* Recai Oktaş:
> * Recai Oktaş [2006-01-25 09:34:15+0200]
> Florian: If you haven't any objections, I'll upload to stable-security
You need to coordinate this with the stable-security team. If you
could upload a new upstream version to unstable, this would be fine,
though.
So far, the patch for CVE-2006-0347 was missing. A tentative backport
of the upstream fix is included below. I dropped the hunk which dealt
with "scripts" support because this functionality is not present in
the sarge version.
The changelog entry should look like this:
Backport revision 1620 from upstream Subversion repository:
"Prohibit '..' in URLs" [CVE-2006-0347]
diff --git a/src/elogd.c b/src/elogd.c
index a24f27e..dbf2101 100755
--- a/src/elogd.c
+++ b/src/elogd.c
@@ -20872,6 +20872,25 @@ void server_loop(void)
setcfg_topgroup("");
p = strchr(net_buffer, '/') + 1;
+
+ /* check for ../.. to avoid serving of files on top of the elog
directory */
+ for (i = 0; p[i] && p[i] != ' ' && p[i] != '?'; i++)
+ url[i] = p[i];
+ url[i] = 0;
+
+ if (strstr(url, "../..")) {
+ sprintf(str, "Invalid URL: %s", url);
+ show_error(str);
+ send(_sock, return_buffer, strlen_retbuf + 1, 0);
+ keep_alive = 0;
+ if (verbose) {
+ eprintf("==== Return ================================\n");
+ eputs(return_buffer);
+ eprintf("\n\n");
+ }
+ goto finished;
+ }
+
logbook[0] = 0;
for (i = 0; *p && *p != '/' && *p != '?' && *p != ' '; i++)
logbook[i] = *p++;
@@ -20935,6 +20954,21 @@ void server_loop(void)
strstr(logbook, ".jpg") || strstr(logbook, ".png") ||
strstr(logbook, ".ico") || strstr(logbook, ".htm")
|| strstr(logbook, ".css")) {
+
+ /* do not allow '..' in file name */
+ if (strstr(logbook, "..")) {
+ sprintf(str, "Invalid URL: %s", logbook);
+ show_error(str);
+ send(_sock, return_buffer, strlen_retbuf + 1, 0);
+ keep_alive = 0;
+ if (verbose) {
+ eprintf("==== Return ================================\n");
+ eputs(return_buffer);
+ eprintf("\n\n");
+ }
+ goto finished;
+ }
+
/* check if file in resource directory */
strlcpy(str, resource_dir, sizeof(str));
strlcat(str, logbook, sizeof(str));
