From owner-freebsd-security@FreeBSD.ORG Sat May 23 15:55:03 2015 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id CD9D0ECF; Sat, 23 May 2015 15:55:03 +0000 (UTC) Received: from mail-la0-x22e.google.com (mail-la0-x22e.google.com [IPv6:2a00:1450:4010:c03::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 5539A1E95; Sat, 23 May 2015 15:55:03 +0000 (UTC) Received: by lagv1 with SMTP id v1so29101701lag.3; Sat, 23 May 2015 08:55:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=NHDUzGpxEYeL3mWNsUyGKvbuwzArfC2Yfwy8K8WW+qM=; b=v9nCtPov8k0QndYvAbn2thDOmYaoIXwc8oim1JX5m1Yk7ky2cKmUpwenEfVtS25i2X fpl3AQN4mR/F4L6wQaX9cxKNBEsKEkFIdGthDEmihT6BsCxnGhus/bpahhgXciIyRpHJ FgtGRdsK0gjoS5uXIvm2QoWqYOrlW1bsk9Eaj+ooyYBoJYmmxJ1sgzl9IQ1R+032oOdO EsnE1ePtGIxJT5B3cAwOQmuzuMS2GfCBScZG8UkPDY4LKwEM7Ty1F+0eyOl7qYvZFyAQ fmUbUsyp0fc40e6+r1hAnK4bWj8DC5H1NQVqWJldkcVRArmbVU0oqEKRMUDxp7nkMN4Y jQPg== MIME-Version: 1.0 X-Received: by 10.112.199.133 with SMTP id jk5mr11208326lbc.32.1432396500079; Sat, 23 May 2015 08:55:00 -0700 (PDT) Received: by 10.112.201.10 with HTTP; Sat, 23 May 2015 08:55:00 -0700 (PDT) In-Reply-To: <20150523153029.F1BBE2AA@hub.freebsd.org> References: <20150523153029.F1BBE2AA@hub.freebsd.org> Date: Sat, 23 May 2015 17:55:00 +0200 Message-ID: Subject: Re: New pkg audit / vuln.xml failures (php55, unzoo) From: Andreas Andersson To: Roger Marquis Cc: freebsd-security@freebsd.org, freebsd-ports@freebsd.org X-Mailman-Approved-At: Sat, 23 May 2015 16:41:08 +0000 Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 May 2015 15:55:04 -0000 Is it enough to only update php55? I could create a patch with relative easyness in that case. 2015-05-23 17:30 GMT+02:00 Roger Marquis : > FYI regarding these new and significant failures of FreeBSD security > policy and procedures. > > PHP55 vulnerabilities announced over a week ago > ) have still > not been ported to lang/php55. You can, however, edit the Makefile, > increment the PORTVERSION from 5.5.24 to 5.5.25, and 'make makesum > deinstall reinstall clean' to secure a server without waiting for the > port to be updated. Older versions of PHP may also have unpatched > vulnerabilities that are not noted in the vuln.xml database. > > New CVEs for unzoo (and likely zoo as well) have not yet shown up in 'pkg > audit -F' or vuln.xml. Run 'pkg remove unzoo zoo' at your earliest > convenience if you have these installed. > > HEADS-UP: anyone maintaining public-facing FreeBSD servers who is > depending on 'pkg audit' to report whether a server is secure it should > be noted that this method is no longer reliable. > > If you find a vulnerability such as a new CVE or mailing list > announcement please send it to the port maintainer and > as quickly as possible. They are whoefully > understaffed and need our help. Though freebsd.org indicates that > security alerts should be sent to this is > incorrect. If the vulnerability is in a port or package send an alert to > ports-secteam@ and NOT secteam@ as the secteam will generally not reply > to your email or forward the alerts to ports-secteam. > > Roger > > Does anyone know what's going on with vuln.xml updates? Over the last >> few weeks and months CVEs and application mailing lists have announced >> vulnerabilities for several ports that in some cases only showed up in >> vuln.xml after several days and in other cases are still not listed >> (despite email to the security team). >> > _______________________________________________ > freebsd-ports@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ports > To unsubscribe, send any mail to "freebsd-ports-unsubscribe@freebsd.org" >