lighttpd security fixes

Attached debdiff that provides security fixes. Trying in a feisty pbuilder now.

Edgy debdiff

Thanks for preparing these diffs! Is the empty file tests/docroot/www/index.html~ actually supposed to be included? That seems like a backup file to me. Have these patches been runtime tested too? The changelog log looks great (very detailed!) the only thing I would change is to include the CVEs for each patch so that the automatic CVE scanner can find them and mark them as "fixed".

Two more issues fixed, CVE numbers listed.

BTW tests/docroot/www/index.html~ comes from upstream.

On Wed, Aug 08, 2007 at 08:13:41PM -0000, Áron Sisak wrote:
> BTW tests/docroot/www/index.html~ comes from upstream.

Is it required to fix the problems? It appears to be an empty file.

tests/docroot/www/index.html~ is needed so that the test suite does not fail.

This is (hopefully) the last of the debdiff series.

All latest feisty, edgy and dapper has been tested in pbuilder.
No "real testing" is given to either of them, though.

I tested the fiesty patch:

https://bugs.launchpad.net/ubuntu/+source/lighttpd/+bug/127718/comments/4

Everything built and worked fine for me.

lighttpd served pages fine and didn't have any errors.

I can also confirm this mod_access bug:

http://www.lighttpd.net/assets/2007/7/24/lighttpd_sa2007_08.txt

bug is present in lighttpd-1.4.13-9ubuntu4 and fixed in lighttpd-1.4.13-9ubuntu4.1 (version created after applying debdiff).

To test I edited this line in /etc/lighttpd/lighttpd.conf:

  url.access-deny = ( "~", ".inc", ".txt" )

I created a simple test.txt file in /var/www/ and could not access it using either http://hostname/test.txt or http://hostname/test.txt/.

I just wanted to comment on my testing methods in case anyone's interested.

Tested the dapper patch and it builds and serves pages fine.

I followed the same procedure for dapper as I did for feisty above.

The mod_access bug went away with the update.

Fixed in gutsy, publications for dapper/feisty are on their way now. :)

aplied this patch http://launchpadlibrarian.net/8743252/lighttpd_1.4.13%7Er1370-1ubuntu1.2.debdiff

builded and tested in Edgy

No problems found