CVE-2006-5752 backport

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@555482 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 263853acdf82184568903dffd3fa4f305b10bf1e..54a1eb607e6cb5bfea6e19ea449c2f8a36ec7708 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,11 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.0.60
 
+  *) SECURITY: CVE-2006-5752 (cve.mitre.org)
+     mod_status: Fix a possible XSS attack against a site with a public
+     server-status page and ExtendedStatus enabled, for browsers which
+     perform charset "detection".  Reported by Stefan Esser.  [Joe Orton]
+
   *) mod_ssl: initialize thread locks before initializing the hardware
      acceleration library, so the latter can make use of the former. 
      PR 20951. [<adunn ncipher.com>]

diff --git a/STATUS b/STATUS
index f59ea33712d0160590b6d31d1e7920a1c8cb20ce..a8cc69eb2f8e5011ca7135737caa34132aaff85a 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -114,7 +114,7 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-    *) SECURITY: CVE-2007-1863 (cve.mitre.org)
+    * SECURITY: CVE-2007-1863 (cve.mitre.org)
       mod_cache: Prevent segfault from Cache-Control headers with no
       values
       Trunk version of patch:
@@ -142,11 +142,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
        http://svn.apache.org/viewvc?view=rev&rev=520733
        +1: wrowe, sctemme, rpluem
 
-    * SECURITY: CVE-2006-5752
-      mod_status XSS fix for broken browsers:
-        http://svn.apache.org/viewvc?view=rev&rev=549159
-      +1: jorton, rpluem, sctemme
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ please place SVN revisions from trunk here, so it is easy to
     identify exactly what the proposed changes are!  Add all new

diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
index 771cd072070d0a9b81bc6c11624e1c524364264f..cb176ce09cf933734bedc450aa39afd9b900bb1e 100644 (file)
--- a/modules/generators/mod_status.c
+++ b/modules/generators/mod_status.c
@@ -269,7 +269,7 @@ static int status_handler(request_rec *r)
     if (r->method_number != M_GET)
         return DECLINED;
 
-    ap_set_content_type(r, "text/html");
+    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
 
     /*
      * Simple table-driven form data set parser that lets you alter the header
@@ -298,7 +298,7 @@ static int status_handler(request_rec *r)
                     no_table_report = 1;
                     break;
                 case STAT_OPT_AUTO:
-                    ap_set_content_type(r, "text/plain");
+                    ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
                     short_report = 1;
                     break;
                 }
@@ -664,7 +664,8 @@ static int status_handler(request_rec *r)
                                ap_escape_html(r->pool,
                                               ws_record->client),
                                ap_escape_html(r->pool,
-                                              ws_record->request),
+                                              ap_escape_logitem(r->pool,
+                                                                ws_record->request)),
                                ap_escape_html(r->pool,
                                               ws_record->vhost));
                 }
@@ -753,7 +754,8 @@ static int status_handler(request_rec *r)
                                    ap_escape_html(r->pool,
                                                   ws_record->vhost),
                                    ap_escape_html(r->pool,
-                                                  ws_record->request));
+                                                  ap_escape_logitem(r->pool, 
+                                                                    ws_record->request)));
                 } /* no_table_report */
             } /* for (j...) */
         } /* for (i...) */