rpms/mono/FC-5 mono-system.web_security_fix2_r69049.patch, NONE, 1.1 mono-system.web_security_fix_r68778.patch, NONE, 1.1 mono.spec, 1.34, 1.35

[fedora-cvs-commits at redhat.com]

Author: alexl

Update of /cvs/dist/rpms/mono/FC-5
In directory cvs.devel.redhat.com:/tmp/cvs-serv5184

Modified Files:
	mono.spec 
Added Files:
	mono-system.web_security_fix2_r69049.patch 
	mono-system.web_security_fix_r68778.patch 
Log Message:
* Thu Jan 11 2007 Alexander Larsson <alexl at redhat.com> - 1.1.13.7-3.fc5.1
- Add patches to fix CVE-2006-6104
- Resolves: rhbz#220853


mono-system.web_security_fix2_r69049.patch:
 HttpRequest.cs |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

--- NEW FILE mono-system.web_security_fix2_r69049.patch ---
Index: mcs/class/System.Web/System.Web/HttpRequest.cs
===================================================================
--- mcs/class/System.Web/System.Web/HttpRequest.cs	(revision 69048)
+++ mcs/class/System.Web/System.Web/HttpRequest.cs	(revision 69049)
@@ -925,7 +925,7 @@
 
 				if (physical_path == null) {
 					// Don't call HttpRequest.MapPath here, as that one *trims* the input
-					physical_path = worker_request.GetFilePathTranslated ();
+					physical_path = worker_request.MapPath (FilePath);
 				}
 
 				if (SecurityManager.SecurityEnabled) {
@@ -1248,6 +1248,7 @@
 		internal void SetFilePath (string path)
 		{
 			file_path = path;
+			physical_path = null;
 		}
 
 		internal void SetCurrentExePath (string path)

mono-system.web_security_fix_r68778.patch:
 HttpRequest.cs |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

--- NEW FILE mono-system.web_security_fix_r68778.patch ---
Index: mcs/class/System.Web/System.Web/HttpRequest.cs
===================================================================
--- mcs/class/System.Web/System.Web/HttpRequest.cs	(revision 68777)
+++ mcs/class/System.Web/System.Web/HttpRequest.cs	(revision 68778)
@@ -923,8 +923,10 @@
 				if (worker_request == null)
 					return String.Empty; // don't check security with an empty string!
 
-				if (physical_path == null)
-					physical_path = MapPath (CurrentExecutionFilePath);
+				if (physical_path == null) {
+					// Don't call HttpRequest.MapPath here, as that one *trims* the input
+					physical_path = worker_request.GetFilePathTranslated ();
+				}
 
 				if (SecurityManager.SecurityEnabled) {
 					new FileIOPermission (FileIOPermissionAccess.PathDiscovery, physical_path).Demand ();


Index: mono.spec
===================================================================
RCS file: /cvs/dist/rpms/mono/FC-5/mono.spec,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -r1.34 -r1.35
--- mono.spec	6 Oct 2006 08:08:31 -0000	1.34
+++ mono.spec	11 Jan 2007 13:35:33 -0000	1.35
@@ -1,6 +1,6 @@
 Name:           mono
 Version:        1.1.13.7
-Release:        2.fc5.1
+Release:        3.fc5.1
 Summary:        a .NET runtime environment
 
 Group:          Development/Languages
@@ -22,6 +22,8 @@
 Patch1: mono-1.1.13.4-selinux-ia64.patch
 Patch2: mono-1.1.13.4-ppc-threading.patch
 Patch3: mono-CVE-2006-5072-TempFileCollection.patch
+Patch4: mono-system.web_security_fix_r68778.patch
+Patch5: mono-system.web_security_fix2_r69049.patch
 
 %description
 The Mono runtime implements a JIT engine for the ECMA CLI
@@ -229,6 +231,8 @@
 %patch1 -p1 -b .selinux-ia64
 %patch2 -p1 -b .ppc-threading
 %patch3 -p1 -b .CVE-2006-5072
+%patch4 -p0 -b .CVE-2006-6104-0
+%patch5 -p0 -b .CVE-2006-6104
 
 %build
 %ifarch ia64 s390
@@ -502,6 +506,9 @@
 %gac_dll IBM.Data.DB2
 
 %changelog
+* Thu Jan 11 2007 Alexander Larsson <alexl at redhat.com> - 1.1.13.7-3.fc5.1
+- Add patches to fix CVE-2006-6104
+
 * Fri Oct 06 2006 Caolan McNamara <caolanm at redhat.com> - 1.1.13.7-2.fc5.1
 - CVE-2006-5072