Bug 1506544

Summary:

Comments on Allow from break access restrictions

Product:

Red Hat Enterprise Linux 6

Reporter:

Heinrich Mislik <heinrich.mislik>

Component:

httpd

Assignee:

Luboš Uhliarik <luhliari>

Status:

CLOSED DUPLICATE

QA Contact:

BaseOS QE - Apps <qe-baseos-apps>

Severity:

high

Docs Contact:

Priority:

unspecified

Version:

6.9

CC:

luhliari

Target Milestone:

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

If docs needed, set a value

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2017-10-26 10:22:14 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
Allow comments in allow/deny	none

Description Heinrich Mislik 2017-10-26 09:53:14 UTC

The Patch for #1349546 breaks "Allow from" in httpd-2.2.15-60

Having the following Lines allows access for ANY ip:

allow from 10.0.0.1 # 10.0.0.2
deny from all

Actual results:

Access from ANY IP is granted.

Expected results:

Access should only be granted for 10.0.0.1

Additional info:

apache iterates over the allow line so that allow_cmd() in mod_authz_host gets called three times with values:

"10.0.0.1"
"#"
"10.0.0.2"

Simply overwriting '#' with '\0' results in an empty string for the following processing. The emtpy string gets passed to apr_ipsubnet_create(). Unfortunatly in version 1.3 of libapr an emtpy string passes looks_like_ip() (fixed in later versions) and gets parsed by parse_network() resulting in the equivalent of network 0/0. Thus access is granted for ANY ip.

I consider this a serious security bug. It can lead to unintentional exposure  of restricted content.

Cheers

Heinrich

Comment 2 Luboš Uhliarik 2017-10-26 10:22:14 UTC


*** This bug has been marked as a duplicate of bug 1489849 ***

Comment 3 Heinrich Mislik 2017-10-30 15:43:44 UTC

Created attachment 1345523 [details]
Allow comments in  allow/deny

patch for mod_authz_host.c that discards anything after '#' in allow/deny

Comment 4 Heinrich Mislik 2017-10-30 15:45:56 UTC

Since the proposed solution (disallowing comments at all) may again break existing configs, I came up with my own patch. In case anyone ist interrested: see attachment.

Cheers

Heinrich