Date: Thu, 27 Nov 2008 23:23:46 +0300 (MSK) From: Eygene Ryabinkin <rea-fbsd@codelabs.ru> To: FreeBSD-gnats-submit@freebsd.org Cc: freebsd-vuxml@freebsd.org Subject: [vuxml] eliminate false-positive for samba due to the entry in old portaudit.xml Message-ID: <20081127202346.3BCEEF181F@phoenix.codelabs.ru>
next in thread | raw e-mail | index | archive | help
>Submitter-Id: current-users >Originator: Eygene Ryabinkin >Organization: Code Labs >Confidential: no >Synopsis: [vuxml] eliminate false-positive for samba due to the entry in old portaudit.xml >Severity: serious >Priority: medium >Category: ports >Class: sw-bug >Release: FreeBSD 7.1-PRERELEASE i386 >Environment: System: FreeBSD 7.1-PRERELEASE i386 >Description: Samba version specification that is found in the old portaudit.xml file inside ports-mgmt/portaudit-db/databases has improper entry that cathes modern Samba port: ----- $ pkg_version -T samba-3.2.4 'samba>=3.*<3.0.5,1' && echo Found! Found! ----- >How-To-Repeat: Run the above command or do 'cd /usr/ports/net/samba32-devel; make check-vulnerable', it should produce something like this: ----- ===> samba-3.2.4 has known vulnerabilities: => Multiple Potential Buffer Overruns in Samba. Reference: <http://www.FreeBSD.org/ports/portaudit/2de14f7a-dad9-11d8-b59a-00061bc2ad93.html>; => Please update your ports tree and try again. *** Error code 1 ----- >Fix: The following patch fixes the things, at least for me: --- portaudit.xml-fix-old-VuXML-entries-for-samba.diff begins here --- >From 601cd8355609580f914c27e15c25bbee25219f6d Mon Sep 17 00:00:00 2001 From: Eygene Ryabinkin <rea-fbsd@codelabs.ru> Date: Thu, 27 Nov 2008 23:04:40 +0300 Very old portaudit.xml in ports-mgmt/portaudit-db/database has 4 years old entry for samba that renders current port, net/samba32-devel to be marked as vulnerable. This happens due to the bad version specification that spans over port epoches, thus caching samba32-devel that has no portepoch: ----- $ pkg_version -T samba-3.2.4 'samba>=3.*<3.0.5,1' && echo Found! Found! ----- Applied modification fixes the things, ----- $ pkg_version -T samba-3.2.4 'samba>=3.*<3.0a20' && echo Found! $ pkg_version -T samba-3.2.4 'samba>=3.0.0.b1,1<3.0.5,1' && echo Found! ----- and seem to catch originally intended versions properly: ----- $ pkg_version -T samba-3.0a19 'samba>=3.*<3.0a20' && echo Found! Found! $ pkg_version -T samba-3.0a19 'samba>=3.0.0.b1,1<3.0.5,1' && echo Found! $ pkg_version -T samba-3.0.1,1 'samba>=3.0.0.b1,1<3.0.5,1' && echo Found! Found! $ pkg_version -T samba-3.0.1,1 'samba>=3.*<3.0a20' && echo Found! ----- Samba revision history was traced by using CVS logs, http://www.freebsd.org/cgi/cvsweb.cgi/ports/net/samba3/Makefile Particularily, portepoch was bumped at the Makefile's version 1.92: http://www.freebsd.org/cgi/cvsweb.cgi/ports/net/samba3/Makefile.diff?r1=1.91;r2=1.92 Note well: the added port specification will catch version 3.0.20, for example, ----- $ pkg_version -T samba-3.0.20 'samba>=3.*<3.0a20' && echo Found! Found! ----- but FreeBSD's 3.0.20 is be named '3.0.20,1', so we seem to be safe here, since this particular specification will catch only 3.0.x: ----- $ pkg_version -T samba-3.1.32 'samba>=3.*<3.0a20' && echo Found! ----- Signed-off-by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> --- ports-mgmt/portaudit-db/database/portaudit.xml | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/ports-mgmt/portaudit-db/database/portaudit.xml b/ports-mgmt/portaudit-db/database/portaudit.xml index 168072a..bcae088 100644 --- a/ports-mgmt/portaudit-db/database/portaudit.xml +++ b/ports-mgmt/portaudit-db/database/portaudit.xml @@ -287,7 +287,8 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. <affects> <package> <name>samba</name> - <range><ge>3.*</ge><lt>3.0.5,1</lt></range> + <range><ge>3.0.0.b1,1</ge><lt>3.0.5,1</lt></range> + <range><ge>3.*</ge><le>3.0a20</le></range> <range><lt>2.2.10</lt></range> </package> <package> -- 1.6.0.4 --- portaudit.xml-fix-old-VuXML-entries-for-samba.diff ends here ---
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20081127202346.3BCEEF181F>