135310 – [patch][vuxml] devel/apr, www/apache22: fix recent vulnerabilities in APR-util

no flags

Multiple vulnerabilities were discovered in APR-util since 1.3.4: [1].
There are reports from various security teams about this: [2], [3].
There is a PoC at
  http://securityvulns.ru/files/apache-ied.pl
It works for me on Apache 2.2.11_4 with Subversion DAV -- all httpd
children are in the RUN state and MaxChild limit is easily reached.

Fix: This is the patch for Apache 2.2 port with all fixes backported.
It works on my servers for a couple of hours without any visible
regressions.

This is the patch that updates the devel/apr to the latest stable
version, thus fixing all 3 issues.  I had also made portlint happy
by using <Tab> after MAKE_JOBS_SAFE.  And since there are additional
libraries now installed, APU extras logics was a bit changed, because
there are two tests for inclusion of BDB/GDBM, not just WITH_<XXX>,
but also library existence check.

From 8d36501ac0c6c797a6b1ae59bd71e54b511abeae Mon Sep 17 00:00:00 2001
From: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Date: Sat, 6 Jun 2009 12:21:27 +0400
Subject: [PATCH] devel/apr: update to 1.3.5 and apr-util to 1.3.7

There were 3 security vulnerabilities in apr-util since 1.3.4:
  http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3

Signed-off-by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
---
 devel/apr/Makefile                 |   31 +++++++++++++++++++++----------
 devel/apr/distinfo                 |   12 ++++++------
 devel/apr/files/patch-apr_hints.m4 |    4 ++--
 devel/apr/pkg-plist                |   12 ++++++++++++
 4 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/devel/apr/Makefile b/devel/apr/Makefile
index 0771859..9bfa146 100644
--- a/devel/apr/Makefile
+++ b/devel/apr/Makefile
@@ -6,7 +6,6 @@
 
 PORTNAME=	apr
 PORTVERSION=	${APR_VERSION}.${APU_VERSION}
-PORTREVISION=	1
 CATEGORIES=	devel
 MASTER_SITES=	${MASTER_SITE_APACHE}
 MASTER_SITE_SUBDIR=	apr
@@ -17,7 +16,7 @@ COMMENT=	Apache Portability Library
 
 LIB_DEPENDS+=	expat.6:${PORTSDIR}/textproc/expat2
 
-MAKE_JOBS_SAFE=  yes
+MAKE_JOBS_SAFE=	yes
 
 OPTIONS=	THREADS "Enable Threads in apr"						on  \
 			IPV6	"Enable IPV6 Support in apr"				off \
@@ -28,8 +27,8 @@ OPTIONS=	THREADS "Enable Threads in apr"						on  \
 			MYSQL	"Enable MySQL suport in apr-util"			off \
 			PGSQL	"Enable Postgresql suport in apr-util"		off
 
-APR_VERSION=	1.3.3
-APU_VERSION=	1.3.4
+APR_VERSION=	1.3.5
+APU_VERSION=	1.3.7
 
 USE_ICONV=		yes
 USE_AUTOTOOLS=	automake:19 autoconf:262 libtool:15:env
@@ -52,12 +51,6 @@ APU_CONF_ARGS=	--with-apr=${APR_WRKDIR} \
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_MYSQL) || defined(WITH_PGSQL) || defined (WITH_LDAP) 
-PLIST_SUB+=	APU_EXTRAS=""
-.else
-PLIST_SUB+=	APU_EXTRAS="@comment "
-.endif
-
 ########## APR Options
 .if defined(WITHOUT_THREADS)
 APR_CONF_ARGS+=	--disable-threads
@@ -83,8 +76,10 @@ PKGNAMESUFFIX=	-ipv6
 
 ######### APR-Util Options
 .if defined(WITHOUT_GDBM)
+PLIST_SUB+=	GDBM="@comment "
 APU_CONF_ARGS+=	--without-gdbm
 .elif defined(WITH_GDBM) || exists(${LOCALBASE}/lib/libgdbm.so.3)
+PLIST_SUB+=	GDBM=""
 LIB_DEPENDS+=	gdbm.3:${PORTSDIR}/databases/gdbm
 APU_CONF_ARGS+=	--with-gdbm=${LOCALBASE}
 .if defined(PKGNAMESUFFIX)
@@ -93,12 +88,16 @@ PKGNAMESUFFIX:=	${PKGNAMESUFFIX}-gdbm
 PKGNAMESUFFIX=	-gdbm
 .endif
 .else
+PLIST_SUB+=	GDBM="@comment "
 APR_UTIL_CONF_ARGS+=	--without-gdbm
 .endif
 
 .if defined(WITHOUT_BDB)
+PLIST_SUB+=	BDB="@comment "
 APU_CONF_ARGS+=	--without-berkeley-db
 .elif defined(WITH_BDB) || exists(${LOCALBASE}/lib/libdb-4.2.so.2)
+APU_EXTRAS=	yes
+PLIST_SUB+=	BDB=""
 USE_BDB=	42+
 APU_CONF_ARGS+=	--with-berkeley-db=${BDB_INCLUDE_DIR}:${BDB_LIB_DIR}
 .if defined(PKGNAMESUFFIX)
@@ -109,8 +108,11 @@ PKGNAMESUFFIX=	-${BDB_INCLUDE_DIR:S,^${LOCALBASE}/include/,,}
 .endif
 
 .if defined(WITHOUT_NDBM)
+PLIST_SUB+=	NDBM="@comment "
 APU_CONF_ARGS+=	--without-ndbm
 .elif defined(WITH_NDBM)
+APU_EXTRAS=	yes
+PLIST_SUB+=	NDBM=""
 APU_CONF_ARGS+=	--with-ndbm=/usr
 .if defined(PKGNAMESUFFIX)
 PKGNAMESUFFIX:=	${PKGNAMESUFFIX}-ndbm
@@ -120,6 +122,7 @@ PKGNAMESUFFIX=	-ndbm
 .endif
 
 .if defined(WITH_LDAP)
+APU_EXTRAS=	yes
 PLIST_SUB+=	LDAP=""
 USE_OPENLDAP=	yes
 APU_CONF_ARGS+=	--with-ldap-include=${LOCALBASE}/include \
@@ -134,6 +137,7 @@ PLIST_SUB+=	LDAP="@comment "
 .endif
 
 .if defined(WITH_MYSQL)
+APU_EXTRAS=	yes
 PLIST_SUB+=	MYSQL=""
 USE_MYSQL=	YES
 APU_CONF_ARGS+=	--with-mysql=${LOCALBASE}
@@ -150,6 +154,7 @@ PLIST_SUB+=	MYSQL="@comment "
 .endif
 
 .if defined(WITH_PGSQL)
+APU_EXTRAS=	yes
 PLIST_SUB+=	PGSQL=""
 USE_PGSQL=	YES
 APU_CONF_ARGS+=	--with-pgsql=${LOCALBASE}
@@ -163,6 +168,12 @@ PKGNAMESUFFIX=	-pgsql
 PLIST_SUB+=	PGSQL="@comment "
 .endif
 
+.if defined(APU_EXTRAS)
+PLIST_SUB+=	APU_EXTRAS=""
+.else
+PLIST_SUB+=	APU_EXTRAS="@comment "
+.endif
+
 post-patch:
 	${REINPLACE_CMD} -e 's/OSVERSION/'${OSVERSION}'/g' \
 		${APR_WRKDIR}/build/apr_hints.m4
diff --git a/devel/apr/distinfo b/devel/apr/distinfo
index 52713d4..7e787e6 100644
--- a/devel/apr/distinfo
+++ b/devel/apr/distinfo
@@ -1,6 +1,6 @@
-MD5 (apr-1.3.3.tar.gz) = b254a9abecaedb05efde71daa7517480
-SHA256 (apr-1.3.3.tar.gz) = 390af2f94c38d9fa03cd6caac3549058bb3e2c4d9f7408b7b829ad75bd5cc273
-SIZE (apr-1.3.3.tar.gz) = 1160542
-MD5 (apr-util-1.3.4.tar.gz) = a10e2ca150ff07f484c724c36142211f
-SHA256 (apr-util-1.3.4.tar.gz) = 3f07ffdb18fb853290c9b83e82cd5cae66b8fbc357bd391e846c0afdd24fed7e
-SIZE (apr-util-1.3.4.tar.gz) = 778902
+MD5 (apr-1.3.5.tar.gz) = 2a3f33c2186f456fd60a34a7c2989580
+SHA256 (apr-1.3.5.tar.gz) = f047422b39a5e5d933d598bd9fca2a1184e1506e4cd66364a990c7f2cd76960d
+SIZE (apr-1.3.5.tar.gz) = 1162875
+MD5 (apr-util-1.3.7.tar.gz) = 0a6802ef6d874db645150ae4a75f41fa
+SHA256 (apr-util-1.3.7.tar.gz) = fadd6a0c55596b2c21375942e3acefc33715e647ed4770dc398d08d8783a39e0
+SIZE (apr-util-1.3.7.tar.gz) = 788206
diff --git a/devel/apr/files/patch-apr_hints.m4 b/devel/apr/files/patch-apr_hints.m4
index 5549809..a360c89 100644
--- a/devel/apr/files/patch-apr_hints.m4
+++ b/devel/apr/files/patch-apr_hints.m4
@@ -1,5 +1,5 @@
---- apr-1.3.3/build/apr_hints.m4.orig	Wed Oct 27 11:12:28 2004
-+++ apr-1.3.3/build/apr_hints.m4	Wed Oct 27 11:25:32 2004
+--- apr-1.3.5/build/apr_hints.m4.orig	Wed Oct 27 11:12:28 2004
++++ apr-1.3.5/build/apr_hints.m4	Wed Oct 27 11:25:32 2004
 @@ -137,11 +137,7 @@
  	;;
      *-freebsd*)
diff --git a/devel/apr/pkg-plist b/devel/apr/pkg-plist
index 18e965e..a091c1c 100644
--- a/devel/apr/pkg-plist
+++ b/devel/apr/pkg-plist
@@ -84,6 +84,18 @@ lib/libaprutil-1.a
 lib/libaprutil-1.la
 lib/libaprutil-1.so
 lib/libaprutil-1.so.%%SHLIB_MAJOR%%
+%%BDB%%lib/apr-util-1/apr_dbm_db-1.so
+%%BDB%%lib/apr-util-1/apr_dbm_db.so
+%%BDB%%lib/apr-util-1/apr_dbm_db.la
+%%BDB%%lib/apr-util-1/apr_dbm_db.a
+%%GDBM%%lib/apr-util-1/apr_dbm_gdbm-1.so
+%%GDBM%%lib/apr-util-1/apr_dbm_gdbm.so
+%%GDBM%%lib/apr-util-1/apr_dbm_gdbm.la
+%%GDBM%%lib/apr-util-1/apr_dbm_gdbm.a
+%%NDBM%%lib/apr-util-1/apr_dbm_ndbm-1.so
+%%NDBM%%lib/apr-util-1/apr_dbm_ndbm.so
+%%NDBM%%lib/apr-util-1/apr_dbm_ndbm.la
+%%NDBM%%lib/apr-util-1/apr_dbm_ndbm.a
 %%LDAP%%lib/apr-util-1/apr_ldap-1.so
 %%LDAP%%lib/apr-util-1/apr_ldap.so
 %%LDAP%%lib/apr-util-1/apr_ldap.la
-- 
1.6.3.1
--- update-to-1.3.5-and-1.3.7.diff ends here ---

The following VuXML entry should be evaluated and added.


I have no time yet to look at Apache < 2.2, but may be there are also
these bugs in there.--eOWus0qrCLmXijMRDrYycZD5EVQkhtvIHG2TYOhEvuwRzNHL
Content-Type: text/plain; name="apache22-backport-apr-util-fixed.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="apache22-backport-apr-util-fixed.diff"

From 60b761ec3dfe066e0f2aae4a0aa69b96ec76d995 Mon Sep 17 00:00:00 2001
From: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Date: Sat, 6 Jun 2009 12:54:20 +0400

Signed-off-by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
---
 www/apache22/Makefile                              |    2 +-
 .../files/patch-apr-fix-apr_xml-expat-attack       |   51 ++++++++++++++++++++
 .../files/patch-apr-fix-brigade_vprintf_overflow   |   18 +++++++
 .../files/patch-apr-fix-strmatch-underflow         |   21 ++++++++
 4 files changed, 91 insertions(+), 1 deletions(-)
 create mode 100644 www/apache22/files/patch-apr-fix-apr_xml-expat-attack
 create mode 100644 www/apache22/files/patch-apr-fix-brigade_vprintf_overflow
 create mode 100644 www/apache22/files/patch-apr-fix-strmatch-underflow

diff --git a/www/apache22/Makefile b/www/apache22/Makefile
index 97cd44a..e470408 100644
--- a/www/apache22/Makefile
+++ b/www/apache22/Makefile
@@ -9,7 +9,7 @@
 
 PORTNAME=	apache
 PORTVERSION=	2.2.11
-PORTREVISION?=	4
+PORTREVISION?=	5
 CATEGORIES=	www
 MASTER_SITES=	${MASTER_SITE_APACHE_HTTPD}
 DISTNAME=	httpd-${PORTVERSION}
diff --git a/www/apache22/files/patch-apr-fix-apr_xml-expat-attack b/www/apache22/files/patch-apr-fix-apr_xml-expat-attack
new file mode 100644
index 0000000..2040f08
--- /dev/null
+++ b/www/apache22/files/patch-apr-fix-apr_xml-expat-attack
@@ -0,0 +1,51 @@
+Taken from
+  http://svn.apache.org/viewvc/apr/apr/trunk/xml/apr_xml.c?r1=757729&r2=781403&view=patch
+
+--- srclib/apr-util/xml/apr_xml.c	2009/03/24 11:12:27	757729
++++ srclib/apr-util/xml/apr_xml.c	2009/06/03 14:26:19	781403
+@@ -347,6 +347,25 @@
+     return APR_SUCCESS;
+ }
+ 
++#if XML_MAJOR_VERSION > 1
++/* Stop the parser if an entity declaration is hit. */
++static void entity_declaration(void *userData, const XML_Char *entityName,
++                               int is_parameter_entity, const XML_Char *value,
++                               int value_length, const XML_Char *base,
++                               const XML_Char *systemId, const XML_Char *publicId,
++                               const XML_Char *notationName)
++{
++    apr_xml_parser *parser = userData;
++
++    XML_StopParser(parser->xp, XML_FALSE);
++}
++#else
++/* A noop default_handler. */
++static void default_handler(void *userData, const XML_Char *s, int len)
++{
++}
++#endif
++
+ APU_DECLARE(apr_xml_parser *) apr_xml_parser_create(apr_pool_t *pool)
+ {
+     apr_xml_parser *parser = apr_pcalloc(pool, sizeof(*parser));
+@@ -372,6 +391,19 @@
+     XML_SetElementHandler(parser->xp, start_handler, end_handler);
+     XML_SetCharacterDataHandler(parser->xp, cdata_handler);
+ 
++    /* Prevent the "billion laughs" attack against expat by disabling
++     * internal entity expansion.  With 2.x, forcibly stop the parser
++     * if an entity is declared - this is safer and a more obvious
++     * failure mode.  With older versions, installing a noop
++     * DefaultHandler means that internal entities will be expanded as
++     * the empty string, which is also sufficient to prevent the
++     * attack. */
++#if XML_MAJOR_VERSION > 1
++    XML_SetEntityDeclHandler(parser->xp, entity_declaration);
++#else
++    XML_SetDefaultHandler(parser->xp, default_handler);
++#endif
++
+     return parser;
+ }
+ 
diff --git a/www/apache22/files/patch-apr-fix-brigade_vprintf_overflow b/www/apache22/files/patch-apr-fix-brigade_vprintf_overflow
new file mode 100644
index 0000000..7ac9767
--- /dev/null
+++ b/www/apache22/files/patch-apr-fix-brigade_vprintf_overflow
@@ -0,0 +1,18 @@
+Equal to the fix in the apr-util itself:
+  http://svn.apache.org/viewvc/apr/apr/trunk/buckets/apr_brigade.c?r1=768417&r2=768416&pathrev=768417&view=patch
+
+See discuission about original vulnerability at
+  http://www.mail-archive.com/dev@apr.apache.org/msg21592.html
+
+--- srclib/apr-util/buckets/apr_brigade.c.orig	2009-06-06 12:32:12.000000000 +0400
++++ srclib/apr-util/buckets/apr_brigade.c	2009-06-06 12:35:30.000000000 +0400
+@@ -689,9 +689,6 @@
+       return -1;
+     }
+ 
+-    /* tack on null terminator to remaining string */
+-    *(vd.vbuff.curpos) = '\0';
+-
+     /* write out what remains in the buffer */
+     return apr_brigade_write(b, flush, ctx, buf, vd.vbuff.curpos - buf);
+ }
diff --git a/www/apache22/files/patch-apr-fix-strmatch-underflow b/www/apache22/files/patch-apr-fix-strmatch-underflow
new file mode 100644
index 0000000..c1e2523
--- /dev/null
+++ b/www/apache22/files/patch-apr-fix-strmatch-underflow
@@ -0,0 +1,21 @@
+Fix underflow in apr_strmatch_precompile,
+  http://svn.apache.org/viewvc/apr/apr/trunk/strmatch/apr_strmatch.c?r1=757729&r2=779878&view=patch
+
+--- srclib/apr-util/strmatch/apr_strmatch.c	2009/03/24 11:12:27	757729
++++ srclib/apr-util/strmatch/apr_strmatch.c	2009/05/29 07:47:52	779878
+@@ -103,13 +103,13 @@
+     if (case_sensitive) {
+         pattern->compare = match_boyer_moore_horspool;
+         for (i = 0; i < pattern->length - 1; i++) {
+-            shift[(int)s[i]] = pattern->length - i - 1;
++            shift[(unsigned char)s[i]] = pattern->length - i - 1;
+         }
+     }
+     else {
+         pattern->compare = match_boyer_moore_horspool_nocase;
+         for (i = 0; i < pattern->length - 1; i++) {
+-            shift[apr_tolower(s[i])] = pattern->length - i - 1;
++            shift[(unsigned char)apr_tolower(s[i])] = pattern->length - i - 1;
+         }
+     }
+     pattern->context = shift;
-- 
1.6.3.1
How-To-Repeat: 
[1] http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3
[2] http://www.securityfocus.com/archive/1/504107
[3] https://bugzilla.redhat.com/show_bug.cgi?id=504390