From owner-freebsd-ports-bugs Wed Mar 5 21: 0:50 2003 Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 83E8937B401 for ; Wed, 5 Mar 2003 21:00:39 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id E361143F3F for ; Wed, 5 Mar 2003 21:00:37 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id h2650XNS085638 for ; Wed, 5 Mar 2003 21:00:33 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.6/8.12.6/Submit) id h2650XcS085636; Wed, 5 Mar 2003 21:00:33 -0800 (PST) Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E37BB37B401; Wed, 5 Mar 2003 20:57:01 -0800 (PST) Received: from hotmail.com (f137.law10.hotmail.com [64.4.15.137]) by mx1.FreeBSD.org (Postfix) with ESMTP id DCB2B43F3F; Wed, 5 Mar 2003 20:56:58 -0800 (PST) (envelope-from delphij@hotmail.com) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 5 Mar 2003 20:56:58 -0800 Received: from 218.246.96.6 by lw10fd.law10.hotmail.msn.com with HTTP; Thu, 06 Mar 2003 04:56:58 GMT Message-Id: Date: Thu, 06 Mar 2003 12:56:58 +0800 From: "öÎ Àî" To: FreeBSD-gnats-submit@FreeBSD.org Cc: re@FreeBSD.org, delphij@frontfree.net Subject: ports/48966: [PATCH] SECURITY UPDATE ports/ftp/proftpd to 1.2.8 Sender: owner-freebsd-ports-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 48966 >Category: ports >Synopsis: [PATCH] SECURITY UPDATE ports/ftp/proftpd to 1.2.8 >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Wed Mar 05 21:00:33 PST 2003 >Closed-Date: >Last-Modified: >Originator: Xin LI >Release: FreeBSD 5.0-CURRENT i386 >Organization: Frontfree Technology Network >Environment: System: FreeBSD chunk.frontfree.net 5.0-CURRENT FreeBSD 5.0-CURRENT #3: Tue Mar 4 20:02:14 CST 2003 root@chunk.frontfree.net:/usr/obj/usr/src/sys/CHUNK i386 >Description: ProFTPD 1.2.8 released on March 4, 2003. This updates ports/ftp/proftpd to the most recent release, solving update problem, adds a new manpage. There is a security vulnerability in proftpd 1.2.6, described in: http://online.securityfocus.com/archive/1/298598 The patch attached fixes the following problems, and therefore also superceds PR superceds 44498, 46189, 48096, 47134 and 48071. *de-pkgcomment *upgrade the port to 1.2.8-R so PR 44498 is corrected, and make 46189, 48096 obsolete *correct the portgresql include directory to conform latest postgresql port. This is reported in ports/47134 *obsoletes buggy PR I submit, numbered ports/48071. This port is a new release, containing some security updates. For security considerations, this is strongly recommeneded to be commited before 4.8-RELEASE. Thanks. >How-To-Repeat: >Fix: apply the patch below: diff -ruN proftpd.orig/Makefile proftpd/Makefile --- proftpd.orig/Makefile Mon Feb 24 10:26:51 2003 +++ proftpd/Makefile Thu Mar 6 09:42:54 2003 @@ -6,17 +6,18 @@ # PORTNAME= proftpd -PORTVERSION= 1.2.6 +PORTVERSION= 1.2.8 CATEGORIES= ftp MASTER_SITES= ftp://ftp.proftpd.net/distrib/source/ \ ftp://ftp.stikman.com/pub/proftpd/source/ \ ftp://ftp.dataguard.no/pub/proftpd/distrib/source/ \ ftp://ftp.club-internet.fr/pub/mirrors/ftp.proftpd.org/distrib/source/ -DISTNAME= ${PORTNAME}-1.2.6 +DISTNAME= ${PORTNAME}-${PORTVERSION} MAINTAINER= mharo@FreeBSD.org +COMMENT= Highly configurable ftp daemon -MAN1= ftpcount.1 ftpwho.1 +MAN1= ftpcount.1 ftpwho.1 ftptop.1 MAN5= xferlog.5 MAN8= proftpd.8 ftpshut.8 @@ -59,7 +60,7 @@ POSTGRESQL_PORT?= databases/postgresql7 MODULES:=${MODULES}:mod_sql:mod_sql_postgres LIB_DEPENDS+= pq.3:${PORTSDIR}/${POSTGRESQL_PORT} -INCLUDEDIRS:=${INCLUDEDIRS}:${PREFIX}/include/pgsql +INCLUDEDIRS:=${INCLUDEDIRS}:${PREFIX}/include LIBDIRS:=${LIBDIRS}:${PREFIX}/lib .endif @@ -90,24 +91,30 @@ -e 's:/usr/bin:${PREFIX}/bin:' \ < ${WRKSRC}/src/proftpd.8.pre_sed > ${WRKSRC}/src/proftpd.8 - @${MV} ${WRKSRC}/src/ftpshut.8 ${WRKSRC}/src/ftpshut.8.pre_sed + @${MV} ${WRKSRC}/utils/ftpshut.8 ${WRKSRC}/utils/ftpshut.8.pre_sed @${SED} -e 's:/usr/sbin:${PREFIX}/sbin:' \ -e 's:/etc:/var/run:' \ - < ${WRKSRC}/src/ftpshut.8.pre_sed > ${WRKSRC}/src/ftpshut.8 + < ${WRKSRC}/utils/ftpshut.8.pre_sed > ${WRKSRC}/utils/ftpshut.8 + + @${MV} ${WRKSRC}/utils/ftpcount.1 ${WRKSRC}/utils/ftpcount.1.pre_sed - @${MV} ${WRKSRC}/src/ftpcount.1 ${WRKSRC}/src/ftpcount.1.pre_sed @${SED} -e 's:/usr/bin:${PREFIX}/bin:' \ - < ${WRKSRC}/src/ftpcount.1.pre_sed > ${WRKSRC}/src/ftpcount.1 + < ${WRKSRC}/utils/ftpcount.1.pre_sed > ${WRKSRC}/utils/ftpcount.1 + + @${MV} ${WRKSRC}/utils/ftptop.1 ${WRKSRC}/utils/ftptop.1.pre_sed + @${SED} -e 's:/usr/bin:${PREFIX}/bin:' \ + < ${WRKSRC}/utils/ftptop.1.pre_sed > ${WRKSRC}/utils/ftptop.1 do-install: @${INSTALL_PROGRAM} ${WRKSRC}/ftpcount ${PREFIX}/bin/ftpcount @${INSTALL_PROGRAM} ${WRKSRC}/ftpwho ${PREFIX}/bin/ftpwho @${INSTALL_PROGRAM} ${WRKSRC}/proftpd ${PREFIX}/libexec/proftpd @${INSTALL_PROGRAM} ${WRKSRC}/ftpshut ${PREFIX}/sbin/ftpshut - @${INSTALL_MAN} ${WRKSRC}/src/ftpcount.1 ${PREFIX}/man/man1/ftpcount.1 - @${INSTALL_MAN} ${WRKSRC}/src/ftpwho.1 ${PREFIX}/man/man1/ftpwho.1 + @${INSTALL_MAN} ${WRKSRC}/utils/ftpcount.1 ${PREFIX}/man/man1/ftpcount.1 + @${INSTALL_MAN} ${WRKSRC}/utils/ftpwho.1 ${PREFIX}/man/man1/ftpwho.1 + @${INSTALL_MAN} ${WRKSRC}/utils/ftptop.1 ${PREFIX}/man/man1/ftptop.1 @${INSTALL_MAN} ${WRKSRC}/src/xferlog.5 ${PREFIX}/man/man5/xferlog.5 - @${INSTALL_MAN} ${WRKSRC}/src/ftpshut.8 ${PREFIX}/man/man8/ftpshut.8 + @${INSTALL_MAN} ${WRKSRC}/utils/ftpshut.8 ${PREFIX}/man/man8/ftpshut.8 @${INSTALL_MAN} ${WRKSRC}/src/proftpd.8 ${PREFIX}/man/man8/proftpd.8 @${INSTALL_DATA} \ ${WRKSRC}/sample-configurations/basic.conf ${PREFIX}/etc/proftpd.conf.default diff -ruN proftpd.orig/distinfo proftpd/distinfo --- proftpd.orig/distinfo Sun Sep 15 02:50:14 2002 +++ proftpd/distinfo Thu Mar 6 09:46:31 2003 @@ -1 +1 @@ -MD5 (proftpd-1.2.6.tar.bz2) = 17551a5281a86fbc7857e31a723d5599 +MD5 (proftpd-1.2.8.tar.bz2) = 35e669cb085879eea21c6db9e7af2040 diff -ruN proftpd.orig/files/patch-aa proftpd/files/patch-aa --- proftpd.orig/files/patch-aa Wed Mar 7 08:32:00 2001 +++ proftpd/files/patch-aa Thu Mar 6 11:55:41 2003 @@ -1,21 +1,27 @@ ---- sample-configurations/basic.conf.old Sun Mar 4 15:08:09 2001 -+++ sample-configurations/basic.conf Sun Mar 4 15:13:29 2001 -@@ -1,3 +1,7 @@ +--- sample-configurations/basic.conf.orig Tue Feb 18 16:16:20 2003 ++++ sample-configurations/basic.conf Thu Mar 6 11:54:41 2003 +@@ -1,7 +1,7 @@ +-# This is a basic ProFTPD configuration file (rename it to +-# 'proftpd.conf' for actual use. It establishes a single server +-# and a single anonymous login. It assumes that you have a user/group +-# "nobody" and "ftp" for normal operation and anon. +# +# To have more informations about Proftpd configuration +# look at : http://www.proftpd.org/ +# - # This is a basic ProFTPD configuration file (rename it to - # 'proftpd.conf' for actual use. It establishes a single server - # and a single anonymous login. It assumes that you have a user/group -@@ -30,24 +34,36 @@ + + ServerName "ProFTPD Default Installation" + ServerType standalone +@@ -35,25 +35,29 @@ AllowOverwrite on --# A basic anonymous configuration, no upload directories. +-# A basic anonymous configuration, no upload directories. If you do +not -# want anonymous users, simply delete this entire +section. - - User ftp - Group ftp +- - # We want clients to be able to login with "anonymous" as well as "ftp" - UserAlias anonymous ftp - @@ -31,37 +37,30 @@ - - DenyAll - +- +######################################################################### -+# # -+# Uncomment lines with only one # to allow basic anonymous access # -+# # ++# The original distribution assumes a basic anonymous access, which is # ++# disabled in this port. Remove the comment # below to activate it. # +######################################################################### -+### A basic anonymous configuration, no upload directories. -+# ++## A basic anonymous configuration, no upload directories. If you do ++not ## want anonymous users, simply delete this entire ++section. # +# User ftp -+# Group ftp -+ ### We want clients to be able to login with "anonymous" as well as "ftp" -+ # UserAlias anonymous ftp -+ -+ ### Limit the maximum number of anonymous logins -+ # MaxClients 10 -+ -+ ### It is wise when making an 'ftp' user that you either block its -+ ### ability to login either via /etc/login.access or my giving it -+ ### an invalid shell. ### Uncomment this if the 'ftp' user you made -+ has an invalid shell -+ -+ # RequireValidShell off -+ -+ ### We want 'welcome.msg' displayed at login, and '.message' -+ displayed ### in each newly chdired directory. -+ # DisplayLogin welcome.msg -+ # DisplayFirstChdir .message -+ -+ ### Limit WRITE everywhere in the anonymous chroot -+ # -+ # DenyAll -+ # - -- -+# ++# Group ftp ++# ++# # We want clients to be able to login with "anonymous" as well as "ftp" ++# UserAlias anonymous ftp ++# ++# # Limit the maximum number of anonymous logins ++# MaxClients 10 ++# ++# # We want 'welcome.msg' displayed at login, and '.message' ++displayed # # in each newly chdired directory. ++# DisplayLogin welcome.msg ++# DisplayFirstChdir .message ++# ++# # Limit WRITE everywhere in the anonymous chroot ++# ++# DenyAll ++# ++# diff -ruN proftpd.orig/files/patch-ah proftpd/files/patch-ah --- proftpd.orig/files/patch-ah Mon Dec 6 03:29:53 1999 +++ proftpd/files/patch-ah Thu Jan 1 08:00:00 1970 @@ -1,10 +0,0 @@ ---- modules/mod_unixpw.c.orig Thu Sep 30 20:33:47 1999 -+++ modules/mod_unixpw.c Sat Nov 13 13:15:26 1999 -@@ -42,6 +42,7 @@ - #include - #endif - #ifdef HAVE_PROT_H -+#include - #include - #endif - diff -ruN proftpd.orig/files/patch-ai proftpd/files/patch-ai --- proftpd.orig/files/patch-ai Mon Oct 21 04:51:22 2002 +++ proftpd/files/patch-ai Thu Jan 1 08:00:00 1970 @@ -1,11 +0,0 @@ ---- contrib/mod_ratio.c.orig Sun Oct 20 13:49:21 2002 -+++ contrib/mod_ratio.c Sun Oct 20 13:50:11 2002 -@@ -606,7 +606,7 @@ - add_response(R_214, - "Bytes: %s Down: %imb Up: %imb CR: %i Mbytes", - stats.btext, (stats.bretr / 1024), (stats.bstor / 1024), -- (stats.bytes / 1024), stats.bytes); -+ (stats.bytes / 1024)); - return HANDLED(cmd); - } - diff -ruN proftpd.orig/files/patch-aj proftpd/files/patch-aj --- proftpd.orig/files/patch-aj Mon Oct 21 04:51:22 2002 +++ proftpd/files/patch-aj Thu Jan 1 08:00:00 1970 @@ -1,11 +0,0 @@ ---- include/glibc-glob.h.orig Sun Oct 20 13:43:44 2002 -+++ include/glibc-glob.h Sun Oct 20 13:48:38 2002 -@@ -50,7 +50,7 @@ - #endif - - /* We need `size_t' for the following definitions. */ --#ifndef __size_t -+#if !defined(__size_t) && !defined(__FreeBSD__) - # if defined __GNUC__ && __GNUC__ >= 2 - typedef __SIZE_TYPE__ __size_t; - # ifdef _XOPEN_SOURCE diff -ruN proftpd.orig/files/patch-pam proftpd/files/patch-pam --- proftpd.orig/files/patch-pam Fri Jun 14 05:00:23 2002 +++ proftpd/files/patch-pam Thu Mar 6 12:13:56 2003 @@ -1,22 +1,3 @@ ---- ./README.PAM.orig Mon Jan 21 16:25:42 2002 -+++ ./README.PAM Mon Jan 21 16:27:07 2002 -@@ -19,14 +19,8 @@ - - FreeBSD: - --To use PAM with ProFTPD, you must edit /etc/pam.conf and add the --following lines: -- --ftp auth required pam_unix.so try_first_pass --ftp account required pam_unix.so try_first_pass --ftp session required pam_permit.so -- --PAM authentication should now work properly. -+To use PAM with ProFTPD, you must set AuthPAMConfig to 'ftpd'. If you -+installed proftpd from the ports collection, this is already the -+default. - - Linux: - To use PAM with ProFTPD, you must edit /etc/pam.d/ftp and add the --- doc/Configuration.html.orig Wed May 22 10:08:15 2002 +++ doc/Configuration.html Sat Jun 1 10:30:54 2002 @@ -3806,7 +3806,7 @@ @@ -28,14 +9,14 @@ >
[I''3DZ;ELE
M*DH*,N]M4%``````]````0R(C0BGM-3P)D*>U3TGM4R#-0QJ>4T'J``!H&@`
M:$3`3(U&B:GE#U-DF@&@!ID```!B``14\H\*`!H`T```&@```````$IZ2A31
MLII&GI3--)B`>H8T(T8(``#0`#(',FFAD`#$9!D`-,$#$`T::`#(&@`2)"`"
M!,F0"9&IC09$394_4:F33VIA)ZFAZ:0>:*;`UMNU6`TA@O[_B/[OR/P:G+\2
MNVV+6K2"1*:\A#(Q@@UN<8?N)@!U,_9+K_1(-`:LZ3,!@($)`?%9=*?>/X_3
M@XJ\'"V!N^K%O?&QW"]\T4=2H#)$0H0*%*E.8;$`XAPEIDLRXT+$A:_DFVO7H&M?\D@&2MW/9U*:K:
M6];3IT\,G1E0"]OI>Q,3.L[U<.D7HF-.3(02.O6C(N8&5=@X59Z9
M+%T=J3[:3DWS.RP^'EC4KUK\"RRJX8#8/>XZF@A:V$]N%V2.[M5EU0Y$Q^"[
M,;EL8F%W9A=V87.4.S^V\3^)C(]C
M%(L$>5)#X^4".?Z6XZ=(Z'3W[#+'+29L)2-QL1W!LKK80_&&0#1N-&MP$MMH
M#K)Q9<`S<%\100.05!<5AP-IB+5P$P/W-*4J1!FE",:0@1"UC4"66N6$ZJQW
MF4F&R:AZXYL@SP)/5],%&WIGR24>[F0DL7DQ2$<1&I%VT;I0RR\*C*RXH$$PA0J;>OO!\*W2CM7J(
M++]MN\P&#)FL]JN5@7I-9BGJD8]A,.?PT%?%NM+18\
M`W=)UX=6\TE(T$CWDC.`SG:TECGZN:+UR&;LXGN0,$+\JLUPVWEBRL+2I4P$
M%@,]F[J-?%I+QKDFAUPO,X/"6=#+I[-WADU;_D555579@YO7=Y]A\;L=OG;9
M>TT\)H>AEP&KB-@<.[K5XXXY<`\;,!;L,M%5A'L09]K1(H.*F8BSC2,8:*-#
MP9*)Y1DO(HQTK0K:UKJ3-MK-,U#>RGP:1MAA]L1_*4%/$,5G/&$54NY"X
M*-7"TN2[+:!+H$@(DHCEEVE1_G.KHUMR6-$1:6>`UYE
M=H[N;VV,TRVUAKJ$PY>#3:/9%IQG$<08%O7!X9;V4WQ0`W]+;&-O3K>G]".J
MKSPQ41$1$1>Q6IZ>6?0Q6"JX
M8<&#@08QT:*4D3GF8E`FT%2#EJ!C,RA`(KPP'*=E\!87='1%0W70M9$H^I?0'G".Z[F>**Q":+4V)7!PA!*";6VL=A8B&\Z2D/RMN@N9$C5@DS,E"B@PDFEV(JA
M:.YJL#?T-^O&33GZ\A5L"`T?(9H10,F(7:\V*7A[ISFN.1*\(FI1&K."3,](
M5XM!256,\\IN3\@N7<_=\)!$H4FFU\YTGQ_#0:CG\5>_AD
M*_!J;@.3-FA5%6@\1:T0`H$`DV`DB($AA)&LF?"X;B4E$B'[)A:6?2Q+\DN-
M#7$$P^+0=X_/]4SQF@^'6=0""/!S#C*:&F.0"ADOW&,=H38!"`0)J#`B[*A[
MJ[@BH_Y8Z8\F?V#XO\%6HW#Q:+UY35R[S4AJ1;W<00I(1/BJ=,__%2SA%A*:
M_2RTQ0CI%FTL%&>B#4@IKS&YZ=2HH5#Y`@\HE
MMQ+SJ_XR#[)`7J[.Z3VB5]R'$,)KM$PRGC@KTAG*^6779@>0,B%;RV@;5H7K
M\:)HW`@8L33I0BP37\
M)K`U],B#SLK&N\&=F$\3XVA;>"Y`K^Q]Y_<
M^BM8WOX"1S6D8(^048,O2!@6;X0>-,7@O:EH$4`J,]$N"L4-?>)9!`>D9-:B
M8(LM08PB@QK'1TX`?0BAG(+R5*;V#&H
M`I?'2JF9M+*2`VC1(*C-(UJJ%#ZJY5_=<%0:5.10$8"[!A>UASI3E+B#J4J0
MYH-9-!-#.!@Q+UBU+%I,=TX2;5T,@0T,B800YO(W$R1?"1H:`,6OMKT"L89&
M'39_7)<@-KD,ZZK#\QJ0OY@O5OXB[5_:YSG)[T2-Q4M?
M0NHYU85C3*JUB84*_?!6I3(4T6XCDAE811
M)B]9"@6DX[J%"HF;[R:QGH1@_R!A4=P0<9">_F/;B3P/%]:."4[SM1DO276K
M:=`RS(B&*0S9(\B@Z9A:5*R9C8,XI&(:1"MG.LZ%6%-`ZCL185E"9G;!<&;B
M`(.`2["1[U)&ZB^:AT*N`*D@HKQY`AAZBE`IVL(Y(/CYX@<12US'WH_Z)HJ#
M]E`B!ABBE(22)*MH38#&7H-VUQB#@ZPK5)@V"U@R20V65A88FT@Y[+`#A&IE
M27(G$`B026R0%+YIKW$R0CX/3TOLDF0.%,9Z"0$ZB\MK!326"U_K'7X@FAIT
M`P0-#ZY@3#M#M9>0X`CL)@-@'W#@`L8A>2`#$_>(P/&;#`;3`K2'R8*9%RR+
MPGT;=3P"NXYOY61G!$"\\*#F]1@6!QI.F6DM"0*;+$H3#=4EY3KI
M93'50,T<@=G17(.P'V?'/`_)BH#E*&.H#,+MMJ,CG(@A5(UV2?D*Q5@BT_FN
MBX>2[34MI@6V%K:*S-DH,PO*]:M`P98\[FI7@&2Q`W&\Q-V%BK'FQ-B,"?3D
M((D8%948-6!M2FO($_-=8E`4/('6;>0
M]B:4PF"*A(#B+2&L
M7.,/&(--3),:;)%%!SRE)+4:1PT+S324!2TH61A;#3N?=D^?]+U9J%
M"$NO1&8,R%XAL>\SS#J
M8:EX[]+5:S=4Y[V49*9\PM6FN"NB*SU#5Y"B@R4R&25IVRLV5"5J%=A5%D*X
M+F-AF-)41($3<%G*C1475I-:1)P0BQ!72@`PD$,#0FJFBA+I*P7!*R:74DET
M-)`L;"@?J07ZH6`L+BRHPU4!-!8!@>)I>,^8@.@=0%
M"`+"(NLPN.C$LPH2*$XYA:WR;7>2E&I5!`PA"6(CFIR\0?=808H_8!(\#V77
B?.%_2J"JN/)]9\/WE=^FBD1JJKTPUU_XNY(IPH2&M9OU4```
`
end

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports-bugs" in the body of the message