#! /bin/sh /usr/share/dpatch/dpatch-run
## 213_CVE-2011-3348.dpatch by Steve Beattie <sbeattie@ubuntu.com>
##
#
# Subject: AJP_EBAD_METHOD is also a bad request so return HTTP_NOT_IMPLEMENTED 
# Origin: http://svn.apache.org/viewvc?view=revision&revision=1167158
#
# CVE-2011-3348

@DPATCH@
diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' apache2-2.2.16~/modules/proxy/mod_proxy_ajp.c apache2-2.2.16/modules/proxy/mod_proxy_ajp.c
--- apache2-2.2.16~/modules/proxy/mod_proxy_ajp.c	2010-07-11 23:57:41.000000000 -0700
+++ apache2-2.2.16/modules/proxy/mod_proxy_ajp.c	2011-10-24 14:37:25.000000000 -0700
@@ -213,6 +213,8 @@
                      conn->worker->hostname);
         if (status == AJP_EOVERFLOW)
             return HTTP_BAD_REQUEST;
+        else if (status == AJP_EBAD_METHOD)
+            return HTTP_NOT_IMPLEMENTED;
         else {
             /*
              * This is only non fatal when the method is idempotent. In this
