SOURCES: apache-CVE-2005-3352.patch (NEW) - Cross-site scripting (...

[glen]

Author: glen                         Date: Tue Feb  7 19:35:47 2006 GMT
Module: SOURCES                       Tag: HEAD
---- Log message:
- Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd

---- Files affected:
SOURCES:
   apache-CVE-2005-3352.patch (NONE -> 1.1)  (NEW)

---- Diffs:

================================================================
Index: SOURCES/apache-CVE-2005-3352.patch
diff -u /dev/null SOURCES/apache-CVE-2005-3352.patch:1.1
--- /dev/null	Tue Feb  7 20:35:47 2006
+++ SOURCES/apache-CVE-2005-3352.patch	Tue Feb  7 20:35:42 2006
@@ -0,0 +1,35 @@
+http://bugs.gentoo.org/show_bug.cgi?id=118875
+
+--- server/util.c	(revision 330526)
++++ server/util.c	(working copy)
+@@ -1762,6 +1762,8 @@
+             j += 3;
+         else if (s[i] == '&')
+             j += 4;
++        else if (s[i] == '"')
++            j += 5;
+ 
+     if (j == 0)
+         return apr_pstrmemdup(p, s, i);
+@@ -1780,6 +1782,10 @@
+             memcpy(&x[j], "&", 5);
+             j += 4;
+         }
++        else if (s[i] == '"') {
++            memcpy(&x[j], """, 6);
++            j += 5;
++        }
+         else
+             x[j] = s[i];
+ 
+--- modules/mappers/mod_imap.c	(revision 330526)
++++ modules/mappers/mod_imap.c	(working copy)
+@@ -342,7 +342,7 @@
+     if (!strcasecmp(value, "referer")) {
+         referer = apr_table_get(r->headers_in, "Referer");
+         if (referer && *referer) {
+-	    return apr_pstrdup(r->pool, referer);
++	    return ap_escape_html(r->pool, referer);
+         }
+         else {
+ 	    /* XXX:  This used to do *value = '\0'; ... which is totally bogus
================================================================