Commits · e0424d6be29d6946943d1163884067384acd35f7 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

14 Sep, 2009 12 commits

* Follow the standard CHANGES format for security changes. · e0424d6b
Ruediger Pluem authored Sep 14, 2009
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814866 13f79535-47bb-0310-9956-ffa450edef68
```
e0424d6b
Correct attribution for mod_dav options provider interface. · dddc7e2e
Graham Leggett authored Sep 14, 2009
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814860 13f79535-47bb-0310-9956-ffa450edef68
```
dddc7e2e
* Replace brigade_move with apr_brigade_split_ex as spotted by pquerna. · 7add9b22
Ruediger Pluem authored Sep 14, 2009
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814854 13f79535-47bb-0310-9956-ffa450edef68
```
7add9b22

Add attribution and CVE notices. · 3f24dca3

Graham Leggett authored Sep 14, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814850 13f79535-47bb-0310-9956-ffa450edef68

3f24dca3

mod_dav: Allow other modules to add things to the DAV or Allow headers · 41a29e6e

Graham Leggett authored Sep 14, 2009

of an OPTIONS request.
Submitted by: Brian France <brian brianfrance.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814832 13f79535-47bb-0310-9956-ffa450edef68

41a29e6e

* Lower memory usage by reusing the brigade instead of constantly · 63ae0b6f

Ruediger Pluem authored Sep 14, 2009

  recerating one.

Submitted by: Stefan Fritsch <sf sfritsch.de>
Reviewed by: rpluem



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814807 13f79535-47bb-0310-9956-ffa450edef68

63ae0b6f

* support/htdbm.c (htdbm_list): Fix compiler warning on x86_64. · 83c4dae6

Joe Orton authored Sep 14, 2009

  (the field width must always be passed as an int if using "%.*")


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814792 13f79535-47bb-0310-9956-ffa450edef68

83c4dae6

* modules/proxy/mod_proxy_ftp.c (parse_epsv_reply): Remove redundant · 89694393

Joe Orton authored Sep 14, 2009

check for !p[0], thanks rpluem. Also update to take const argument
and fix comment, since the string is not modified in-place.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814785 13f79535-47bb-0310-9956-ffa450edef68

89694393

htdbm: don't allocate more memory for every record we dump. · 4bffed6a

Daniel Earl Poirier authored Sep 14, 2009

Thanks to Jeff Trawick for flagging this.
Also ensure a space before all dumped comments.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814781 13f79535-47bb-0310-9956-ffa450edef68

4bffed6a

Move declaration to remove a compiler warning. · 65292f5f

Graham Leggett authored Sep 14, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814779 13f79535-47bb-0310-9956-ffa450edef68

65292f5f

mod_mime: detect invalid use of MultiviewsMatch inside Location and · 0b1033ce

Daniel Earl Poirier authored Sep 14, 2009

LocationMatch sections.  Document that such usage is not valid.
PR47754.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814728 13f79535-47bb-0310-9956-ffa450edef68

0b1033ce

Security fix - this is presumed to fix CVE-2009-3094 (the disclosed · 9881400c

Joe Orton authored Sep 14, 2009

information was limited so this has not been confirmed):

* modules/proxy/mod_proxy_ftp.c (parse_epsv_reply): New function.
  (proxy_ftp_handler): Fix possible NULL pointer deference in
  apr_socket_close(NULL) on error paths.  Fix possible buffer overread
  in EPSV response parser; use parse_epsv_reply instead.  Thanks to
  Jeff Trawick and Stefan Fritsch for analysis of this issue.

Submitted by: Stefan Fritsch <sf fritsch.de>, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814652 13f79535-47bb-0310-9956-ffa450edef68

9881400c

13 Sep, 2009 7 commits

Bring the LDAPCacheEntries and LDAPOpCacheEntries usage() in synch with · 50324b19

Eric Covener authored Sep 13, 2009

the manual and the implementation (0 and -1 both disable the cache).

PR 40948


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814441 13f79535-47bb-0310-9956-ffa450edef68

50324b19

mod_request: Make sure the KeptBodySize directive rejects values · 4979c0aa

Graham Leggett authored Sep 13, 2009

that aren't valid numbers.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814337 13f79535-47bb-0310-9956-ffa450edef68

4979c0aa

Remove trailing whitespace from the mod_request module. · 9f67b81d

Graham Leggett authored Sep 13, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814336 13f79535-47bb-0310-9956-ffa450edef68

9f67b81d

mod_session_crypto: Sanity check should the potentially encrypted · 691b0692

Graham Leggett authored Sep 13, 2009

session cookie be too short.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814334 13f79535-47bb-0310-9956-ffa450edef68

691b0692

mod_session.c: Prevent a segfault when session is added but not · ca7c8b41

Graham Leggett authored Sep 13, 2009

configured.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814327 13f79535-47bb-0310-9956-ffa450edef68

ca7c8b41

Remove stray trailing whitespace from mod_session.c. · 929e0a12

Graham Leggett authored Sep 13, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814325 13f79535-47bb-0310-9956-ffa450edef68

929e0a12

Bring in support for an arbitrary list of mpms to the RPM spec file · abeb2271

Graham Leggett authored Sep 13, 2009

as per the fedora spec file.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814318 13f79535-47bb-0310-9956-ffa450edef68

abeb2271

12 Sep, 2009 2 commits

* Add missing , to make it compile again. · c8a63b1c

Ruediger Pluem authored Sep 12, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814114 13f79535-47bb-0310-9956-ffa450edef68

c8a63b1c

* Detab. · 2f0e39a6

Ruediger Pluem authored Sep 12, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814113 13f79535-47bb-0310-9956-ffa450edef68

2f0e39a6

11 Sep, 2009 5 commits

htcacheclean: 19 ways to fail, 1 error message. Fixed. · 32de8d5c

Graham Leggett authored Sep 11, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814091 13f79535-47bb-0310-9956-ffa450edef68

32de8d5c

Add an RPM init.d script to start the htcacheclean daemon, controlled · fec6e0bf

Graham Leggett authored Sep 11, 2009

by the optional /etc/sysconfig/htcacheclean configuration.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814079 13f79535-47bb-0310-9956-ffa450edef68

fec6e0bf

Catch the somewhat absurd combination of a 417 error where no Expect header · c72809d7
William A. Rowe Jr authored Sep 11, 2009
```
was present.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814048 13f79535-47bb-0310-9956-ffa450edef68
```
c72809d7

Security fix - this is presumed to fix CVE-2009-3095 (the disclosed · 40494782

Joe Orton authored Sep 11, 2009

information was limited so this has not been confirmed):

* modules/proxy/mod_proxy_ftp.c (proxy_ftp_handler): Fail if the
  decoded Basic credentials contain "special" characters.
  Thanks to Stefan Fritsch for analysis of this issue.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@814045 13f79535-47bb-0310-9956-ffa450edef68

40494782

Fix the RPM init.d script to correctly take into account the pid file · 15656f6d

Graham Leggett authored Sep 11, 2009

when starting and stopping the server. This prevents the init script
from blowing away other instances of httpd that might be running on the
same machine when someone attempts to stop the server.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813972 13f79535-47bb-0310-9956-ffa450edef68

15656f6d

10 Sep, 2009 7 commits

Fail server startup when mod_auth_digest is unable to · f8c7ff9c

Daniel Earl Poirier authored Sep 10, 2009

provide the security checks configured.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813396 13f79535-47bb-0310-9956-ffa450edef68

f8c7ff9c

hrmm · bf7e1c67

Jim Jagielski authored Sep 10, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813381 13f79535-47bb-0310-9956-ffa450edef68

bf7e1c67

doccs · 9d6b5385

Jim Jagielski authored Sep 10, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813379 13f79535-47bb-0310-9956-ffa450edef68

9d6b5385

veto-ed · 6876e93d

Jim Jagielski authored Sep 10, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813376 13f79535-47bb-0310-9956-ffa450edef68

6876e93d

* More style fixes. No functional changes. · 6a047020

Ruediger Pluem authored Sep 10, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813265 13f79535-47bb-0310-9956-ffa450edef68

6a047020

* Style fixes. No functional changes. · a0f40cec

Ruediger Pluem authored Sep 10, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813254 13f79535-47bb-0310-9956-ffa450edef68

a0f40cec

* Silence compiler warnings · 9da0cb92

Ruediger Pluem authored Sep 10, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813249 13f79535-47bb-0310-9956-ffa450edef68

9da0cb92

09 Sep, 2009 7 commits

mod_proxy_connect: The connect method doesn't work if the client is · 34aeb912

Graham Leggett authored Sep 09, 2009

connecting to the apache proxy through an ssl socket. Fixed.
PR: 29744.
Submitted by: Brad Boyer, Mark Cave-Ayland, Julian Gilbey, Fabrice Durand,
David Gence, Tim Dodge, Per Gunnar Hans, Emmanuel Elango, Kevin Croft,
Rudolf Cardinal


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813178 13f79535-47bb-0310-9956-ffa450edef68

34aeb912

Make sure the NULL terminator of the array is consistent with the other · 32f4d579

Graham Leggett authored Sep 09, 2009

elements in the array.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813165 13f79535-47bb-0310-9956-ffa450edef68

32f4d579

Update transformations. · d481af28

Graham Leggett authored Sep 09, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813128 13f79535-47bb-0310-9956-ffa450edef68

d481af28

<li> must be followed by a matching </li>. · b2c99c87

Graham Leggett authored Sep 09, 2009


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813127 13f79535-47bb-0310-9956-ffa450edef68

b2c99c87

mod_ssl: The error message when SSLCertificateFile is missing should at · e92fef18

Graham Leggett authored Sep 09, 2009

least give the name or position of the problematic virtual host definition.
[Stefan Fritsch sf sfritsch.de]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@813105 13f79535-47bb-0310-9956-ffa450edef68

e92fef18

mod_auth_digest: When qop is none, client doesn't send nonce count, · b3706dc4

Daniel Earl Poirier authored Sep 09, 2009

but module was segfaulting trying to check the nonce count anyway.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@812934 13f79535-47bb-0310-9956-ffa450edef68

b3706dc4

Nothing is installed within this tree · f074cb3b

William A. Rowe Jr authored Sep 09, 2009

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@812927 13f79535-47bb-0310-9956-ffa450edef68

f074cb3b