalArgumentException iae = new IllegalArgumentException
 
58
-                ("Cannot create object name for user " + user);
 
59
+                ("Cannot create object name for user [" + username + "]");
 
60
             iae.initCause(e);
 
61
             throw iae;
 
62
         }
 
63
@@ -335,7 +335,7 @@
 
64
             database.removeGroup(group);
 
65
         } catch (Exception e) {
 
66
             IllegalArgumentException iae = new IllegalArgumentException
 
67
-                ("Exception destroying group " + group + " MBean");
 
68
+                ("Exception destroying group [" + groupname + "] MBean");
 
69
             iae.initCause(e);
 
70
             throw iae;
 
71
         }
 
72
@@ -360,7 +360,7 @@
 
73
             database.removeRole(role);
 
74
         } catch (Exception e) {
 
75
             IllegalArgumentException iae = new IllegalArgumentException
 
76
-                ("Exception destroying role " + role + " MBean");
 
77
+                ("Exception destroying role [" + rolename + "] MBean");
 
78
             iae.initCause(e);
 
79
             throw iae;
 
80
         }
 
81
@@ -385,7 +385,7 @@
 
82
             database.removeUser(user);
 
83
         } catch (Exception e) {
 
84
             IllegalArgumentException iae = new IllegalArgumentException
 
85
-                ("Exception destroying user " + user + " MBean");
 
86
+                ("Exception destroying user [" + username + "] MBean");
 
87
             iae.initCause(e);
 
88
             throw iae;
 
89
         }
 
90
Index: tomcat6-6.0.28/java/org/apache/catalina/users/MemoryUserDatabase.java
 
91
===================================================================
 
92
--- tomcat6-6.0.28.orig/java/org/apache/catalina/users/MemoryUserDatabase.java  2011-09-20 10:26:11.651591530 -0400
 
93
+++ tomcat6-6.0.28/java/org/apache/catalina/users/MemoryUserDatabase.java       2011-09-20 10:26:33.601591357 -0400
 
94
@@ -549,7 +549,7 @@
 
95
             values = getUsers();
 
96
             while (values.hasNext()) {
 
97
                 writer.print("  ");
 
98
-                writer.println(values.next());
 
99
+                writer.println(((MemoryUser) values.next()).toXml());
 
100
             }
 
101
 
 
102
             // Print the file epilog
 
103
Index: tomcat6-6.0.28/java/org/apache/catalina/users/MemoryUser.java
 
104
===================================================================
 
105
--- tomcat6-6.0.28.orig/java/org/apache/catalina/users/MemoryUser.java  2011-09-20 10:26:04.321591591 -0400
 
106
+++ tomcat6-6.0.28/java/org/apache/catalina/users/MemoryUser.java       2011-09-20 10:26:31.391591375 -0400
 
107
@@ -246,7 +246,7 @@
 
108
      * <code>username</code> or </code>name</code> for the username
 
109
      * property.</p>
 
110
      */
 
111
-    public String toString() {
 
112
+    public String toXml() {
 
113
 
 
114
         StringBuffer sb = new StringBuffer("<user username=\"");
 
115
         sb.append(RequestUtil.filter(username));
 
116
@@ -293,5 +293,52 @@
 
117
 
 
118
     }
 
119
 
 
120
+    /**
 
121
+     * <p>Return a String representation of this user.</p>
 
122
+     */
 
123
+    @Override
 
124
+    public String toString() {
 
125
+
 
126
+        StringBuilder sb = new StringBuilder("User username=\"");
 
127
+        sb.append(RequestUtil.filter(username));
 
128
+        sb.append("\"");
 
129
+        if (fullName != null) {
 
130
+            sb.append(", fullName=\"");
 
131
+            sb.append(RequestUtil.filter(fullName));
 
132
+            sb.append("\"");
 
133
+        }
 
134
+        synchronized (groups) {
 
135
+            if (groups.size() > 0) {
 
136
+                sb.append(", groups=\"");
 
137
+                int n = 0;
 
138
+                Iterator<Group> values = groups.iterator();
 
139
+                while (values.hasNext()) {
 
140
+                    if (n > 0) {
 
141
+                        sb.append(',');
 
142
+                    }
 
143
+                    n++;
 
144
+                    sb.append(RequestUtil.filter(values.next().getGroupname()));
 
145
+                }
 
146
+                sb.append("\"");
 
147
+            }
 
148
+        }
 
149
+        synchronized (roles) {
 
150
+            if (roles.size() > 0) {
 
151
+                sb.append(", roles=\"");
 
152
+                int n = 0;
 
153
+                Iterator<Role> values = roles.iterator();
 
154
+                while (values.hasNext()) {
 
155
+                    if (n > 0) {
 
156
+                        sb.append(',');
 
157
+                    }
 
158
+                    n++;
 
159
+                    sb.append(RequestUtil.filter(values.next().getRolename()));
 
160
+                }
 
161
+                sb.append("\"");
 
162
+            }
 
163
+        }
 
164
+        return (sb.toString());
 
165
+    }
 
166
+
 
167
 
 
168
 }