diff options
| author | Jacques Vidrine <nectar@FreeBSD.org> | 2002-03-23 19:34:54 +0000 |
|---|---|---|
| committer | Jacques Vidrine <nectar@FreeBSD.org> | 2002-03-23 19:34:54 +0000 |
| commit | a337ff9ae57bf18c53f27c2e053e2a138d3191c6 (patch) | |
| tree | f5af307831c30f01d94cf3b5e600d7fc90a20f4c /www | |
| parent | ari-yahoo repocopied to 'net' to live beside other Yahoo! messenger clients. (diff) | |
Patch buffer overflow described in
<URL:http://www.apache-ssl.org/advisory-20020301.txt>.
Notes
Notes:
svn path=/head/; revision=56496
Diffstat (limited to '')
| -rw-r--r-- | www/apache13-ssl/Makefile | 4 | ||||
| -rw-r--r-- | www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c | 27 |
2 files changed, 28 insertions, 3 deletions
diff --git a/www/apache13-ssl/Makefile b/www/apache13-ssl/Makefile index b9de43c55e1b..46edcd603054 100644 --- a/www/apache13-ssl/Makefile +++ b/www/apache13-ssl/Makefile @@ -9,6 +9,7 @@ PORTNAME= apache+ssl PORTVERSION= ${APACHE_VERSION}.${APACHE_SSL_VERSION} +PORTREVISION= 1 CATEGORIES= www security MASTER_SITES= http://www.apache.org/dist/ \ ftp://ftp.ox.ac.uk/pub/crypto/SSL/Apache-SSL/ \ @@ -86,9 +87,6 @@ CONFIGURE_ENV+= EXTRA_SSL_LIBS="-L${OPENSSLLIB} -L${LOCALBASE}/lib" MAN1= dbmmanage.1 htdigest.1 htpasswd.1 MAN8= ab.8 httpsdctl.8 apxs.8 httpsd.8 logresolve.8 rotatelogs.8 -FORBIDDEN= contains unpatched vulnerabilities: CAN-2001-0729, 0730, 0731 \ - and SSL vulnerability - post-extract: @cd ${WRKSRC} && tar xzf ${DISTDIR}/apache_${APACHE_VERSION}+ssl_${APACHE_SSL_VERSION}${EXTRACT_SUFX} diff --git a/www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c b/www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c new file mode 100644 index 000000000000..6ed9f3ad0dd9 --- /dev/null +++ b/www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c @@ -0,0 +1,27 @@ +--- src/modules/ssl/apache_ssl.c Wed Dec 5 08:24:16 2001 ++++ src/modules/ssl/apache_ssl.c Mon Mar 4 04:17:11 2002 +@@ -1254,7 +1254,6 @@ + static void SendSessionToServer(SSL_SESSION *pSession, + conn_rec *pCurrentConnection) + { +- uchar buf[MAX_SESSION_DER]; + Cache *p; + uchar *t; + int nLength; +@@ -1273,13 +1272,13 @@ + memcpy(t,pSession->session_id,pSession->session_id_length); + p=LocalCacheAdd(t,pSession->session_id_length,tExpiresAt); + +- t=buf; +- nLength=i2d_SSL_SESSION(pSession,&t); ++ nLength=i2d_SSL_SESSION(pSession,NULL); + assert(nLength > 0); + assert(nLength <= MAX_SESSION_DER); + + p->aucData=malloc(nLength); +- memcpy(p->aucData,buf,nLength); ++ t=p->aucData; ++ nLength=i2d_SSL_SESSION(pSession,&t); + p->nData=nLength; + + GlobalCacheAdd(p->aucKey,p->nKey,p->aucData,p->nData,tExpiresAt); |