← Back to branch summary

~ubuntu-branches/ubuntu/natty/tomcat6/natty-proposed

« back to all changes in this revision

Viewing changes to debian/patches/0017-CVE-2011-3190.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2011-09-26 11:27:14 UTC
  • Revision ID: package-import@ubuntu.com-20110926112714-ngfuvuxfnr5oe2x8
Tags: 6.0.28-10ubuntu2.2
https://launchpad.net/bugs/843701
* SECURITY UPDATE: information disclosure via log file
  - debian/patches/0015-CVE-2011-2204.patch: fix logging in
    java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java,
    java/org/apache/catalina/users/MemoryUserDatabase.java,
    java/org/apache/catalina/users/MemoryUser.java.
  - CVE-2011-2204
* SECURITY UPDATE: file restriction bypass or denial of service via
  untrusted web application.
  - debian/patches/0016-CVE-2011-2526.patch: check canonical name in
    java/org/apache/catalina/connector/LocalStrings.properties,
    java/org/apache/catalina/connector/Request.java,
    java/org/apache/catalina/servlets/DefaultServlet.java,
    java/org/apache/coyote/http11/Http11AprProcessor.java,
    java/org/apache/coyote/http11/LocalStrings.properties,
    java/org/apache/tomcat/util/net/AprEndpoint.java,
    java/org/apache/tomcat/util/net/NioEndpoint.java.
  - CVE-2011-2526
* SECURITY UPDATE: AJP request spoofing and authentication bypass
  (LP: #843701)
  - debian/patches/0017-CVE-2011-3190.patch: Properly handle request
    bodies in java/org/apache/coyote/ajp/AjpAprProcessor.java,
    java/org/apache/coyote/ajp/AjpProcessor.java.
  - CVE-2011-3190
* SECURITY UPDATE: HTTP DIGEST authentication weaknesses
  - debian/patches/0018-CVE-2011-1184.patch: add new nonce options in
    java/org/apache/catalina/authenticator/DigestAuthenticator.java,
    java/org/apache/catalina/authenticator/LocalStrings.properties,
    java/org/apache/catalina/authenticator/mbeans-descriptors.xml,
    java/org/apache/catalina/realm/RealmBase.java,
    webapps/docs/config/valve.xml.
  - CVE-2011-1184

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0017-CVE-2011-3190.patch
 
1
Description: fix AJP request spoofing and authentication bypass
 
2
Origin: upstream, http://svn.apache.org/viewvc?rev=1162959&view=rev
 
3
Bug-Ubuntu: https://bugs.launchpad.net/bugs/843701
 
4
Bug: https://issues.apache.org/bugzilla/show_bug.cgi?id=50189
 
5
Bug: https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
 
6
 
 
7
Index: tomcat6-6.0.28/java/org/apache/coyote/ajp/AjpAprProcessor.java
 
8
===================================================================
 
9
--- tomcat6-6.0.28.orig/java/org/apache/coyote/ajp/AjpAprProcessor.java 2011-09-20 10:33:13.541588195 -0400
 
10
+++ tomcat6-6.0.28/java/org/apache/coyote/ajp/AjpAprProcessor.java      2011-09-20 10:33:38.251588001 -0400
 
11
@@ -390,11 +390,13 @@
 
12
                     }
 
13
                     continue;
 
14
                 } else if(type != Constants.JK_AJP13_FORWARD_REQUEST) {
 
15
-                    // Usually the servlet didn't read the previous request body
 
16
-                    if(log.isDebugEnabled()) {
 
17
-                        log.debug("Unexpected message: "+type);
 
18
+                    // Unexpected packet type. Unread body packets should have
 
19
+                    // been swallowed in finish().
 
20
+                    if (log.isDebugEnabled()) {
 
21
+                        log.debug("Unexpected message: " + type);
 
22
                     }
 
23
-                    continue;
 
24
+                    error = true;
 
25
+                    break;
 
26
                 }
 
27
 
 
28
                 keptAlive = true;
 
29
@@ -1026,6 +1028,11 @@
 
30
 
 
31
         finished = true;
 
32
 
 
33
+        // Swallow the unread body packet if present
 
34
+        if (first && request.getContentLengthLong() > 0) {
 
35
+            receive();
 
36
+        }
 
37
+        
 
38
         // Add the end message
 
39
         if (outputBuffer.position() + endMessageArray.length > outputBuffer.capacity()) {
 
40
             flush();
 
41
Index: tomcat6-6.0.28/java/org/apache/coyote/ajp/AjpProcessor.java
 
42
===================================================================
 
43
--- tomcat6-6.0.28.orig/java/org/apache/coyote/ajp/AjpProcessor.java    2011-09-20 10:33:20.851588140 -0400
 
44
+++ tomcat6-6.0.28/java/org/apache/coyote/ajp/AjpProcessor.java 2011-09-20 10:33:40.801587980 -0400
 
45
@@ -408,11 +408,13 @@
 
46
                     }
 
47
                     continue;
 
48
                 } else if(type != Constants.JK_AJP13_FORWARD_REQUEST) {
 
49
-                    // Usually the servlet didn't read the previous request body
 
50
-                    if(log.isDebugEnabled()) {
 
51
-                        log.debug("Unexpected message: "+type);
 
52
+                    // Unexpected packet type. Unread body packets should have
 
53
+                    // been swallowed in finish().
 
54
+                    if (log.isDebugEnabled()) {
 
55
+                        log.debug("Unexpected message: " + type);
 
56
                     }
 
57
-                    continue;
 
58
+                    error = true;
 
59
+                    break;
 
60
                 }
 
61
 
 
62
                 request.setStartTime(System.currentTimeMillis());
 
63
@@ -1031,6 +1033,11 @@
 
64
 
 
65
         finished = true;
 
66
 
 
67
+        // Swallow the unread body packet if present
 
68
+        if (first && request.getContentLengthLong() > 0) {
 
69
+            receive();
 
70
+        }
 
71
+        
 
72
         // Add the end message
 
73
         output.write(endMessageArray);
 
74