DoS-vulnerability in lighttpd

[Fridtjof Busse]

Binary package hint: lighttpd

I know it's universe, but it deserves to be fixed:
http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt
http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt
Both problems are fixed in 1.4.14, but since that version contains a regression, 1.4.15 is the best version to go with (or a backport).

Patches are here:
http://www.lighttpd.net/assets/2007/4/13/lighttpd-1.4.x_crlf_parsing_dos.patch
http://www.lighttpd.net/assets/2007/4/13/lighttpd-1.4.x_zero_mtime_crash.patch

[Kees Cook (kees)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. If someone can prepare (and test) the fixes and attach debdiffs that follow the [https://wiki.ubuntu.com/SecurityUpdateProcedures], I'd be more than happy to get them uploaded.

[Scott Kitterman (kitterman)]

I'll take a stab at it.

[Scott Kitterman (kitterman)]

The relevant patches are already in the Feisty version, so no issue there.

[Scott Kitterman (kitterman)]

For the initial reporter, what version of Ubuntu are you running? I'll prepare a package for that one first so you can test it.

[Fridtjof Busse (fbusse-deactivatedaccount-deactivatedaccount)]

Running feisty as of couple of minutes ago. The changelog on packages.ubuntu.com was outdated, thus I missed the fixed package. But I can test on edgy/dapper nonetheless, I have plenty of virtual machines around.

[Scott Kitterman (kitterman)]

OK. I can make i386 binaries or give you a source patch.

[Scott Kitterman (kitterman)]

This is going to take a while because the Ubuntu repositories are totally hammered by the Feisty release.

[Scott Kitterman (kitterman)]

Debdiff for Edgy for testing.

[Scott Kitterman (kitterman)]

Dapper debdiff for testing. Note that only one of the two isses was relevant to this version.

[Scott Kitterman (kitterman)]

Dapper-proposed debdiff for testing. Note that only one of the two isses was relevant to this version.

[Scott Kitterman (kitterman)]

Here are the source changes for all the supported releases. If you need me to build binaries for you (I can do -i386), let me know. Otherwise, please test these and then let us know how it goes.

[Kees Cook (kees)]

On Thu, Apr 19, 2007 at 06:48:33PM -0000, Scott Kitterman wrote:
> Debdiff for Edgy for testing.

Hi Scott,

Thanks very much for getting the patches extracted. The lighttpd
package, however, uses the "dpatch" patch system. Instead of applying
the fixes inline, please use "dpatch-edit-patch". For more details on
patching packages with different patch mechanisms, see pitti's excellent
write up:
https://wiki.ubuntu.com/MOTU/School/PatchingSources

--
Kees Cook

[Fridtjof Busse (fbusse-deactivatedaccount-deactivatedaccount)]

Works and builds fine on dapper i386 (patch applied by hand).

[Scott Kitterman (kitterman)]

Updated patch for Edgy using the patch system. Pbuilt and verified in the pbuilder log that the patches were applied. I can probide i386 binaries for testing if requested.

[Scott Kitterman (kitterman)]

Dapper fix with dpatch. Version number is due to the .1 already in dapper proposed.

[Scott Kitterman (kitterman)]

Dapper-proposed fix with dpatch attached.

[Scott Kitterman (kitterman)]

Also subscribing MOTU SRU because the fix impacts dapper-proposed.

[Kees Cook (kees)]

Show state in Feisty (fixed already), Edgy, and Dapper. Also linking to CVE.

[Daniel T Chen (crimsun)]

+1 for new dapper-proposed.

[William Grant (wgrant)]

I've uploaded the security fix for 1.4.11-3ubuntu3.1 to dapper-proposed.

[Martin Pitt (pitti)]

Updated packages released to -security. Thank you!

[Martin Pitt (pitti)]

Package released to dapper-security. Thank you!

[Martin Pitt (pitti)]

Just for the record, I rejected the dapper-proposed upload because the fix is already in -security.

[Scott Kitterman (kitterman)]

Then that leaves us with a higher version numbered package in
dapper-proposed that is unpatched. If that SRU ever gets released we'll
re-introduce the vulnerability.

[Martin Pitt (pitti)]

Scott, I don't understand -- If the -proposed package has the same vulnerability fix, then it doesn't matter. If it fixes something different, then it should not be treated in this bug report.

[Daniel T Chen (crimsun)]

Martin, Scott's debdiff for a new dapper-proposed source upload contains the fix in the dapper-security upload. The current dapper-proposed source does /not/ contain this fix.

[Scott Kitterman (kitterman)]

The problem is that when this was reported, there was an updated for Dapper sitting in dapper-proposed:

https://launchpad.net/ubuntu/dapper/+source/lighttpd

That update:

https://launchpad.net/ubuntu/dapper/+source/lighttpd/1.4.11-3ubuntu3.1

has been sitting in dapper-proposed since last November and lacks the fix for this issue. So the existing -proposed package has the vulnerability. The upload you rejected was meant to replace it by fixing the vulnerability.

As it stands right now, should 1.4.11-3ubuntu3.1 ever finish SRU testing and be released, it would re-introduce this vulnerability. The intent of the 1.4.11-3ubuntu3.2 upload was to ensure (in advance) that this would not happen.

Sorry I wasn't clear before (hope I am now).

[Martin Pitt (pitti)]

Hi Scott,

Scott Kitterman [2007-05-03 11:52 -0000]:
> That update:
>
> https://launchpad.net/ubuntu/dapper/+source/lighttpd/1.4.11-3ubuntu3.1
>
> has been sitting in dapper-proposed since last November and lacks the
> fix for this issue. So the existing -proposed package has the
> vulnerability. The upload you rejected was meant to replace it by
> fixing the vulnerability.

Ah, I'm terribly sorry. Can you please upload it again then?

Thanks,

Martin
--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org

[Scott Kitterman (kitterman)]

I've attached the dapper-proposed debdiff with the maintainer change removed to be uploaded again.

[Scott Kitterman (kitterman)]

This time with the mention of the maintainer change removed from the changelog....

[Scott Kitterman (kitterman)]

dapper-proposed update uploaded.