AJP_EBAD_METHOD is also a bad request so return HTTP_NOT_IMPLEMENTED

Submitted by: jfclere
Backports: r1166551, r1166657
Reviewed by: wrowe, jorton

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1167158 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 0fe3146f0e9ad0c8d796b6bdf998b3c1eee7b3bf..13ca80ce0519bf4b2a940931c3c59fbe3f71a9d5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.2.21
 
+  *) SECURITY: CVE-2011-3348 (cve.mitre.org)
+     mod_proxy_ajp: Respond with HTTP_NOT_IMPLEMENTED when the method is not
+     recognized.  [Jean-Frederic Clere]
+
   *) Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20.
      PR 51748. [<lowprio20 gmail.com>]
 

diff --git a/STATUS b/STATUS
index 0ea546884a5f91a937e6f2efdd2a92577f6ed204..625c36e320d1ef68758175d4e80bb6a2489d414c 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -93,10 +93,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  * mod_proxy_ajp: return HTTP_NOT_IMPLEMENTED when AJP_EBAD_METHOD
-    Trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1166551 &
-                 http://svn.apache.org/viewvc?view=revision&revision=1166657
-    +1: jfclere, jorton, wrowe
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
index 0d8095fa598bd97461390f39cb66ad09c991a611..92084e3182944e96d480ba44cc75bca73f024b08 100644 (file)
--- a/modules/proxy/mod_proxy_ajp.c
+++ b/modules/proxy/mod_proxy_ajp.c
@@ -214,7 +214,9 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
                      conn->worker->hostname);
         if (status == AJP_EOVERFLOW)
             return HTTP_BAD_REQUEST;
-        else {
+        else if  (status == AJP_EBAD_METHOD) {
+            return HTTP_NOT_IMPLEMENTED;
+        } else {
             /*
              * This is only non fatal when the method is idempotent. In this
              * case we can dare to retry it with a different worker if we are