Web Server Updates – NET+OS 7.3

 

 

 

Last Updated: 10/25/10         Fix Count: 15

 

 

Title

SMTP authentication failure

 

Case: 33111

 

Date Fixed: 10/25/10

 

Description

SMTP authentication fails using CRAM MD5

 

Solution

Fixed problem where SMTP authentication fails using CRAM MD5 if the password contains the number 6 or a \. (case  33111)

 

Title

email headers contain a 0.0.0.0 address field

 

Case: 35889

 

Date Fixed: 09/15/10

 

Description

Return-Path is not properly included in email headers

 

Solution

Fixed RpWriteIpAddressInDotForm() to use IPv6 for IPv6 family (IPv4 was always used) Also corrected size when copying local address in StcpActiveConnectionStatus().

 

 

Title

Certain URL formats could cause cross site scripting vulnerabilities in AWS applications

 

Case: 34389

 

Date Fixed: 05/13/10

 

Description

Directly accessing certain forms objects and including javascript code in the URL could allow the javascript code to run. This represents a simulation of a cross site scripting threat. The AWS code was not correctly checking forms objects, thus leaving a door open for such vulnerabilities.

 

Solution

Removed itemValue for invalid form entries to prevent cross-site scripting.

 

 

Title

Internet Explorer unable to open attachment

 

Case: 34406

 

Date Fixed: 05/12/10

 

Description

Windows Internet Explorer was unable to open an attachment (Content-Disposition: attachment) if the web server returned no-cache in the cache-control header.

 

Solution

Updated the web server to return must-revalidate in cache-control header for Content-Disposition: attachment.

 

 

Title

Updated CGI to support customized content-type

 

Case: 33984

 

Date Fixed: 05/03/10

 

Description

Customer wants the ability to change HTTP headers from RpExternalCgi

 

Solution

Added fOtherMimeType in rpCgiPtr structure for customized content-type. (case 33984)

 

 

Title

Cross-site scripting vulnerability in AWS

 

Case: 33871

 

Date Fixed: 04/06/10

 

Description

Cross-site scripting is a methodology where a hacker "piggy-backs" malicious javascript or other language code in a web request or web page and induces a web server to run that code. This vulnerability has been remedied.

 

Solution

Return bad-request if item is not found on the form.

 

 

Title

Problem authenticating to mail servers

 

Case: 29483

 

Date Fixed: 02/25/09

 

Description

After failing EHLO (authenticated email) email client does not retry with HELO

 

Solution

Send QUIT command before closing the connection when we receive that error from the server.

 

 

Title

PBuilder Code generation error

 

Case: 28272

 

Date Fixed: 01/16/09

 

Description

Code generated by PBuilder utility, for RpbufferDisplay does not align with stub function signature (size of length field)

 

Solution

Changed fBufferItemLength from Unsigned16 to Unsigned32 for RpBufferDisplay tag. PageBuilder creates the prototype using Unsigned32 for RpBufferDisplay tag. fBufferItemLength is only used for the RpBufferDisplay tag.

 

 

Title

UTF-8 Content-type not supported

 

Case: 1256813

 

Date Fixed: 09/19/08

 

Description

MCAdd_ContentType does not allow the use of UTF-8.

 

Solution

Support for the UTF-8 character set added.

 

 

Title

Frames being challenged in AWS

 

Case: 28039

 

Date Fixed: 09/12/08

 

Description

A web page is included as part of a NET+OS application that uses the HTML frames construct. In addition multiple frames share one realm. Also digest authentication is enabled for the realms to which the frames are associated. In this case a user could be challenged an unreasonable number of times due to restrictions in frames sharing realms.

 

Due to the way MS Internet Explorer handles authentication challenges when a web pages contains multiple frames and the way nonces are generated, a user could end up continually being challenged for his user name and password. This has to do with MS Internet explorer sending frame challenges simultaneously. The way nonces are handled in NET+OS’s AWS is not conducive to this activity. Mozilla’s Firefox browser handles HTML frames in a different manner and user should not experience this problem when using Firefox.

 

Solution

Digi’s NET+OS does not support multiple frames sharing a single realm when digest authentication is enabled. If digest authentication is required, then Digi requires that each frame be associated with a separate realm. Additionally, changes were made to AWS to ensure that existing user entries are more adequately cleared out of the internal web access database, after authentication failures.

 

 

Title

MCAdd_Special_Attachment failing

 

Case: 1256813

 

Date Fixed: 09/09/08

 

Description

When trying to add a special attachment, the function always returned NAMAILC_SYNTAXERROR (-8).

 

Solution

Fixed issue that was causing mime_types of a valid size to be rejected.

 

 

Title

Device fails to respond to 250 AUTH response from server

 

Case: 27905

 

Date Fixed: 09/04/08

 

Description

When there are multiple lines for the EHLO response and the last line is not a ‘250 OK’, the SMTP agent would miss the last line of information.

 

Solution

Modified code to check response and act accordingly.

 

 

Title

Mail Server crashing

 

Case: 27457

 

Date Fixed: 08/05/08

 

Description

If you specify an invalid IP address for your Mail server, and try to send Emails to it, MCSendMail will cause the thread to hang on the tx_semaphore_get or occasionally crash.

 

Solution

Added code to validate Mail ID.

 

 

Title

Mail Server fails to send attachments

 

Case: 27355

 

Date Fixed: 07/23/08

 

Description

If you call NAMCSetCharsetandMailername each time you send an email, on the second send you'll get a bunch of header information and the data stored in the attachment in the body of the message rather than attached to the email itself.

 

Solution

Fixed the mailerproductname by removing RP_STRCAT call. kCRLF will be catenated when constructing the mail header.

 

 

Title

Enabled RomPagerCaptureLanguage feature

 

Case: 1250703

 

Date Fixed: 07/18/08

 

Description

The Accept-Language HTTP header is sent by browsers and may provide some information about what languages a browser user is capable of displaying. If RomPagerCaptureLanguage is defined as 1, the code to capture the
Accept-Language HTTP header that the browser sends in will be generated.

 

Solution

Enabled feature in the Web Server code.

 

 

Title

IP address filtering problems

 

Case: 1250703

 

Date Fixed: 07/10/08

 

Description

When the secure AWS is configured to accept both http and https connections, and IP address filtering is set via NAsetSysAccess(), after a POST operation, the URL at the top of the forms page would change to http from https. In addition, the user would get a window indicting that they are moving to a less secure environment.

 

Solution

New code for analyzing and comparing the IP address of the incoming connection and the IP address contained in the system access database, was not correctly comparing IPV4 and IPv4-mapped IPv6 addresses correctly. This was causing this internal code to incorrectly conclude that a privilege violation had occurred. This has been corrected.

 

 
Files:  
               netos\h\rphttpd\RpExtern.h
               netos\h\rphttp\RpCgi.h
               netos\h\mailcapi.h
               netos\\lib\arm7\32b\ghs\librphttpd.a
               netos\lib\arm9\32b\gnu\librphttpd.a
               netos\lib\arm7\32b\ghs\librphttpd.a
               netos\lib\arm9\32b\gnu\librphttpd.a
               netos\\lib\arm7\32b\ghs\librphttpddbg.a
               netos\lib\arm9\32b\gnu\librphttpddbg.a
               netos\lib\arm7\32b\ghs\librphttpddbg.a
               netos\lib\arm9\32b\gnu\librphttpddbg.a
               netos\\lib\arm7\32b\ghs\libhttpd.a
               netos\lib\arm9\32b\gnu\libhttpd.a
               netos\lib\arm7\32b\ghs\libhttpd.a
               netos\lib\arm9\32b\gnu\libhttpd.a
               netos\\lib\arm7\32b\ghs\libhttpddbg.a
               netos\lib\arm9\32b\gnu\libhttpddbg.a
               netos\lib\arm7\32b\ghs\libhttpddbg.a
               netos\lib\arm9\32b\gnu\libhttpddbg.a
               netos\\lib\arm7\32b\ghs\libemailc.a
               netos\lib\arm9\32b\gnu\libemailc.a
               netos\lib\arm7\32b\ghs\libemailc.a
               netos\lib\arm9\32b\gnu\libemailcd.a
               netos\\lib\arm7\32b\ghs\libemailcdbg.a
               netos\lib\arm9\32b\gnu\libemailcdbg.a
               netos\lib\arm7\32b\ghs\libemailcdbg.a
               netos\lib\arm9\32b\gnu\libemailcdbg.a
 

Special Instructions

 

  • Unzip the patch(es) to the root of your NET+OS installation, for example C:\netos73\.
  • Be sure to install any patches listed under Dependencies below
  • Rebuild your application.

 

Patch Link:  WebServerUpdates_73

 

Dependencies

This patch also requires the installation of the following patch(es):

None