Developer Resources
Board support packages
Foundry27 projects
Forums
Home
Developer Resources
Technical Articles

QNX Technical Articles

TCP/IP Runtime 4.25 and 5.0 for QNX® 4.25 TCP/IP Daemon Security Patch (Patch ID 1) Release Notes

TCP/IP Runtime 4.25 and 5.0 for QNX® 4.25

Date of this edition: July 21, 2005

Target OS: QNX® 4.25

This patch contains security updates to the slinger tiny webserver.

Note:
  • For information on installing this patch, see the installation note.
  • For the most up-to-date version of these release notes, log into your myQNX account, and then go to the Download Center area of www.qnx.com.

Contents

Note: Throughout this document, you may see reference numbers associated with particular issues, changes, etc. When corresponding with our Technical Support staff about a given issue, please quote the relevant reference number. You might also find the reference numbers useful for tracking issues as they become fixed.

Fixed issues

This patch addresses the following issues:

  • Slinger used to allow a remote user to access files outside of its root directory (as identified by the HTTPD_ROOT_DIR environment variable) by including ../ in the URI of the request sent to slinger (e.g. http://hostname/././../../etc/passwd).

    Slinger tried to keep track of how far into the directory tree it went, but this wasn't reliable and could be defeated by adding ./ before the ../ in the path. Slinger doesn't provide support to write to the filesystem, and accesses files as user ID -2. It now removes any ../ strings from the URI before processing. (Ref# 21825)

  • A large HTTP GET request-URI (greater than the value of PATH_MAX) formerly could overflow Slinger's internal buffer and cause a fault. This has been fixed. (Ref# 21965)

Known issues

Currently none known.

Technical support

If you have any questions, comments, or problems with a QNX product, please contact Technical Support. For more information, visit our website, www.qnx.com.