[Fedora-directory-commits] adminserver/admserv/cfgstuff admserv.conf.in, 1.10, 1.11

[Richard Allen Megginson (rmeggins)]

Author: rmeggins

Update of /cvs/dirsec/adminserver/admserv/cfgstuff
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv14565/adminserver/admserv/cfgstuff

Modified Files:
	admserv.conf.in 
Log Message:
Resolves: CVE-2008-0892 and 437320
Description: Directory Server: shell command injection in CGI replication
monitor
Directory Server: unrestricted access to CGI scripts
Fix Description: remove ScriptAlias for bin/admin/admin/bin - do not use that
directory for CGI URIs - use only protected URIs for CGIs requiring
authentication
Remove most CGI parameters from repl-monitor-cgi.pl - user must supply
replmon.conf in the admin server config directory instead of passing in this
pathname - repl-monitor-cgi.pl does not use system to call repl-monitor.pl, it
"includes" that script (using perl import).
Platforms tested: all supported platforms
Flag Day: no
Doc impact: release notes are available

Resolves: CVE-2008-0892 and 437320
Description: Directory Server: shell command injection in CGI replication
monitor
Directory Server: unrestricted access to CGI scripts
Fix Description: remove ScriptAlias for bin/admin/admin/bin - do not use that
directory for CGI URIs - use only protected URIs for CGIs requiring
authentication
Remove most CGI parameters from repl-monitor-cgi.pl - user must supply
replmon.conf in the admin server config directory instead of passing in this
pathname - repl-monitor-cgi.pl does not use system to call repl-monitor.pl, it
"includes" that script (using perl import).
Platforms tested: all supported platforms
Flag Day: no
Doc impact: release notes are available



Index: admserv.conf.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cfgstuff/admserv.conf.in,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- admserv.conf.in	7 Dec 2007 17:43:50 -0000	1.10
+++ admserv.conf.in	9 Jun 2008 15:42:46 -0000	1.11
@@ -25,7 +25,6 @@
 ADMServerVersionString "@capbrand at -Administrator/@PACKAGE_VERSION@"
 ADMConfigDir "@configdir@"
 
-ScriptAlias /bin/admin/admin/bin/ "@cgibindir@/"
 ScriptAlias /dist/ "@cgibindir@/"
 ScriptAlias /manual/help/ "@cgibindir@/"
 
@@ -63,7 +62,7 @@
 
 # remap / requests to the download CGI
 RewriteEngine on
-RewriteRule ^/$ /bin/admin/admin/bin/download [R,L,QSA]
+RewriteRule ^/$ /dist/download [R,L,QSA]
 
 # remap admin server icons
 Alias /admin-serv/tasks/icons/ @icondir@/