Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 88537
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: euclid80@users.sf.net
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
diff patch for referrer bug patch euclid80@users.sf.net 2005-04-09 19:46 0000 442 bytes Details | Diff
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 88537 depends on: Show dependency tree
Bug 88537 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2005-04-09 19:44 0000 
Regarding junkbuster-2.0.2-r2...

The function ij_untrusted_url() in filters.c clobbers the value of the global variable "referrer", which is set by the config file.  Now, when the "single-threaded" option has NOT been specified in the config file, the bug is harmless because this function is run in a child process.  However, if single-threading is enabled, all successive connections will use the new value of "referrer".

In particular, by sending a request for "http://host/ij-untrusted-url?a?a?x" to the proxy, one can install the value "x" in the referrer variable.


Reproducible: Always
Steps to Reproduce:
1. request http://host/ij-untrusted-url?a?a?x through the proxy.

Actual Results:  
Sets "referrer" global variable.

Expected Results:  
Should use a local variable named "referrer".

------- Comment #1 From euclid80@users.sf.net 2005-04-09 19:46:42 0000 ------- 
Created an attachment (id=55828) [details]
patch for referrer bug

------- Comment #2 From Thierry Carrez (RETIRED) 2005-04-10 07:49:12 0000 ------- 
Can auditors have a look ?

------- Comment #3 From Tavis Ormandy (RETIRED) 2005-04-10 11:38:21 0000 ------- 
Confirmed. That's an interesting bug, a malicious site could override your
referrer setting and allow it to be sent (if you were to enable single-threaded
operation, for some reason).

it get's worse, there's some heap corruption happening in there due to the
inconsistent use of the strsav() function that looks exploitable
(single-threaded or not). looks like there are some other errors as well that
need correcting.

Is there any reason to use junkbuster rather than privoxy? maybe we should
consider abandoning junkbuster as it looks like upstream is inactive.

------- Comment #4 From Sune Kloppenborg Jeppesen 2005-04-12 00:03:06 0000 ------- 
www-proxy please advise.

------- Comment #5 From Alin Năstac 2005-04-12 13:13:11 0000 ------- 
fixed both issues in -r3
I've took the liberty to keep keywords unchanged and erase the old version. the new patch is Obviously Correct, tested on x86 by me and is definitely arch independent.

------- Comment #6 From Sune Kloppenborg Jeppesen 2005-04-12 13:25:18 0000 ------- 
Thx Alin. This one is ready for GLSA.

------- Comment #7 From Sune Kloppenborg Jeppesen 2005-04-13 08:50:52 0000 ------- 
GLSA 200504-11
Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug