Fixing two possible security vulnerabilities:

CVE-2006-5752 XSS in mod_status with ExtendedStatus on
CVE-2007-3304 Remote DoS if MPM and mod_cache enabled
bumping PKGREVISION

2 files changed, 88 insertions, 0 deletions

diff --git a/www/apache/patches/patch-ar b/www/apache/patches/patch-ar
new file mode 100644
index 00000000000..c0016a6cdd4
--- /dev/null
+++ b/www/apache/patches/patch-ar
@@ -0,0 +1,40 @@
+$NetBSD: patch-ar,v 1.5 2007/06/28 00:38:01 lkundrak Exp $
+
+--- src/main/http_main.c.orig	2007-06-28 02:10:30.000000000 +0200
++++ src/main/http_main.c
+@@ -2751,6 +2751,17 @@ static int find_child_by_pid(int pid)
+     return -1;
+ }
+ 
++static int safe_child_kill(pid_t pid, int sig)
++{
++    if (getpgid(pid) == getpgrp()) {
++        return kill(pid, sig);
++    }
++    else {
++        errno = EINVAL;
++        return -1;
++    }
++}
++
+ static void reclaim_child_processes(int terminate)
+ {
+ #ifndef MULTITHREAD
+@@ -5113,7 +5124,7 @@ static void perform_idle_server_maintena
+ 		else if (ps->last_rtime + ss->timeout_len < now) {
+ 		    /* no progress, and the timeout length has been exceeded */
+ 		    ss->timeout_len = 0;
+-		    kill(ps->pid, SIG_TIMEOUT_KILL);
++		    safe_child_kill(ps->pid, SIG_TIMEOUT_KILL);
+ 		}
+ 	    }
+ #endif
+@@ -5126,7 +5137,7 @@ static void perform_idle_server_maintena
+ 	 * while we were counting. Use the define SIG_IDLE_KILL to reflect
+ 	 * which signal should be used on the specific OS.
+ 	 */
+-	kill(ap_scoreboard_image->parent[to_kill].pid, SIG_IDLE_KILL);
++	safe_child_kill(ap_scoreboard_image->parent[to_kill].pid, SIG_IDLE_KILL);
+ 	idle_spawn_rate = 1;
+ #ifdef TPF
+         ap_update_child_status(to_kill, SERVER_DEAD, (request_rec *)NULL);
diff --git a/www/apache/patches/patch-as b/www/apache/patches/patch-as
new file mode 100644
index 00000000000..ada8a6dd033
--- /dev/null
+++ b/www/apache/patches/patch-as
@@ -0,0 +1,48 @@
+$NetBSD: patch-as,v 1.5 2007/06/28 00:38:01 lkundrak Exp $
+
+--- src/modules/standard/mod_status.c.orig	2007-06-28 02:39:31.000000000 +0200
++++ src/modules/standard/mod_status.c	2007-06-28 02:44:25.000000000 +0200
+@@ -221,7 +221,7 @@ static int status_handler(request_rec *r
+     if (r->method_number != M_GET)
+ 	return DECLINED;
+ 
+-    r->content_type = "text/html";
++    r->content_type = "text/html; charset=ISO-8859-1";
+ 
+     /*
+      * Simple table-driven form data set parser that lets you alter the header
+@@ -247,7 +247,7 @@ static int status_handler(request_rec *r
+ 		    no_table_report = 1;
+ 		    break;
+ 		case STAT_OPT_AUTO:
+-		    r->content_type = "text/plain";
++		    r->content_type = "text/plain; charset=ISO-8859-1";
+ 		    short_report = 1;
+ 		    break;
+ 		}
+@@ -591,7 +591,7 @@ static int status_handler(request_rec *r
+ 			ap_rputs(")\n", r);
+ 			ap_rprintf(r, " <i>%s {%s}</i> <b>[%s]</b><br>\n\n",
+ 			    ap_escape_html(r->pool, score_record.client),
+-			    ap_escape_html(r->pool, score_record.request),
++                                   ap_escape_html(r->pool, ap_escape_logitem(r->pool, score_record.request)),
+ 			    vhost ? ap_escape_html(r->pool, 
+ 				vhost->server_hostname) : "(unavailable)");
+ 		    }
+@@ -686,14 +686,14 @@ static int status_handler(request_rec *r
+ 			     "</tr>\n\n",
+ 			     score_record.client,
+ 			     vhost ? vhost->server_hostname : "(unavailable)",
+-			     ap_escape_html(r->pool, score_record.request));
++			     ap_escape_html(r->pool, ap_escape_logitem(r->pool, score_record.request)))
+ #else
+ 			    ap_rprintf(r,
+ 			     "<td>%s<td nowrap>%s<td nowrap>%s</tr>\n\n",
+ 			     ap_escape_html(r->pool, score_record.client),
+ 			     vhost ? ap_escape_html(r->pool, 
+ 				vhost->server_hostname) : "(unavailable)",
+-			     ap_escape_html(r->pool, score_record.request));
++			     ap_escape_html(r->pool, ap_escape_logitem(r->pool, score_record.request)))
+ #endif
+ 		    }		/* no_table_report */
+ 		}			/* !short_report */