[Pkg-nagios-changes] [SCM] Debian packaging for Nagios3 branch, master, updated. debian/3.2.3-2-4-g73dd0b5

[Alexander Wirt]

The following commit has been merged in the master branch:
commit 73dd0b5f4d876c5a0ca8d91f4c7bb8630e393aae
Author: Alexander Wirt <formorer at debian.org>
Date:   Sat Jun 4 20:14:53 2011 +0200

    Provide a better fix for CVE-2011-2179
    
    Git-Dch: Ignore

diff --git a/debian/patches/98_fix_XSS_CVE-2011-2179.dpatch b/debian/patches/98_fix_XSS_CVE-2011-2179.dpatch
index d35489a..0297833 100755
--- a/debian/patches/98_fix_XSS_CVE-2011-2179.dpatch
+++ b/debian/patches/98_fix_XSS_CVE-2011-2179.dpatch
@@ -1,20 +1,20 @@
 #! /bin/sh /usr/share/dpatch/dpatch-run
-## 99_fix_XSS.dpatch by Alexander Wirt <formorer at debian.org>
+## 98_fix_XSS_CVE-2011-2179.dpatch by Alexander Wirt <formorer at debian.org>
 ##
 ## All lines beginning with `## DP:' are a description of the patch.
-## DP: Fix for CVE-2011-2179 (#629127)
-## DP: http://tracker.nagios.org/view.php?id=224
+## DP: fix cross site scripting vulnerability in config.cgi on config expander arguments
+## DP: CVE-2011-2179
 
 @DPATCH@
 diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' pkg-nagios3~/cgi/config.c pkg-nagios3/cgi/config.c
 --- pkg-nagios3~/cgi/config.c	2011-05-22 08:22:20.000000000 +0200
-+++ pkg-nagios3/cgi/config.c	2011-06-04 09:36:40.208175645 +0200
-@@ -2275,7 +2275,7 @@
- 	if ((*to_expand)!='\0'){
- 		arg_count[0]=0;
++++ pkg-nagios3/cgi/config.c	2011-06-04 20:13:24.388437809 +0200
+@@ -426,7 +426,7 @@
+ 				error=TRUE;
+ 				break;
+ 			        }
+-			strncpy(to_expand,variables[x],MAX_COMMAND_BUFFER);
++			strncpy(to_expand,escape_string(variables[x]),MAX_COMMAND_BUFFER);
+ 			to_expand[MAX_COMMAND_BUFFER-1]='\0';
+ 		        }
  
--		printf("<TR CLASS='dataEven'><TD CLASS='dataEven'>To expand:</TD><TD CLASS='dataEven'>%s",command_args[0]);
-+		printf("<TR CLASS='dataEven'><TD CLASS='dataEven'>To expand:</TD><TD CLASS='dataEven'>%s",escape_string(command_args[0]));
- 		for (i=1;(i<MAX_COMMAND_ARGUMENTS)&&command_args[i];i++)
- 			printf("!<FONT\n   COLOR='%s'>%s</FONT>",hash_color(i),command_args[i]);
- 		printf("\n</TD></TR>\n");

-- 
Debian packaging for Nagios3