From owner-svn-ports-all@FreeBSD.ORG Thu Nov 1 14:10:56 2012 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 27E40E1B; Thu, 1 Nov 2012 14:10:56 +0000 (UTC) (envelope-from flo@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 105BB8FC08; Thu, 1 Nov 2012 14:10:56 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id qA1EAtNa007648; Thu, 1 Nov 2012 14:10:55 GMT (envelope-from flo@svn.freebsd.org) Received: (from flo@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id qA1EAt7V007643; Thu, 1 Nov 2012 14:10:55 GMT (envelope-from flo@svn.freebsd.org) Message-Id: <201211011410.qA1EAt7V007643@svn.freebsd.org> From: Florian Smeets Date: Thu, 1 Nov 2012 14:10:55 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r306803 - in head: security/vuxml www/rt38 X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Nov 2012 14:10:56 -0000 Author: flo Date: Thu Nov 1 14:10:55 2012 New Revision: 306803 URL: http://svn.freebsd.org/changeset/ports/306803 Log: Update to 3.8.15 Security: 4b738d54-2427-11e2-9817-c8600054b392 Feature safe: yes Modified: head/security/vuxml/vuln.xml head/www/rt38/Makefile head/www/rt38/distinfo (contents, props changed) head/www/rt38/pkg-plist (contents, props changed) Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Nov 1 13:55:03 2012 (r306802) +++ head/security/vuxml/vuln.xml Thu Nov 1 14:10:55 2012 (r306803) @@ -51,6 +51,65 @@ Note: Please add new entries to the beg --> + + RT -- Multiple Vulnerabilities + + + rt40 + 4.04.0.8 + + + rt38 + 3.8.15 + + + + +

BestPractical report:

+
All versions of RT are vulnerable to an email header injection + attack. Users with ModifySelf or AdminUser can cause RT to add + arbitrary headers or content to outgoing mail. Depending on the + scrips that are configured, this may be be leveraged for information + leakage or phishing.
+
RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability + due to lack of proper rights checking, allowing any privileged user + to create Articles in any class.
+
All versions of RT with cross-site-request forgery (CSRF) + protection (RT 3.8.12 and above, RT 4.0.6 and above, and any + instances running the security patches released 2012-05-22) contain + a vulnerability which incorrectly allows though CSRF requests which + toggle ticket bookmarks.
+
All versions of RT are vulnerable to a confused deputy attack on + the user. While not strictly a CSRF attack, users who are not logged + in who are tricked into following a malicious link may, after + supplying their credentials, be subject to an attack which leverages + their credentials to modify arbitrary state. While users who were + logged in would have observed the CSRF protection page, users who + were not logged in receive no such warning due to the intervening + login process. RT has been extended to notify users of pending + actions during the login process.
+
RT 3.8.0 and above are susceptible to a number of vulnerabilities + concerning improper signing or encryption of messages using GnuPG; + if GnuPG is not enabled, none of the following affect you.
+

+ + + + CVE-2012-4730 + CVE-2012-4731 + CVE-2012-4732 + CVE-2012-4734 + CVE-2012-4735 + CVE-2012-4884 + http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html + + + 2012-10-26 + 2012-11-01 + + + drupal7 -- multiple vulnerabilities Modified: head/www/rt38/Makefile ============================================================================== --- head/www/rt38/Makefile Thu Nov 1 13:55:03 2012 (r306802) +++ head/www/rt38/Makefile Thu Nov 1 14:10:55 2012 (r306803) @@ -8,7 +8,7 @@ # o install a sample into etc/apache22/Includes PORTNAME= rt -PORTVERSION= 3.8.14 +PORTVERSION= 3.8.15 CATEGORIES= www MASTER_SITES= http://download.bestpractical.com/pub/rt/release/ \ ftp://ftp.eu.uu.net/pub/unix/ticketing/rt/release/ Modified: head/www/rt38/distinfo ============================================================================== --- head/www/rt38/distinfo Thu Nov 1 13:55:03 2012 (r306802) +++ head/www/rt38/distinfo Thu Nov 1 14:10:55 2012 (r306803) @@ -1,2 +1,2 @@ -SHA256 (rt-3.8.14.tar.gz) = 59c892a08746cf83fdfdf0ef4584d929983e22b5f5d17980b7541ac028933509 -SIZE (rt-3.8.14.tar.gz) = 5593322 +SHA256 (rt-3.8.15.tar.gz) = fca1283189bd670fde7a041e99e85aa4a58e0e302bb1f3c7ddab2f4997b5da55 +SIZE (rt-3.8.15.tar.gz) = 5650409 Modified: head/www/rt38/pkg-plist ============================================================================== --- head/www/rt38/pkg-plist Thu Nov 1 13:55:03 2012 (r306802) +++ head/www/rt38/pkg-plist Thu Nov 1 14:10:55 2012 (r306803) @@ -463,6 +463,7 @@ share/rt38/html/Elements/HeaderJavascrip share/rt38/html/Elements/ListActions share/rt38/html/Elements/ListMenu share/rt38/html/Elements/Login +share/rt38/html/Elements/LoginRedirectWarning share/rt38/html/Elements/Logo share/rt38/html/Elements/Logout share/rt38/html/Elements/MakeClicky