Attachment 6694 Details for Bug 8289 – Proposed patch for 3.0.x

[patch] Proposed patch for 3.0.x

0001-s3-swat-Fix-possible-XSS-attack-bug-8289.patch (text/plain), 1.67 KB, created by Jeremy Allison on 2011-07-12 18:52:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2011-07-12 18:52:49 UTC

Size: 1.67 KB

patch

obsolete

>From c6221db2dd3cbf601283fb2ea289bf462e370a90 Mon Sep 17 00:00:00 2001
>From: Kai Blin <kai@samba.org>
>Date: Tue, 12 Jul 2011 11:51:01 -0700
>Subject: [PATCH] s3 swat: Fix possible XSS attack (bug #8289)
>
>Nobuhiro Tsuji of NTT DATA SECURITY CORPORATION reported a possible XSS attack
>against SWAT, the Samba Web Administration Tool. The attack uses reflection to
>insert arbitrary content into the "change password" page.
>
>This patch fixes the reflection issue by not printing user-specified content on
>the website anymore.
>
>Signed-off-by: Kai Blin <kai@samba.org>
>---
> source/web/swat.c |   14 ++------------
> 1 files changed, 2 insertions(+), 12 deletions(-)
>
>diff --git a/source/web/swat.c b/source/web/swat.c
>index 1994f38..a2065ee 100644
>--- a/source/web/swat.c
>+++ b/source/web/swat.c
>@@ -1098,11 +1098,9 @@ static void chg_passwd(void)
> 	if(cgi_variable(CHG_S_PASSWD_FLAG)) {
> 		printf("<p>");
> 		if (rslt == True) {
>-			printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
>-			printf("\n");
>+			printf("%s\n", _(" The passwd has been changed."));
> 		} else {
>-			printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
>-			printf("\n");
>+			printf("%s\n", _(" The passwd for has NOT been changed."));
> 		}
> 	}
> 	
>@@ -1116,14 +1114,6 @@ static void passwd_page(void)
> {
> 	const char *new_name = cgi_user_name();
> 
>-	/* 
>-	 * After the first time through here be nice. If the user
>-	 * changed the User box text to another users name, remember it.
>-	 */
>-	if (cgi_variable(SWAT_USER)) {
>-		new_name = cgi_variable_nonull(SWAT_USER);
>-	} 
>-
> 	if (!new_name) new_name = "";
> 
> 	printf("<H2>%s</H2>\n", _("Server Password Management"));
>-- 
>1.7.1
>

Actions: View

Attachments on bug 8289: 6684 | 6685 | 6686 | 6687 | 6688 | 6694 | 6696