[3988] in WWW Security List Archive
Re: Security release: Apache 1.1.2 (fwd)
daemon@ATHENA.MIT.EDU (John Stewart)
Wed Jan 15 14:07:39 1997
To: Michael Brennen <mbrennen@fni.com>
cc: Daniel Rinehart <danielr@ccs.neu.edu>,
www security <www-security@ns2.rutgers.edu>
In-reply-to: Your message of "Tue, 14 Jan 1997 08:54:19 CST."
<Pine.LNX.3.95.970114085014.16936B-100000@ns1.fni.com>
Date: Wed, 15 Jan 1997 08:44:47 -0800
From: John Stewart <jns@cisco.com>
Errors-To: owner-www-security@ns2.rutgers.edu
->
-> Don't install the directory patch; it will break CGI execution. I have
-> not looked into the patch to determine why. Stronghold has apparently
-> already released a modified directory patch that doesn't break CGI; I
-> expect Apache will follow shortly (if it isn't already in the rest of my
-> inbox that I haven't gotten to yet.)
->
-> -- Michael (mbrennen@fni.com)
Well, three days ago a co-worker and I released this patch to the
Apache project, they acked the message, and then radio silence.
RCS file: RCS/http_request.c,v
retrieving revision 1.1
diff -c -r1.1 http_request.c
*** http_request.c 1997/01/13 19:53:58 1.1
--- http_request.c 1997/01/13 19:54:17
***************
*** 180,186 ****
return OK;
}
#if defined(ENOENT)
! else if (errno == ENOENT) {
#else
#error Your system apparently does not define ENOENT.
#error Removal of these lines opens a security hole if protecting
--- 180,186 ----
return OK;
}
#if defined(ENOENT)
! else if ((errno == ENOENT) || is_scriptaliased(r)) {
#else
#error Your system apparently does not define ENOENT.
#error Removal of these lines opens a security hole if protecting
***************
*** 197,203 ****
}
#if defined(ENOENT)
else {
! log_printf(r->server, "access to %s failed for client; unable to de
termine if index file exists (stat() returned unexpected error)", r->filename);
return FORBIDDEN;
}
#endif
--- 197,203 ----
}
#if defined(ENOENT)
else {
! log_printf(r->server, "access to %s failed for client; unable to de
termine if index file exists (stat() returned unexpected error: %d)", r->filena
me, errno);
return FORBIDDEN;
}
#endif
