Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 11 Feb 2000 13:50:27 -0500 (EST)
From:      sk-ports@vegamuse.org
To:        FreeBSD-gnats-submit@freebsd.org
Subject:   ports/16655: security patch update for port: sysutils/wmmon
Message-ID:  <200002111850.NAA04596@gateway.va.vegamuse.org>

next in thread | raw e-mail | index | archive | help

>Number:         16655
>Category:       ports
>Synopsis:       Previous security patch was improperly merged
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Feb 11 12:20:08 PST 2000
>Closed-Date:
>Last-Modified:
>Originator:     Stephen Kiernan
>Release:        FreeBSD 4.0-19991202-CURRENT i386
>Organization:
>Environment:

N/A

>Description:

The last two security patches to prevent launching a program with group kmem
privledges were improperly merged, causing the port to stop working unless
launched by a user with group kmem privledges.

>How-To-Repeat:

Compile the port as-is, run as user without kmem privledges, watch kvm_openfile
fail.

>Fix:

Updated patch-ad file
(should replace current patch-ad file in sysutils/wmmon/patches)

--
begin 644 wmmon-patch-ad.tar.gz
M'XL(`(;RHC@``^P\_7/;.*[[J_:O8/)F4]E6_!FG2=UDMIND>YDV::=)V[W7
M9C2*1-NZR))&DNWDNOG?'T"0$B4K']VV=S=OSK,;220`@B`(@"38V,G<*4\[
M,3XW'>^G'_#K=;O;6UOL)X:_;N7)AL/A5I>QI]UA=[C]='NXS5BO/]CN_\2Z
M/X*9ZF^>9D["V$])%&7WP2VGG`?_"H;^M;]FL\F6LUD4MMUVE/@3XWS.V8ES
MPWJ[K+?]K#=XUMN&]]V=GS<W-Q6D\3+QV2%WV:`'8_6L.WPVV$*@W9^;Y1]^
ML_Z.-1@P\8DTX!.4`=XV?V;,.)@ZX82GS_!=EOW<8D:OW^GV.DB2F6<9CZ<\
M9*]\GH1.:+'T:C..DBS]=<$GSFR><N!\TD`TH\F((,LBEO`%3S)Z<P(&<(GO
M,2?TV"2)YK'O"0S&G''&$W:UF-E1S,.Q'_"4^2ES7#>:Q8&?3KG7EJ#F6YPF
M;)Q$,P9L+3A[QWT/.$K@\6O*G<TLVDRO;MHASP1#W6&GO_67^O$6:KB'W+],
M./_M[)!MM;M2-#TAFIUO)]EO]RTV(+H`\)N30GT4,C?R./4RFW(=FH%(4Q\@
MHC'0B:58+F]`[(F?9E'*_C>:!TYJD7A"]M$)`L?E%LI=0G^,@G'B@`#=:0AB
MXPF.?6^G`[*B7KT(L\@/.3N=!P%@+ITD_O4ZW0)*[3!H(#3P>G)TTCG[^.)M
MY_W;\^.3(^`ZN&'SV'.PBTL4RL)/_<N`2_CWJ1].V"2(+D$7<)"9QU,W\>,L
M2E)2$F_N<E%5J\9/^]9.KU#CG8'5Z^XJ/?X?/W2#.0CM^=@-LZ`]W2\5SD,0
MCD>E((6B@B=)&&%YBY40TINTLW3\K$H(RV,'I%=7D=W$/*UI!%2;FBB*`G_F
M9VFU-`(]#E""U0JD[D;AN*[<NP(+FJF:,;-MJ2^VTI7]/3;HXJ^$Z_&%ALA#
MSQ^OT(;_79)FM2;S9_R!-K=$FVQCHZ;Z.=4.5^@F,.'OYVDQFW$P&#6#]@?,
MRS\"_[(Z-EA^':\,&1;SZXR'R!'T=>K$HDMURM?K;EN]WM-"_7J#+:NW.U#Z
M]_+X]9'1',<VBG2D%P21XSF+R8B4`JU<9C3AX;$]=OK^]>L1E*99,G<S%F+?
MX>^G"ZC[@AWW^%A,1/O@]-PPA)GXPM9M4/%U=FN5('Y[__+L[8N#(Z.GH"[G
MXS2&N;\">O#6QBEK]'-ZL8WCN0+XXL/1N_>GQD#!.3!\\S!T8%8KV(<5+J=V
M_LH^/3YE\K<%=>J'M+,K._3#%180Z<W[<X(SAJP&*YKGTN!!RDOHAX!^^.[X
MPY&QI3KA`8J7^(O5[@+PQ\,S8ZA!+KTTIYUK8UV7I4+K/?YP8J.!?'U\=FYL
M*YKITD&?5AT_`7MX].'<>%I`P@RM@3M%HL:.`@N18BT4D#-V-3`@MPIW>'+R
MX@^CEZN6-YLYU]4N8PV4P=LMJJL?9D:<^O_DQ<?4'V?X%43AQ&BZ\T0*KR@#
MIY1IA8A&PR`^W:F3&&",06<_V6_?G!W_T;=?'Y\>V<#=!4T1)_-=1&/8X7@"
M[@1FR6:OOA)T(J^%F==ILO$\=#.<Z*S9@9)%!+'(/'4FW,37QDB5Q0F0D:-:
MJ3I,G.49-)6:V%+3P@8K?VJ`;3]Z`%XJ%0V*9Q;*93?8GW]JY:<\HV(2H.CL
M#$(%4\B8-1.>.0O'#ZSB>PRD&J-\,%$2&GTD7Y!%R0AQB0Z(6-.&2"V#UDW!
M,(X2F$!B6H+-'#\4_7.2B:M`X'WQZ:(!1JS6F`[!=@YWM9!TT+7Z6[T\*#5N
M\>^MC$7]L0EDN7NE1J4!LZW+1%3U1<0T8S%H``9.'I3(8M*WV:113`C`,/BU
MGYD]^KBEGAKE7E(?D'O11\%!;4C=&UC]P0[U`*@(%3=\9?S5MQ=P(:HU9@A_
M@`YAA%]"W8V,S^)/O?[.A<"ALF:L,'"&&`;X+?L/4.6NQ?#U[_@JQ2];@<`+
M6!<&7%7*FH2/ZXK!>XABV1"V-8X!9HSAM[G>B9/([<QCX1$LMIZL-T8$8\_X
MS`_'4156%E>`I>.K`LOB"C!*K@J)91J8D,F8F>,8]6H-ASUUG7`,!0#T2^`!
M[(8F##&")2'@P^Q2F\;8#:*4([51KFSP'$<),_V][HCYS\'VV&?G+\YML*3'
M!T=G4-9J8>-"9W>'UF`[#P`>H0)B0&?^Y:?^A6`!+2@$`P994BR@,`#97#B!
M<0DK8C5.]=KQXY5#\-O%>.3@_+7]ZNC=Z4B5]K`42^S?WKPYQX`B[Q54X",:
MFZH/)'0</I-B2A-(6`Q6/QL*!%X1R1)1D<6ZC;6]S5X#PD?$1'^?$VMG"SN%
MU>\:L-[`\;AOG,L2R*$V695:"V(6@7(KE2V679GP+`8_@5^F5%A4$G)Z)/UZ
M4"K>[^$+PK9:$G)_?Z_7$-Q!4`^&9T[C+REN[D&X.;J7`R5,C"/W]E!@#29C
MRM(ZVB19ZG_?V.\.WYR^_KO%R#@6(Z,3^\*4354F=;U$^!G[)?T<KA=$F#"N
M8CD%'TJ$X&T^\B<)9^D$7,45&(HV^QU\/BP4T=$NTC;Z'-E^RC.`,B?T@($5
MXPNLQ$`V2LQU`EB_I['C,5M2>W/<%IA@4]D43`NTET51I;4YM3:_J[7)_)[6
ME,24,9+?M@CB18T%H7P#8^&N@C%*@7XS#&(UF`;JE`D5:(C#8"0J-_=#.W1`
M68&U)Y^[3T98WVJQG)QPC1(0%Y]L;T\X1JI4;I&5QU`T_HR=W<PNHX`]^25]
MPL(H`],[#STQI%K+<@Z)*6$8\.>A>%]`R[B.%#><S]`;D]Y2@"Z`4%ZPU.E>
MM"7O:[J@#`J]A#8GW/%R@7[28GI$!4,Y!YMA4MS1V)!M6\H`R>^&Z@FU*QG<
MUULTBJ@5.'>=((A<LTH.C61!R]""VD?C7/Z3)Y&I898!69,IGA7*K9"<B,6I
M8'5@3Z+0SZ($MUA^\3#\\5WH']HI!Z+>A9_=M&EL-=)W+63TH:PT37J`@ZC$
MMA)ZZ3HF;0263'#-GL@9(WMV^]6.MS86V]JV^MN]/!;#`7YW_/O?SNT7!^?'
M;TX;+/$GT\QV1/B/KBE+O'E<AADIS)/CP\/71SGJS/?`@Z_@EJ&4KX1*-[XQ
M,:P#.71XYG9$>)FX,M")G23E=N*B"95@%']>\9LT)Q/3Q.'APES_VYN3(XE<
MHAX794Z6M]C^VN:,^]ENC_UK[CV>>8;$(.PFGXLS`L-V</C*`@`,QDZ#ISUK
ML-O-8Z=_WY"5.E4>LMJQ$1',Z@`)[R$])\X8N;Y^=X!AOSXPY"I@M93-E','
M_@((>B&J;2E#0'A8T*.90M8-<`!^1E9&$I!3"?G"ZA(;Z'!".3\S'"^)@^%R
MNBZYRW7)J(SPR@#3?`=S@77Y%%ZC*6S<+TVI27]-9>IF_=;.EK6UHZTAMV%)
MMMTOXO$TV]Q/,AL#<*`J'IL,"_$5K>](0:D""297Y!A.G$]YPI^DS(%@);H,
M^(QA`5OZV90)QY,R-XE2W-E&#(A1<;M^YES3^EL,\*63)#Y/V"5WHQG:YY!/
MG`P#$^!3(4%Y"K$I2.+2#Q"+SD32")P_Q<:7<UAA2_A+GE%M,!<Z'G+NB2WT
M2[&I[D]"[FG[9+3AH00B5UIBH2(E@J\EB:@"!7?W*.SN6L.M@;*]^;Z*.`80
M3>&:T10O,*"LF686T[_Z%+[G:V)M20Q%\Y`Z0^)$U0-L`.,>"F0\!I=E@=<%
ME?'4!`6@.Y>F%BO6L*2_RRD>1)ACF,VIM&G0>`E.C^]@JL)_RE*>\-FS]48Q
MU6@UJE4R6)36_;]N$88<G@U-5:W\"Z54@2,!;"@);.0BV"`9J#FJJSXL-=1J
MPBBI`*PR)'Y+27`%ID#N=#!R@4CL2IOW-3(Y6SKQW4(1M844L*_]<M?[>>-%
M9_IW]J9?QVK!:&DGZ?8._4R7<4D_[U9(J6`IYU=FH2`6KO_.CHY>V6='Y]]!
MJ[Y:@G?HSE<IPX/2*P38:7[?WV>@^6<3_:E@!>R-[Z9&^8<V[$^`^_R=V^Z0
MYQ@,K)V=I\IS?),1*ULL.<'TX.$_><7^U]:T#RSDM+WYL0^*+K9?;"\*Y<Z3
M7)5!M8=[''YHT4LTST8Y";%JE@=_L+:?%<MFBLCJEHD'I^=U"T3`SA=<\-YH
M[.WI7W*_25K=6L+JI*V.>FZ2U?X7?6NMY"7:RK,<JR`C[86-0K!=6)6CFU9H
M'0KZT'$+H*6?2*`&>_Z<J8.8,EWI\@E#K`<5X1**PA(V*3]C>5Y:(QMRD/2Q
MDX5TY%*4WJH7?;E8HB`[6K2U69SMU'5';Z>,BV6;VME/'7;.CWY^5.%@5(&A
MMJI-585ERB[M=\5YC:G85-\5O=_;Z^J#;^2G.(]QAU6_A^L'S4%N,KUVM>^K
M4["G[S(8TN1_B]O\KY7[>BMWKZ%3:O8=C=R7_\[U?_]<?R!P6[7?67F>?^,T
MUY;O:VI7^X'<!E@'-.$/:^8GSV*+L<A/NQ;I?0-X^BFL?&4VFU@^3S#E#'=(
MH0RQ,0PF6LO$A_5LB%ELK_@"ANJU,^4W[/G5+/@UB:ZNG*MY&]:C[8G3GJ?[
M;8'4D?S21HMQ]N'%.W/A)`W@_NS\W?'I[^(+U_"P+`8>70Z&('9$J@]A*]17
MOQ^=F[YW;3&!0;_/*!>LZ5'5!M3E$PKA(.17338JQ"0*1.L0!LS22:-"LH]V
M!$"T>5O`5FCU3<?SDCN(U=@$<VZ+362!UB`\L3<%?[](-"/AV3P)&9Z0L:_Y
M(;;\W5;X?`<RK.7T>S&J=;NT)4W_?4TN!("+Z8@X\Q37T0),;8C?E\KV\UI^
M1HO=P1;Q!9^EPPVRPE/H+4]&JJUIP,'HBVP=\0"_"3X`LVUR$!\*?"@-::$?
MQOC43X8I)0C<[5*4TAHCB-PKVM5KQCP!`-HZ$?)E<9;H!$1V'4/.!,.,W76<
MT^]7.BPPIU["5`*3)"`,_DH+S2J4.D%8A9(<ZB-J""MC@&DXP"@5/"%:&7$L
MQV8\Q:2=M$UG?9A:[$[%MIM(J;0D8II%,=9YN..&IB:9.6*O3"35BI%3AR28
M&$M(4M_P?*;-SJ=@PF+,88:1`>8@N$C9DTO'8ZBR\/%$8N4<T7>'NIF'`TLG
M"9$)M<!6$T*5/R_B")Q98+$<AAN*8.05"-'$6D1<D\7*K<C/S4V9UU")C\C<
MKY]'$9O-051"C+A`T254$DB[C6=%T@W1.5P:<!Z;`RI3!D"\D,S4:;LH+AC"
MWGC<A59`25P:2VB9<Q0HIC"KI*S"H#]B"N*AISQ24HY$%."6F)R.%NM9>!)*
MB4(J7:0N<M2(L#'8`>X5?5_M&SYSRP)#JIZRV?95NK2S*',"FH/H_\J56#12
M5'!ZUR&#=U=PN4T1;DIE_TD[4H3(:_1]5T=/(QIAD0Y*3&,.YT,]U=H\//J@
MK!;!J#J1/R@-65'3,[7D1PQOI#DH@E)9`*9_/4^)U)-$EB+N*YN]ACSZ(#YP
MEA,QL".XG-ZCLP\(PY1RFF00D10Y@3LI$*!&11RBDSA50@#A*I'ER61*[;5^
M8R(G]!I,F^HP$^_K,J>S$%3?)*"EDFZY5X#2+'"82G,09A%S&HI15:D-H50J
MBLUG?);R3(I![%3>V?/[':#F#\AF8SPJQZV=!%-;&7NU^2G!Y'F8TF*M4HR^
MK,W/ES&K">R2Q2ZC+(M@#1/RZ\P6+NZQ_$FQRO9A%-#;%7JG^1^E>P"V7LE.
M*&B0UCY,I%#@DB?#WH"H$!W$9$,5:0_U3ZO!6U#%8H-&L;6'=SQ$JI*`EL>!
M`H)<)/J?LV)F@\=*@1.A&LX,-1X=(UX<\"?S!(R1YZ=7Y*@`4Q%X"6[51],<
M<&<AHW/E#"Q!02PG:([+>$/A@F9KED6<5^775B06-$E4<"R)B,(F6@4&0HB;
M*D`)%PXB:X=LG82M\GXN'#\T@\X$94:,_"/R0_#LWC_@`Y?D6$,$+(7I3T+*
MEZ">@HSGF!R!D84,+99.*&XO78'O8UGBN%=:KS,,#_3``N:1)&5A#E(0L'_,
M,=9R,`4I4IC002`$H1YP/$]2'BQXWJ>.&ELY2W#L.U+J$!E+)9`E^:*RF"%H
MYLQ<52141S?-PI8!DY_,*K%?I&&X`*4C2)UP4W*A-%$=%"@E7@55QP<M]L@V
M$=!8U?:62HZ^=]HC<F&7U)1"KD;:K0""$=I2!Z1RW6^I48/B=SKJOQ2I=QL4
MPV_D(3>E$D/,#E!Y(71PV.N+&A4>4"1/5KFE4EW$)_,A1"$QY$DN+9DB<$U1
M_36M`H@IG/<M4J7#*'P"1HCC?3-6')V(6#D&8^)3MCLH$T1]0@W#*%/(-SQC
MEQP6W6([6-S96OB.F,M1:.XTY(4[2@C'UVN5K;#\Y%^T(5()+X.KE/*JKV7O
MY$#[%U0LPQ_"W"SZ`:HEY-%JT1=)J24ABVQ<.H,79]XBLT_<,,/=C+QWT*V4
MN@%>#JU%J0\X#YF'4I(T\)Q<')-'8&P2.L87`5?:)@CL;4U\UV$TG%K,1@9:
M5<B>$O0F5=)(8[8$^/&1,$'2#]^9CK]Z=RJ7/\#Y8360#B,9S;/(=<&:R`[(
M^!O$RR2V7-@PS--OF*;I17,(_QJ"[0Y3G\0^WG7JMKN8?-)M#XLT>$'I_]WY
M7Z4`O]EP:V@-AULJJ4%L?9?9D_NL,):8)*EV&/Q4O7GY&V[6R:UQ1DG;_DAM
M$522'4114[L?T,RB*QYB8N$Z^YQ!L"ZJQD'D9,:X2-D&6XH^UH_V\MQO8(6,
MC;@HN;-K[>QNJ^/-'](=P0C=#OLTN"B*Y,6R3P=OWV,^W]'9Q>/XKAV6X;8U
MW.WG>7Y->5R68XN%$,1FH3N+S;PSZVX\7[?8(-^&S0_P18;%ZNG]?<?W8G^V
M="90/KS'MK3]WIC2NV`<)0"-:+[#"[.ZUVX/++:%RP[:"E8VB\(/+%N3H;UA
ME)(D![G#D)N^6FMTI%)IS8"!1#/K9%%@YDE?^:;Q0^A*WF5T;1^Y<NFCG(A3
MNO8A9"E+U'4,=9=#E6.2VA@S'.1)D%0.F21K]M`ZLG'Y\L8=&N!WHEP#:`WU
M0Y4`M=I._&A=G`C4U"VQ[FNU9*M>"[:^60N8U`)6.?T3/4/@?99/U4;Q"LTT
MO307_RW9FMT=J]?K]O,LO+\Z2?_C#Q%73A$?=XSXT#GB/>D,=&FW[K1/6ME\
M?2J_M5._O*1(;[@[OX%N_=8U1!8^;X<^M694@7[B53=MS2+D$"ZC>P%AR,NS
M@Q>OCQKY_1:C4/4B5,X=257M27(^BA,D=7R(Z;-2TY43\B^*D[5;C3_2T,)5
M">P"]K9L)Y7!^SJS<_>UX?RB]/=4^M8/4/I61>E;CU'ZUOU*WRJ4_HZ;'A\/
MSVHTL;BJD5]I*+:TZ+[%WIZZB-$LE6O-KB[$Y(5D?26FV\RBV7R10YK18J47
M^:3';7D)6IP,5'Y^B,>@7KY*5*!J$Q2_<)<:?I2L>S\,\#K*EY+UOQ!SK%=N
MZ=R/,XDRB26Y%(%A/2@/>2(V1QYD9#ZSY8:3G<;<]<>^+HC[$5,><#?#[?+'
MPN*Z^"%H\'/I-%K*OO8>Q<F,_BTG?03%L*C;R*)>0#<+4/5O0.C0((B"528B
M<_E=0A"3H>;7;.9"5&)]:*R(NET>,CGE3;:F=)/^)1LY,>@B$]L`32M<SSQI
MJ.O6.0"J:PT$`<%WVY.WBDU-!%B2[]=7=EYE?=$2MO!-5&18J%C.F:KN^>HX
M.D+!P/T8A+0R/,BUNEPOF57B(H.G7[<P\FUJZ?VJ_<UFVKW"[QI)K9"C0N6%
MO]+#2"S=S^@^MNBG;*"JM/_7SK'L-A$#S_L72R4B@I:2I4D*;<4%N"'U0#E5
MU8J0@+:0A[J)H(?^.YX9VS/V.H^MD#@P<TG6'C_6\_+.V$.Q26\X<F$Y*->(
ML!S`I<>48Z3PMI]9TE9YNG8<ZO+S56JLY6:]=3`\N=1]M-8VT/</';=V@ES&
M+/O@>8,N%#'O6H3Y;`X7PIS@)@7\22R[`=-AEY--<^_N70.F?V9>MCMIHV&<
M7>GU\F=@D-`:X=`Y[2;,C^4V-D$<#H$^7'E?R@9K-#L+G.^+MU+3D1_=]BEP
MK%&4LA3HPH#W28/::;/"-LLGC53P"';(TP_HWFNIX2*7_\7<7'Q&-L=7*')K
M6PIIDPS]8IT3-DU9X")__\E\$G_\\.ZJ(ET@K&+0O,SWB&Y220F6(],4\%#6
M_*K-W-O<X.XW^[W_5_"*EF<L:8>1@C\=<.TCNJ2($;8XD#+[:1-B;B?4+E*%
M.!'=PDI)1$<YCY'4[W*Q'ZOEDXH^DU]BS#-RO+^N]'?J_>X#'J+ZVT-*[=]M
MS.T&(.M@`S)I!C*T!%:/MZQ!UL$@9"V;X#KR]8>8!@!QV<S`=/;MR^;G^BQ=
M+5Y%U;!?"K+NS.1NM;@$+@$B/4($4<2&O=VCN*$CBH(^!8HLB[<++.UWL^]U
M`R?^\*@\G]%&\T!.(PC%+QJX#%.M9G>0NF7I3E5$B#\FB.'PS;I-4DTVE1EL
M/*S6%`RL)O=K//B`#WXP5T!QWN1XR,74^18$;"OF`"=E>8YT95U*B^P15GXY
M7VW6LVJ&&6Y"R2GR2+("O8[91:9TE!]^+XA+X3\D%'%HK.5Q_<$UPC)T/5W<
M'*^631W/DC)TV;DUF""-%&$H)-?3^D9J*Y`TUC:[T.0RQ#U(FB6KF(+IEN)8
M"-?%K!,W3;!@C!,P6US9YH2X=8LO\GZ4WD7:9.N@2K(HF]B'V-E//CSO>"KY
MV(;_]A>^!_KZIZ!V4"X.4#PB<)`,]KTY+<:#D;A8#@P9Y`:@!#$NHF.36+@K
M28:1T-WHHPN#,(N&Q"L]'GALMZ*]\FAF!D<^>X&-K9^<^R!(60Y.B[(L1^)&
MZ?[9+_9,O\A'?FHMW/`5=J*&KT&HJ3=)465\\KH8#T4NZ;(<0L!GQ/FDG8>,
M,I51FK*I3:GP\GGF$M<<V>,D3Z=H'_$?[AKIS(LIZI_;O`6K^K?9&:(T@)2C
M-XXREN')NII8"5VYMQ`3N[TPK<T/N7#_=7YO!04%!04%!04%!04%!04%!04%
3!04%!04%A?\+_@#:?07#`'@``,T/
`
end


>Release-Note:
>Audit-Trail:
>Unformatted:


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200002111850.NAA04596>