Attachment 305352 Details for Bug 349011 – SuSE patch

[patch] SuSE patch

nagios-2.9-CVE-2007-5624.diff (text/plain), 11.99 KB, created by Tomas Hoger on 2008-05-14 12:10:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-05-14 12:10:54 UTC

Size: 11.99 KB

patch

obsolete

>From 6df006df7617d6eda9cf9c2efab5af229e3e5313 Mon Sep 17 00:00:00 2001
>From: Ludwig Nussel <ludwig.nussel@suse.de>
>Date: Wed, 9 Apr 2008 16:12:32 +0200
>Subject: [PATCH] CVE-2007-5624
> PatchSet 872
> Fix for potential XSS vulnerability in CGIs
>
>Conflicts:
>
>	cgi/cgiutils.c
>---
> cgi/avail.c           |    4 ++++
> cgi/cgiutils.c        |   23 +++++++++++++++++++++++
> cgi/cmd.c             |    6 ++++++
> cgi/extinfo.c         |    4 ++++
> cgi/histogram.c       |    2 ++
> cgi/history.c         |    2 ++
> cgi/notifications.c   |    4 ++++
> cgi/status.c          |    4 ++++
> cgi/statusmap.c       |    2 ++
> cgi/statuswml.c       |    5 +++++
> cgi/statuswrl.c       |    1 +
> cgi/summary.c         |    3 +++
> cgi/trends.c          |    2 ++
> include/cgiutils.h.in |    2 ++
> 14 files changed, 64 insertions(+), 0 deletions(-)
>
>diff --git a/cgi/avail.c b/cgi/avail.c
>index 8fb7662..6479b29 100644
>--- a/cgi/avail.c
>+++ b/cgi/avail.c
>@@ -1157,6 +1157,7 @@ int process_cgivars(void){
> 				hostgroup_name="";
> 			else
> 				strcpy(hostgroup_name,variables[x]);
>+			strip_html_brackets(hostgroup_name);
> 			display_type=DISPLAY_HOSTGROUP_AVAIL;
> 			show_all_hostgroups=(strcmp(hostgroup_name,"all"))?FALSE:TRUE;
> 		        }
>@@ -1174,6 +1175,7 @@ int process_cgivars(void){
> 				servicegroup_name="";
> 			else
> 				strcpy(servicegroup_name,variables[x]);
>+			strip_html_brackets(servicegroup_name);
> 			display_type=DISPLAY_SERVICEGROUP_AVAIL;
> 			show_all_servicegroups=(strcmp(servicegroup_name,"all"))?FALSE:TRUE;
> 		        }
>@@ -1191,6 +1193,7 @@ int process_cgivars(void){
> 				host_name="";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 			display_type=DISPLAY_HOST_AVAIL;
> 			show_all_hosts=(strcmp(host_name,"all"))?FALSE:TRUE;
> 		        }
>@@ -1208,6 +1211,7 @@ int process_cgivars(void){
> 				svc_description="";
> 			else
> 				strcpy(svc_description,variables[x]);
>+			strip_html_brackets(svc_description);
> 			display_type=DISPLAY_SERVICE_AVAIL;
> 			show_all_services=(strcmp(svc_description,"all"))?FALSE:TRUE;
> 		        }
>diff --git a/cgi/cgiutils.c b/cgi/cgiutils.c
>index ae187f0..f09eef0 100644
>--- a/cgi/cgiutils.c
>+++ b/cgi/cgiutils.c
>@@ -1415,6 +1415,29 @@ char * html_encode(char *input){
> 
> 
> 
>+/* strip > and < from string */
>+void strip_html_brackets(char *buffer){
>+	register int x;
>+	register int y;
>+	register int z;
>+
>+	if(buffer==NULL || buffer[0]=='\x0')
>+		return;
>+
>+	/* remove all occurances in string */
>+	z=(int)strlen(buffer);
>+	for(x=0,y=0;x<z;x++){
>+		if(buffer[x]=='<' || buffer[x]=='>')
>+			continue;
>+		buffer[y++]=buffer[x];
>+	        }
>+	buffer[y++]='\x0';
>+
>+	return;
>+	}
>+
>+
>+
> /* determines the log file we should use (from current time) */
> void get_log_archive_to_use(int archive,char *buffer,int buffer_length){
> 	struct tm *t;
>diff --git a/cgi/cmd.c b/cgi/cmd.c
>index ab968e5..a9cd485 100644
>--- a/cgi/cmd.c
>+++ b/cgi/cmd.c
>@@ -380,6 +380,7 @@ int process_cgivars(void){
> 				comment_author="";
> 			else
> 				strcpy(comment_author,variables[x]);
>+			strip_html_brackets(comment_author);
> 			}
> 
> 		/* we found the comment data */
>@@ -395,6 +396,7 @@ int process_cgivars(void){
> 				comment_data="";
> 			else
> 				strcpy(comment_data,variables[x]);
>+			strip_html_brackets(comment_data);
> 			}
> 
> 		/* we found the host name */
>@@ -410,6 +412,7 @@ int process_cgivars(void){
> 				host_name="";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 			}
> 
> 		/* we found the hostgroup name */
>@@ -425,6 +428,7 @@ int process_cgivars(void){
> 				hostgroup_name="";
> 			else
> 				strcpy(hostgroup_name,variables[x]);
>+			strip_html_brackets(hostgroup_name);
> 			}
> 
> 		/* we found the service name */
>@@ -440,6 +444,7 @@ int process_cgivars(void){
> 				service_desc="";
> 			else
> 				strcpy(service_desc,variables[x]);
>+			strip_html_brackets(service_desc);
> 			}
> 
> 		/* we found the servicegroup name */
>@@ -455,6 +460,7 @@ int process_cgivars(void){
> 				servicegroup_name="";
> 			else
> 				strcpy(servicegroup_name,variables[x]);
>+			strip_html_brackets(servicegroup_name);
> 			}
> 
> 		/* we got the persistence option for a comment */
>diff --git a/cgi/extinfo.c b/cgi/extinfo.c
>index a58399b..98e8c7c 100644
>--- a/cgi/extinfo.c
>+++ b/cgi/extinfo.c
>@@ -604,6 +604,7 @@ int process_cgivars(void){
> 			host_name=strdup(variables[x]);
> 			if(host_name==NULL)
> 				host_name="";
>+			strip_html_brackets(host_name);
> 			}
> 
> 		/* we found the hostgroup name */
>@@ -617,6 +618,7 @@ int process_cgivars(void){
> 			hostgroup_name=strdup(variables[x]);
> 			if(hostgroup_name==NULL)
> 				hostgroup_name="";
>+			strip_html_brackets(hostgroup_name);
> 			}
> 
> 		/* we found the service name */
>@@ -630,6 +632,7 @@ int process_cgivars(void){
> 			service_desc=strdup(variables[x]);
> 			if(service_desc==NULL)
> 				service_desc="";
>+			strip_html_brackets(service_desc);
> 			}
> 
> 		/* we found the servicegroup name */
>@@ -643,6 +646,7 @@ int process_cgivars(void){
> 			servicegroup_name=strdup(variables[x]);
> 			if(servicegroup_name==NULL)
> 				servicegroup_name="";
>+			strip_html_brackets(servicegroup_name);
> 			}
> 
> 		/* we found the sort type argument */
>diff --git a/cgi/histogram.c b/cgi/histogram.c
>index b396b7d..719f4d6 100644
>--- a/cgi/histogram.c
>+++ b/cgi/histogram.c
>@@ -1086,6 +1086,7 @@ int process_cgivars(void){
> 				host_name="";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 
> 			display_type=DISPLAY_HOST_HISTOGRAM;
> 		        }
>@@ -1103,6 +1104,7 @@ int process_cgivars(void){
> 				svc_description="";
> 			else
> 				strcpy(svc_description,variables[x]);
>+			strip_html_brackets(svc_description);
> 
> 			display_type=DISPLAY_SERVICE_HISTOGRAM;
> 		        }
>diff --git a/cgi/history.c b/cgi/history.c
>index 71dc485..4fc8f1a 100644
>--- a/cgi/history.c
>+++ b/cgi/history.c
>@@ -379,6 +379,7 @@ int process_cgivars(void){
> 				host_name="";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 
> 			display_type=DISPLAY_HOSTS;
> 
>@@ -401,6 +402,7 @@ int process_cgivars(void){
> 				svc_description="";
> 			else
> 				strcpy(svc_description,variables[x]);
>+			strip_html_brackets(svc_description);
> 
> 			display_type=DISPLAY_SERVICES;
> 		        }
>diff --git a/cgi/notifications.c b/cgi/notifications.c
>index 13b3b4f..6a0761a 100644
>--- a/cgi/notifications.c
>+++ b/cgi/notifications.c
>@@ -371,6 +371,7 @@ int process_cgivars(void){
> 			query_host_name=strdup(variables[x]);
> 			if(query_host_name==NULL)
> 				query_host_name="";
>+			strip_html_brackets(query_host_name);
> 			if(!strcmp(query_host_name,"all"))
> 				find_all=TRUE;
> 			else
>@@ -390,6 +391,8 @@ int process_cgivars(void){
> 
> 			if(query_contact_name==NULL)
> 				query_contact_name="";
>+			strip_html_brackets(query_contact_name);
>+
> 			if(!strcmp(query_contact_name,"all"))
> 				find_all=TRUE;
> 			else
>@@ -408,6 +411,7 @@ int process_cgivars(void){
> 			query_svc_description=strdup(variables[x]);
> 			if(query_svc_description==NULL)
> 				query_svc_description="";
>+			strip_html_brackets(query_svc_description);
> 		        }
> 	
> 		/* we found the notification type argument */
>diff --git a/cgi/status.c b/cgi/status.c
>index 9b7188b..737cb21 100644
>--- a/cgi/status.c
>+++ b/cgi/status.c
>@@ -572,6 +572,7 @@ int process_cgivars(void){
> 			        }
> 
> 			hostgroup_name=strdup(variables[x]);
>+			strip_html_brackets(hostgroup_name);
> 
> 			if(hostgroup_name!=NULL && !strcmp(hostgroup_name,"all"))
> 				show_all_hostgroups=TRUE;
>@@ -589,6 +590,7 @@ int process_cgivars(void){
> 			        }
> 
> 			servicegroup_name=strdup(variables[x]);
>+			strip_html_brackets(servicegroup_name);
> 
> 			if(servicegroup_name!=NULL && !strcmp(servicegroup_name,"all"))
> 				show_all_servicegroups=TRUE;
>@@ -606,6 +608,7 @@ int process_cgivars(void){
> 			        }
> 
> 			host_name=strdup(variables[x]);
>+			strip_html_brackets(host_name);
> 
> 			if(host_name!=NULL && !strcmp(host_name,"all"))
> 				show_all_hosts=TRUE;
>@@ -730,6 +733,7 @@ int process_cgivars(void){
>                                 break;
>                                 }
>                         service_filter=strdup(variables[x]);
>+			strip_html_brackets(service_filter);
>                         }
> 	        }
> 
>diff --git a/cgi/statusmap.c b/cgi/statusmap.c
>index 4da8f0a..06cc3ad 100644
>--- a/cgi/statusmap.c
>+++ b/cgi/statusmap.c
>@@ -412,6 +412,7 @@ int process_cgivars(void){
> 				host_name="all";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 
> 			if(!strcmp(host_name,"all"))
> 				show_all_hosts=TRUE;
>@@ -570,6 +571,7 @@ int process_cgivars(void){
> 				break;
> 			        }
> 
>+			strip_html_brackets(variables[x]);
> 			add_layer(variables[x]);
> 		        }
> 	        }
>diff --git a/cgi/statuswml.c b/cgi/statuswml.c
>index 4ba0e53..8ef099f 100644
>--- a/cgi/statuswml.c
>+++ b/cgi/statuswml.c
>@@ -239,6 +239,7 @@ int process_cgivars(void){
> 				hostgroup_name="";
> 			else
> 				strcpy(hostgroup_name,variables[x]);
>+			strip_html_brackets(hostgroup_name);
> 
> 			if(!strcmp(hostgroup_name,"all"))
> 				show_all_hostgroups=TRUE;
>@@ -260,6 +261,7 @@ int process_cgivars(void){
> 				host_name="";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 		        }
> 
> 		/* we found the service argument */
>@@ -276,6 +278,7 @@ int process_cgivars(void){
> 				service_desc="";
> 			else
> 				strcpy(service_desc,variables[x]);
>+			strip_html_brackets(service_desc);
> 		        }
> 
> 
>@@ -317,6 +320,7 @@ int process_cgivars(void){
> 				ping_address="";
> 			else
> 				strcpy(ping_address,variables[x]);
>+			strip_html_brackets(ping_address);
> 		        }
> 
> 		/* we found the traceroute argument */
>@@ -333,6 +337,7 @@ int process_cgivars(void){
> 				traceroute_address="";
> 			else
> 				strcpy(traceroute_address,variables[x]);
>+			strip_html_brackets(traceroute_address);
> 		        }
> 
> 	        }
>diff --git a/cgi/statuswrl.c b/cgi/statuswrl.c
>index 83c65ee..423ad77 100644
>--- a/cgi/statuswrl.c
>+++ b/cgi/statuswrl.c
>@@ -239,6 +239,7 @@ int process_cgivars(void){
> 				host_name="all";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 
> 			if(!strcmp(host_name,"all"))
> 				show_all_hosts=TRUE;
>diff --git a/cgi/summary.c b/cgi/summary.c
>index f0f40d6..2e8ecac 100644
>--- a/cgi/summary.c
>+++ b/cgi/summary.c
>@@ -1135,6 +1135,7 @@ int process_cgivars(void){
> 				target_hostgroup_name="";
> 			else
> 				strcpy(target_hostgroup_name,variables[x]);
>+			strip_html_brackets(target_hostgroup_name);
> 
> 			if(!strcmp(target_hostgroup_name,"all"))
> 				show_all_hostgroups=TRUE;
>@@ -1157,6 +1158,7 @@ int process_cgivars(void){
> 				target_servicegroup_name="";
> 			else
> 				strcpy(target_servicegroup_name,variables[x]);
>+			strip_html_brackets(target_servicegroup_name);
> 
> 			if(!strcmp(target_servicegroup_name,"all"))
> 				show_all_servicegroups=TRUE;
>@@ -1179,6 +1181,7 @@ int process_cgivars(void){
> 				target_host_name="";
> 			else
> 				strcpy(target_host_name,variables[x]);
>+			strip_html_brackets(target_host_name);
> 
> 			if(!strcmp(target_host_name,"all"))
> 				show_all_hosts=TRUE;
>diff --git a/cgi/trends.c b/cgi/trends.c
>index 5822b32..3998fe7 100644
>--- a/cgi/trends.c
>+++ b/cgi/trends.c
>@@ -1207,6 +1207,7 @@ int process_cgivars(void){
> 				host_name="";
> 			else
> 				strcpy(host_name,variables[x]);
>+			strip_html_brackets(host_name);
> 
> 			display_type=DISPLAY_HOST_TRENDS;
> 		        }
>@@ -1224,6 +1225,7 @@ int process_cgivars(void){
> 				svc_description="";
> 			else
> 				strcpy(svc_description,variables[x]);
>+			strip_html_brackets(svc_description);
> 
> 			display_type=DISPLAY_SERVICE_TRENDS;
> 		        }
>diff --git a/include/cgiutils.h.in b/include/cgiutils.h.in
>index 46daf6c..47d26e3 100644
>--- a/include/cgiutils.h.in
>+++ b/include/cgiutils.h.in
>@@ -471,6 +471,8 @@ char * my_strsep (char **, const char *);
> char * url_encode(char *);		        		/* encodes a string in proper URL format */
> char * html_encode(char *);					/* encodes a string in HTML format (for what the user sees) */
> 
>+void strip_html_brackets(char *); 
>+
> void get_time_breakdown(unsigned long,int *,int *,int *,int *);	/* given total seconds, get days, hours, minutes, seconds */
> 
> void get_log_archive_to_use(int,char *,int);			/* determines the name of the log archive to use */
>-- 
>1.5.3.4
>

Actions: View | Diff

Attachments on bug 349011: 305352