View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0004636libmicrohttpddigest authentication (HTTP)public2016-09-02 09:012016-10-17 17:21
Reporter0xda7aba5e Assigned ToChristian Grothoff Due Date
PrioritynormalSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product Version0.9.51 
Target Version0.9.52Fixed in Version0.9.52 
Summary0004636: non-sequential nonce count
DescriptionBrowsers maybe send there nonce-count in an non-sequential order.
In file "src/microhttpd/digestauth.c" the function "check_nonce_nc" only accepts ascending nonce-count values:
Request 1: nc=1
Request 2: nc=2
Request 3: nc=5

It should be possible that a nonce-count value is lower than a nonce-count sent before:
Request 1: nc=1
Request 2: nc=2
Request 3: nc=5
Request 4: nc=3
Request 5: nc=4
Request 6: nc=6

Such a sequence causes a 401 response.




TagsNo tags attached.

Activities

Christian Grothoff

2016-09-04 16:17

manager   ~0011087

Ok, I guess we should keep a bit mask in addition to the counter to allow this.

Christian Grothoff

2016-09-06 21:42

manager   ~0011095

Implemented in SVN 37899.

Issue History

Date ModifiedUsernameFieldChange
2016-09-02 09:010xda7aba5eNew Issue
2016-09-04 16:17Christian GrothoffNote Added: 0011087
2016-09-04 16:17Christian GrothoffAssigned To => Christian Grothoff
2016-09-04 16:17Christian GrothoffStatusnew => assigned
2016-09-04 16:17Christian GrothoffTarget Version => 0.9.52
2016-09-06 21:42Christian GrothoffNote Added: 0011095
2016-09-06 21:42Christian GrothoffStatusassigned => resolved
2016-09-06 21:42Christian GrothoffFixed in Version => 0.9.52
2016-09-06 21:42Christian GrothoffResolutionopen => fixed
2016-10-17 17:21Christian GrothoffStatusresolved => closed