SECURITY: CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest.

The value placeholder in [Proxy-]Authorization headers type 'Digest' was not
initialized or reset before or between successive key=value assignments by
mod_auth_digest.  Providing an initial key with no '=' assignment could reflect
the stale value of uninitialized pool memory used by the prior request, leading
to leakage of potentially confidential information, and a segfault.

Submitted by: wrowe
Backports: r1800919
Reviewed by: wrowe, jim, jchampion

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1800955 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index cc2f9e5592c337391e8937f12984d24a83625297..6f4ef92edcf159ddecc0507758b4fbf708e9bb3e 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -115,11 +115,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-   *) Correct string scope to prevent duplicated values for subsequent tokens.
-      Submitted by: wrowe
-      trunk patch: http://svn.apache.org/r1800919
-      +1: wrowe, jim, jchampion
-
    *) Fix negotiation type parsing to be strict about "*", "*/*" and "type/*"
       comparisons.
       Submitted by: wrowe, Robert Święcki <robert swiecki.net>

diff --git a/modules/aaa/mod_auth_digest.c b/modules/aaa/mod_auth_digest.c
index d0c77dc5695065ee91fa1f4b4324918c4fe3349b..e99cb3b3f1118f34b8bdde7c65f46a21501a96ce 100644 (file)
--- a/modules/aaa/mod_auth_digest.c
+++ b/modules/aaa/mod_auth_digest.c
@@ -965,13 +965,13 @@ static int get_digest_rec(request_rec *r, digest_header_rec *resp)
 
         /* find value */
 
+        vv = 0;
         if (auth_line[0] == '=') {
             auth_line++;
             while (apr_isspace(auth_line[0])) {
                 auth_line++;
             }
 
-            vv = 0;
             if (auth_line[0] == '\"') {         /* quoted string */
                 auth_line++;
                 while (auth_line[0] != '\"' && auth_line[0] != '\0') {
@@ -990,8 +990,8 @@ static int get_digest_rec(request_rec *r, digest_header_rec *resp)
                     value[vv++] = *auth_line++;
                 }
             }
-            value[vv] = '\0';
         }
+        value[vv] = '\0';
 
         while (auth_line[0] != ',' && auth_line[0] != '\0') {
             auth_line++;