Sat May 23 07:12:46 2009 UTC ()
Pullup ticket 2778 - requested by tron
Security fix

Revisions pulled up:
- pkgsrc/www/apache22/Makefile			1.43
- pkgsrc/www/apache22/distinfo			1.18
- pkgsrc/www/apache22/patches/patch-ab		1.10

   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Fri May 22 09:46:06 UTC 2009

   Modified Files:
   	pkgsrc/www/apache22: Makefile distinfo
   Added Files:
   	pkgsrc/www/apache22/patches: patch-ab

   Log Message:
   Add patch from the Apache SVN repository to fix the information leak
   in the "mod_proxy_ajp" module reported in CVE-2009-1191.

   To generate a diff of this commit:
   cvs rdiff -u -r1.42 -r1.43 pkgsrc/www/apache22/Makefile
   cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/apache22/distinfo
   cvs rdiff -u -r0 -r1.10 pkgsrc/www/apache22/patches/patch-ab


(spz)
diff -r1.39 -r1.39.2.1 pkgsrc/www/apache22/Makefile
diff -r0 -r1.10.2.2 pkgsrc/www/apache22/patches/patch-ab
cvs diff -r1.39 -r1.39.2.1 pkgsrc/www/apache22/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/www/apache22/Attic/Makefile 2009/02/25 15:39:38 1.39
+++ pkgsrc/www/apache22/Attic/Makefile 2009/05/23 07:12:45 1.39.2.1
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.39 2009/02/25 15:39:38 tron Exp $ 1# $NetBSD: Makefile,v 1.39.2.1 2009/05/23 07:12:45 spz Exp $
2 2
3DISTNAME= httpd-2.2.11 3DISTNAME= httpd-2.2.11
4PKGREVISION= 2 4PKGREVISION= 3
5PKGNAME= ${DISTNAME:S/httpd/apache/} 5PKGNAME= ${DISTNAME:S/httpd/apache/}
6CATEGORIES= www 6CATEGORIES= www
7MASTER_SITES= ${MASTER_SITE_APACHE:=httpd/} \ 7MASTER_SITES= ${MASTER_SITE_APACHE:=httpd/} \
8 ${MASTER_SITE_APACHE:=httpd/old/} 8 ${MASTER_SITE_APACHE:=httpd/old/}
9EXTRACT_SUFX= .tar.bz2 9EXTRACT_SUFX= .tar.bz2
10 10
11MAINTAINER= tron@NetBSD.org 11MAINTAINER= tron@NetBSD.org
12HOMEPAGE= http://httpd.apache.org/ 12HOMEPAGE= http://httpd.apache.org/
13COMMENT= Apache HTTP (Web) server, version 2 13COMMENT= Apache HTTP (Web) server, version 2
14 14
15PKG_DESTDIR_SUPPORT= user-destdir 15PKG_DESTDIR_SUPPORT= user-destdir
16 16
17CONFLICTS= apache-{,*ssl}-[0-9]* apache6-[0-9]* 17CONFLICTS= apache-{,*ssl}-[0-9]* apache6-[0-9]*
File Added: pkgsrc/www/apache22/patches/Attic/patch-ab
$NetBSD: patch-ab,v 1.10.2.2 2009/05/23 07:12:45 spz Exp $

Patch for CVE-2009-1191 taken from the Apache SVN repository:
http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_ajp.c?view=markup&pathrev=768506

--- modules/proxy/mod_proxy_ajp.c	2008/11/15 14:25:54	714273
+++ modules/proxy/mod_proxy_ajp.c	2009/04/25 09:58:52	768506
@@ -307,21 +307,17 @@
                          "proxy: read zero bytes, expecting"
                          " %" APR_OFF_T_FMT " bytes",
                          content_length);
-            status = ajp_send_data_msg(conn->sock, msg, 0);
-            if (status != APR_SUCCESS) {
-                /* We had a failure: Close connection to backend */
-                conn->close++;
-                ap_log_error(APLOG_MARK, APLOG_ERR, status, r->server,
-                            "proxy: send failed to %pI (%s)",
-                            conn->worker->cp->addr,
-                            conn->worker->hostname);
-                return HTTP_INTERNAL_SERVER_ERROR;
-            }
-            else {
-                /* Client send zero bytes with C-L > 0
-                 */
-                return HTTP_BAD_REQUEST;
-            }
+            /*
+             * We can only get here if the client closed the connection
+             * to us without sending the body.
+             * Now the connection is in the wrong state on the backend.
+             * Sending an empty data msg doesn't help either as it does
+             * not move this connection to the correct state on the backend
+             * for later resusage by the next request again.
+             * Close it to clean things up.
+             */
+            conn->close++;
+            return HTTP_BAD_REQUEST;
         }
     }