From owner-freebsd-security@FreeBSD.ORG Thu May 1 08:55:50 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1E9591065676 for ; Thu, 1 May 2008 08:55:50 +0000 (UTC) (envelope-from gunther.mayer@googlemail.com) Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.184]) by mx1.freebsd.org (Postfix) with ESMTP id A2AE68FC1C for ; Thu, 1 May 2008 08:55:49 +0000 (UTC) (envelope-from gunther.mayer@googlemail.com) Received: by nf-out-0910.google.com with SMTP id h3so422607nfh.33 for ; Thu, 01 May 2008 01:55:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:user-agent:mime-version:to:subject:content-type:content-transfer-encoding:from; bh=M8YUZdg0Hki4oPt/RnSqWSjcoWPIlnOU4QUTRTosLnk=; b=iSZYHguMQ3FokYidIMduTXbYGcm+xzYqf5nhY03SQxTCLzM2Kl1pYTJTnNZ82oYTvEyFZKNBa6LGZgJTMol8Q9ehrAqVkuxnbAWIXUEYWTsZ6IDQuTlbU/8kBoAuDPj4QnJx2rufoE459NGKiaXkbP4M3ZslsLzIAxgUjLC6wlk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:user-agent:mime-version:to:subject:content-type:content-transfer-encoding:from; b=FuUXVNcL229vzaeCidygGbj7uh8+jaTW5RDGwjqCzv1k1okaYKfpjzJkPAlkn/HqMjFi14vigf5XXtR0lhVDTXxsrM3/iD3dihEa59yDeMeS2lLCX9GWepskG4NB4n5zH5Z5t408KKZdcOJ9JUFLxskU7w9RnSMkhL20JY92uA4= Received: by 10.210.124.8 with SMTP id w8mr1620117ebc.108.1209630470058; Thu, 01 May 2008 01:27:50 -0700 (PDT) Received: from ?172.25.0.155? ( [41.245.156.120]) by mx.google.com with ESMTPS id c4sm19535497nfi.13.2008.05.01.01.27.47 (version=TLSv1/SSLv3 cipher=RC4-MD5); Thu, 01 May 2008 01:27:49 -0700 (PDT) Message-ID: <48197EDD.7030308@gmail.com> Date: Thu, 01 May 2008 10:27:09 +0200 User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: freebsd-security@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit From: Gunther Mayer X-Mailman-Approved-At: Thu, 01 May 2008 11:21:35 +0000 Subject: validity of php 5.2.1 vulnerability X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 May 2008 08:55:50 -0000 Hi there, Some days ago there was an integer overflow vulnerability posted for php 5.2.1 and earlier (http://www.freebsd.org/ports/portaudit/f6377f08-12a7-11dd-bab7-0016179b2dd5.html). I immediately upgraded my php to 5.2.1_1 but portaudit still complains that the vulnerability still exists: [root@myserver ~]# portaudit -a Affected package: php5-5.2.5_1 Type of problem: php -- integer overflow vulnerability. Reference: 1 problem(s) in your installed packages found. You are advised to update or deinstall the affected package(s) immediately. However, I cannot upgrade any further as 5.2.5_1 *is* the version that was supposed to fix this: [root@myserver ~]# portupgrade -nv php5 ---> Session started at: Thu, 01 May 2008 10:19:33 +0200 ** No need to upgrade 'php5-5.2.5_1' (>= php5-5.2.5_1). (specify -f to force) ---> ** Upgrade tasks 1: 0 done, 1 ignored, 0 skipped and 0 failed ---> Listing the results (+:done / -:ignored / *:skipped / !:failed) - lang/php5 (php5-5.2.5_1) ---> Packages processed: 0 done, 1 ignored, 0 skipped and 0 failed ---> Session ended at: Thu, 01 May 2008 10:19:36 +0200 (consumed 00:00:02) Looking closer at the information given in the above URL the vulnerability specifies that all "php5 >0" is affected, which to me means that all php5 versions until all eternity will be marked vulnerable, not only those <= 5.2.1. Can somebody please fix the CVE or tell me what I'm doing wrong? I don't want to get into the habit of ignoring portaudit reports as that's clearly *bad* practise. Gunther