Project

General

Profile

Actions
Copy link

Bug #2478

closed

invalid memory read in qop=auth-int "handling"

Added by oinkaroonie about 11 years ago. Updated almost 11 years ago.

Status:
Fixed
Priority:
Normal
Category:
-
Target version:
1.4.33
ASK QUESTIONS IN Forums:

Description

When qop == "auth-int" in an HTTP Digest authorization request, A2 is supposed to include an MD5sum of the message body. Currently, lighttpd computes the MD5 of random memory:

li_MD5_Update(&Md5Ctx, (unsigned char *)"", HASHHEXLEN);

This proposed patch correctly computes A2 when qop is "auth-int".

Files

diffs (3.96 KB) diffs proposed patch oinkaroonie, 2013-02-21 00:53
Actions
Copy link
 #1

Updated by darix about 11 years ago

  • Status changed from New to Need Feedback
  • with how big of bodies did you test that?
  • did you test it with fastcgi?
Actions
Copy link
 #2

Updated by stbuehler almost 11 years ago

  • Target version set to 1.4.33

The invalid read should be fixed ofc, but parsing the request body is not gonna happen. (async, ...)

Just use https if you want to protect the connection; qop=auth-int won't be supported.

Actions
Copy link
 #3

Updated by stbuehler almost 11 years ago

  • Subject changed from qop == "auth-int" doesn't compute A2 correctly to invalid memory read in qop=auth-int "handling"
Actions
Copy link
 #4

Updated by stbuehler almost 11 years ago

  • Status changed from Need Feedback to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2877.

Actions
Copy link

Also available in: Atom