>Number: 3522
>Category: os-irix
>Synopsis: Directory listings messed up (showing random data from memory).
>Confidential: no
>Severity: critical
>Priority: medium
>Responsible: apache
>State: open
>Class: sw-bug
>Submitter-Id: apache
>Arrival-Date: Thu Dec 10 11:10:00 PST 1998
>Last-Modified:
>Originator: [EMAIL PROTECTED]
>Organization:
apache
>Release: Apache 1.3.3
>Environment:
Standard C Compiler
IRIX64 mis1 6.4 02121744 IP27
It was compiled with standard options for irix/sgi (I didn't change anything)
>Description:
Instead of generating a simple link for a page, it is getting additional data.
<LI><A HREF="MA_AGC_ISO_1998110301_19981105130435.CSV.gz">
MA_AGC_ISO_1998110301_19981105130435.CSV.gz</A>s/participant/50051/MA/README
The BIGGEST security problem is that occasionally it gets data from /etc/passwd
and displays it all (including
the encrypted passwords).
>How-To-Repeat:
Have a directory with over 1000 files. I unfortunatly can't supply you with a
URL (its behind firewalls and is confidential information).
>Fix:
I was able to track the bug into the function output_directories
(/modules/standard/mod_autoindex.c)
and have currently kludged a fix to it. The problem appears to be when the
function
ap_rvputs(r, "<LI><A HREF=\"", anchor, "\"> ", t2, "</A>", pad, NULL); is
called. The pad
function. The pad variable has random garbage from RAM inserted into it (at
least for non-fancy indexing).
For my quick fix, I explicitly told it to use a " " when it was not fancy
indexing
instead of the pad with bogus data.
ap_rvputs(r, "<LI><A HREF=\"", anchor, "\"> ", t2,
"</A>", (autoindex_opts & FANCY_INDEXING) ? pad : " ",
NULL);
The fix should be to ensure that any/all places that pad is used that it gets
initialized to '\0's.
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <[EMAIL PROTECTED]> in the Cc line ]
[and leave the subject line UNCHANGED. This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig- ]
[nored unless you are responding to an explicit request ]
[from a developer. ]
[Reply only with text; DO NOT SEND ATTACHMENTS! ]
