Web Server Updates – NET+OS 7.2

Last Updated: 05/13/10 Fix Count: 6

Title

Certain URL formats could cause cross site scripting vulnerabilities in AWS applications

Case: 34389

Date Fixed: 05/13/10

Description

Directly accessing certain forms objects and including javascript code in the URL could allow the javascript code to run. This represents a simulation of a cross site scripting threat. The AWS code was not correctly checking forms objects, thus leaving a door open for such vulnerabilities.

Solution

Removed itemValue for invalid form entries to prevent cross-site scripting.

Title

Internet Explorer unable to open attachment

Case: 34406

Date Fixed: 05/12/10

Description

Windows Internet Explorer was unable to open an attachment (Content-Disposition: attachment) if the web server returned no-cache in the cache-control header.

Solution

Updated the web server to return must-revalidate in cache-control header for Content-Disposition: attachment.

Title

PBuilder Code generation error

Case: 34256

Date Fixed: 05/05/10

Description

Code generated by PBuilder utility, for RpbufferDisplay does not align with stub function signature (size of length field)

Solution

Changed fBufferItemLength from Unsigned16 to Unsigned32 for RpBufferDisplay tag. PageBuilder creates the prototype using Unsigned32 for RpBufferDisplay tag. fBufferItemLength is only used for the RpBufferDisplay tag.

Title

Cross-site scripting vulnerability in AWS

Case: 33871

Date Fixed: 04/06/10

Description

Cross-site scripting is a methodology where a hacker "piggy-backs" malicious javascript or other language code in a web request or web page and induces a web server to run that code. This vulnerability has been remedied.

Solution

Return bad-request if item is not found on the form.

Title

When secure AWS is started in HTTP_AND_HTTPS mode forms do not act well

Case: 31225

Date Fixed: 07/27/09

Description

If the secure web server is started with the secure_only field set to HTTP_AND_HTTPS and a form is included in the project, and you surf to the device as https:<your device ip>, when you hit the submit button (assuming you entered the form as HTTPS) as you transition to the post_submit page, you'll leave HTTPS and revert to HTTP.

Solution

Fix ported back from NET+OS 7.4

Title

Problem authenticating to mail servers

Case: 29483

Date Fixed: 02/25/09

Description

After failing EHLO (authenticated email) email client does not retry with HELO

Solution

Send QUIT command before closing the connection when we receive that error from the server.

Title

Intermittent problems authenticating to mail servers

Case: 1231775 / 20959

Date Fixed: 06/22/07

Description

Server intermittently rejects connection attempt when using CRAM-MD5 authentication.

Solution

CRAM-MD5 digest calculation may contain NULL in the data field. Code now handles this properly.

 
Files: netos\\lib\arm7\32b\ghs\librphttpd.a
netos\lib\arm9\32b\gnu\librphttpd.a
netos\lib\arm7\32b\ghs\librphttpd.a
netos\lib\arm9\32b\gnu\librphttpd.a
netos\\lib\arm7\32b\ghs\libhttpd.a
netos\lib\arm9\32b\gnu\libhttpd.a
netos\lib\arm7\32b\ghs\libhttpd.a
netos\lib\arm9\32b\gnu\libhttpd.a
netos\\lib\arm7\32b\ghs\libemailc.a
netos\lib\arm9\32b\gnu\libemailc.a
netos\lib\arm7\32b\ghs\libemailc.a
netos\lib\arm9\32b\gnu\libemailc.a
 

Special Instructions

• Unzip the patch(es) to the root of your NET+OS installation, for example C:\netos72\.
• Be sure to install any patches listed under Dependencies below
• Rebuild your application.

Patch Link: WebServerUpdates_72

Dependencies

This patch also requires the installation of the following patch(es):

None