From owner-freebsd-questions@FreeBSD.ORG Sat Apr 14 13:53:10 2007 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 68B6216A402 for ; Sat, 14 Apr 2007 13:53:10 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from smtp.infracaninophile.co.uk (ns0.infracaninophile.co.uk [81.187.76.162]) by mx1.freebsd.org (Postfix) with ESMTP id CD21513C480 for ; Sat, 14 Apr 2007 13:53:09 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from [IPv6:::1] (localhost.infracaninophile.co.uk [IPv6:::1]) by smtp.infracaninophile.co.uk (8.14.1/8.14.1) with ESMTP id l3EDqskj040641; Sat, 14 Apr 2007 14:52:54 +0100 (BST) (envelope-from m.seaman@infracaninophile.co.uk) Authentication-Results: smtp.infracaninophile.co.uk from=m.seaman@infracaninophile.co.uk; sender-id=permerror; spf=permerror X-SenderID: Sendmail Sender-ID Filter v0.2.14 smtp.infracaninophile.co.uk l3EDqskj040641 Message-ID: <4620DCB0.8080306@infracaninophile.co.uk> Date: Sat, 14 Apr 2007 14:52:48 +0100 From: Matthew Seaman Organization: Infracaninophile User-Agent: Thunderbird 1.5.0.10 (X11/20070320) MIME-Version: 1.0 To: Steinar Bormer References: <3jzvefz87sl.fsf@buri.ifi.uio.no> In-Reply-To: <3jzvefz87sl.fsf@buri.ifi.uio.no> X-Enigmail-Version: 0.94.0.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------enigDDCF590989D05676AE90F046" X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (smtp.infracaninophile.co.uk [IPv6:::1]); Sat, 14 Apr 2007 14:53:04 +0100 (BST) X-Virus-Scanned: ClamAV version 0.90.2, clamav-milter version 0.90.2 on happy-idiot-talk.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, DKIM_POLICY_TESTING, DK_POLICY_SIGNSOME,NO_RELAYS autolearn=ham version=3.1.8 X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on happy-idiot-talk.infracaninophile.co.uk Cc: questions@freebsd.org Subject: Re: astro/google-earth X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Apr 2007 13:53:10 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigDDCF590989D05676AE90F046 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable Steinar Bormer wrote: > Greetings, >=20 >=20 > On 2007-04-13 astro/google-earth was updated. See: >=20 > >=20 >=20 > The Makefile now says nothing about FORBIDDEN, but 'make' still gives > the following output: >=20 > ,---- > | # make > | =3D=3D=3D> google-earth-4.0.2735 has known vulnerabilities: > | =3D> google-earth -- heap overflow in the KML engine. > | Reference: > | =3D> Please update your ports tree and try again. > | *** Error code 1 > |=20 > | Stop in /usr/ports/astro/google-earth. > `---- >=20 > Needless to say I've updated the ports tree twice today, and Makefile, > distinfo and pkg-plist have been updated. You question boils down to: why does the ports system still think Google Earth v. 4.0.2735 is still vulnerable when portaudit and VuXML say that only versions earlier than 4.0.2414 are vulnerable? Ports certainly shouldn't do that given this: happy-idiot-talk:~:% pkg_version -t 4.0.2414 4.0.2735 < Looks like a bug to me. =20 > What I really don't understand is where this message quoted above is > coming from. It's not included in any of the four files in > /usr/ports/astro/google-earth, so it must be stored somewhere else. An= y > pointers on how to proceed from here are appreciated. >=20 This message comes from portaudit(1). There's a steaming great clue to that effect in the URL you quote. A good thing to try is downloading a new portaudit database: portaudit -F Then retry the update. Perhaps there was an error in the version numberi= ng in the version of the portaudit database you had originally, which has si= nce been fixed. This would have fixed it for me, if I had Google Earth insta= lled: happy-idiot-talk:...ports/astro/google-earth:% portaudit -C Affected package: google-earth-4.0.2735 Type of problem: google-earth -- heap overflow in the KML engine. Reference: happy-idiot-talk:...ports/astro/google-earth:% sudo portaudit -F=20 Password: auditfile.tbz 100% of 41 kB 49 kBps New database installed. happy-idiot-talk:...ports/astro/google-earth:% portaudit -C If you absolutely have to upgrade straight away and cannot, for some unimaginable reason, download a fresh portaudit database, then you can define the somewhat misnamed 'DISABLE_VUNERABILITIES' variable in your make environment. It doesn't disable any vulnerabilities per se -- much as we might desire that it should -- rather it disables all the warnings and lock-outs of installing ports with known vulnerabilities. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW --------------enigDDCF590989D05676AE90F046 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.3 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGINy28Mjk52CukIwRCDK/AJ9ODSMNdyd4gkhWv1rZLr7DVo7tLQCcD2xl sbXhxD9BvZrgpHsHjf13s/o= =2Qze -----END PGP SIGNATURE----- --------------enigDDCF590989D05676AE90F046--