Re: ISS Advisory: Remote Compromise Vulnerability in Apache HTTPServer

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



<valcu.gheorghe@caatoosee.ro> writes:

> The patch that mentioned casting bufsiz from an int to an unsigned int
> failed to do a few things:
>
> 1) There are 2 instances of the same code in http_protocol.c that need
> to be fixed, as both suffer from the same problem
> 2) The cast to unsigned int was only done in comparison, and was not
> done in assignment, which could possibly lead to problems down the road
> with the int value?

3) Casting to unsigned int does not help that much if the variable in
question is a long.

The Apache CVS repository now seems contain a correct patch.

-- 
Florian Weimer 	                  Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          fax +49-711-685-5898

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux