Bugzilla Bug 81776

From the lighttpd-announce-list (see URL):

------------------------------------------------------------------
Dear users,

in lighttpd 1.3.7 and below it is possible to fetch the source files
which should be handled by CGI or FastCGI applications.

- How to reproduce:

  append a %00 to the filename:

  http://www.example.org/index.php%00

- Description

  Control-Sequences are not mapped out in buffer_urldecode() in buffer.c
  which leeds to a \0 sequence in the filename while lighttpd ignores 
  is handles the %00 as part of the filename.

- Fix

  1. upgrade to the latest version 1.3.10
  2. apply the fixes referenced at http://wiki.lighttpd.net/7.html#A12
  3. apply the attached fix

- affected versions

  1.3.7 and below 

- not affected
  1.3.8 and above 
  1.3.7 and below if
  - no CGI or FastCGI is used
  - no CGI is used and FastCGI is running on a remote host
------------------------------------------------------------------

Reproducible: Always
Steps to Reproduce:

Sorry, there is one thing I forgot to mention:

The license of the lighttpd-package has changed from QPL-1.0 to a BSD-style-Licence with version 1.3.5.
This change should be reflected when bumping to a current version.

web-apps please bump.

http://www.lighttpd.net/news/

I actually have a 1.3.10 ebuild I've been working on; I just need to integrate
the spawn-fcgi init/conf scripts into lighttpd as it is now a part of lighttpd.
 I'll see if I cannot get this finished today.

Have a look at 76575 - here I changed some things like that for 1.3.7

see http://bugs.gentoo.org/show_bug.cgi?id=76575#4

argh, sorry, that's the comment I meant:
http://bugs.gentoo.org/show_bug.cgi?id=76575#c4

Committed. Sorry for not getting this done as soon as I said I would.

Thx Aaron.

This one is ready for GLSA. Security please vote. I tend to vote YES on this one.

Voting yes too.

I'm testing at the moment, some things I noticed in
http://www.gentoo.org/cgi-bin/viewcvs.cgi/*checkout*/www-servers/lighttpd/lighttpd-1.3.10.ebuild?rev=1.1&content-type=text/plain 

- a lighttpd user & group is created, but I cannot find where they are put into
lighttpd.conf, to replace the following lines :

#server.username            = "wwwrun"
#server.groupname           = "wwwrun"

(replace "wwwrun" with "lighttpd" and remove #)

In my ebuild I used the following lines to do this:
        sed -i -e 's:^#server.username.*:server.username = "lighttpd":1'
${D}/etc/lighttpd.conf
        sed -i -e 's:^#server.groupname.*:server.groupname = "lighttpd":1'
${D}/etc/lighttpd.conf

But that's not nice, I think the better way would be to use
lighttpd-1.1.8-gentoo.diff, perhaps change it to lighttpd-1.3.10-gentoo.diff
(${P}-gentoo.diff).

an issue with:
http://www.gentoo.org/cgi-bin/viewcvs.cgi/*checkout*/www-servers/lighttpd/files/lighttpd-1.3.10-php.diff?rev=1.1&content-type=text/plain

in the following diff
diff -urN lighttpd-1.3.10.orig/doc/lighttpd.1 lighttpd-1.3.10/doc/lighttpd.1

-/etc/lighttpd/lighttpd.conf
+/etc/lighttpd.conf

is this change only necessary if used with php? Because as I understand this
patch is conditional in lighttpd-1.3.10.ebuild:

use php && epatch ${FILESDIR}/${P}-php.diff

Perhaps the "lighttpd.1 diff" should be moved to ${FILESDIR}/${P}-gentoo.diff

the lighttpd author also recommends using the following patches:
http://wiki.lighttpd.net/7.html#A14

Ok, there's a few things I need to fix but do not hinder the status of this
bug:

 - I forgot that the licensing has changed to BSD
 - Yes, the default lighttpd.conf should contain the new change to lighttpd
user/group
 - Yes, the man page should be patched regardless of USE=php ; this is a bug I
should've caught when porting the php patch to 1.3.10, so my mistake.

I'll release a -r1 asap, but like I said these are minor and have no affect on
this bug.

1.3.10-r1 is in cvs.

Drafted

GLSA 200502-21