author | Rich Burridge <rich.burridge@oracle.com> |
Sat, 13 Apr 2013 09:26:14 -0700 | |
changeset 1264 | 51f059c08b40 |
permissions | -rw-r--r-- |
1264
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
1 |
From 3604fde3d3c9b0d0e389e079aecf470d123ba180 Mon Sep 17 00:00:00 2001 |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
2 |
From: YAMADA Yasuharu <[email protected]> |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
3 |
Date: Thu, 11 Apr 2013 00:17:15 +0200 |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
4 |
Subject: [PATCH] cookie: fix tailmatching to prevent cross-domain leakage |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
5 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
6 |
Cookies set for 'example.com' could accidentaly also be sent by libcurl |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
7 |
to the 'bexample.com' (ie with a prefix to the first domain name). |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
8 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
9 |
This is a security vulnerabilty, CVE-2013-1944. |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
10 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
11 |
Bug: http://curl.haxx.se/docs/adv_20130412.html |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
12 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
13 |
--- lib/cookie.c 2013-04-12 13:42:43.099608542 -0700 |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
14 |
+++ lib/cookie.c 2013-04-12 13:51:27.701845050 -0700 |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
15 |
@@ -118,15 +118,29 @@ |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
16 |
free(co); |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
17 |
} |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
18 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
19 |
-static bool tailmatch(const char *little, const char *bigone) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
20 |
+static bool tailmatch(const char *cooke_domain, const char *hostname) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
21 |
{ |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
22 |
- size_t littlelen = strlen(little); |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
23 |
- size_t biglen = strlen(bigone); |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
24 |
+ size_t cookie_domain_len = strlen(cooke_domain); |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
25 |
+ size_t hostname_len = strlen(hostname); |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
26 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
27 |
- if(littlelen > biglen) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
28 |
+ if(hostname_len < cookie_domain_len) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
29 |
return FALSE; |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
30 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
31 |
- return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE; |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
32 |
+ if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len)) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
33 |
+ return FALSE; |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
34 |
+ |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
35 |
+ /* A lead char of cookie_domain is not '.'. |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
36 |
+ RFC6265 4.1.2.3. The Domain Attribute says: |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
37 |
+ For example, if the value of the Domain attribute is |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
38 |
+ "example.com", the user agent will include the cookie in the Cookie |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
39 |
+ header when making HTTP requests to example.com, www.example.com, and |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
40 |
+ www.corp.example.com. |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
41 |
+ */ |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
42 |
+ if(hostname_len == cookie_domain_len) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
43 |
+ return TRUE; |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
44 |
+ if('.' == *(hostname + hostname_len - cookie_domain_len - 1)) |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
45 |
+ return TRUE; |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
46 |
+ return FALSE; |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
47 |
} |
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
48 |
|
51f059c08b40
16658714 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
49 |
/* |