From owner-svn-ports-all@FreeBSD.ORG Tue Oct 1 23:47:14 2013 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id DC509930; Tue, 1 Oct 2013 23:47:14 +0000 (UTC) (envelope-from jase@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id C7E2724C3; Tue, 1 Oct 2013 23:47:14 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r91NlE4g007770; Tue, 1 Oct 2013 23:47:14 GMT (envelope-from jase@svn.freebsd.org) Received: (from jase@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r91NlEdY007756; Tue, 1 Oct 2013 23:47:14 GMT (envelope-from jase@svn.freebsd.org) Message-Id: <201310012347.r91NlEdY007756@svn.freebsd.org> From: Jase Thew Date: Tue, 1 Oct 2013 23:47:14 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r329009 - in head/security: polarssl vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Oct 2013 23:47:14 -0000 Author: jase Date: Tue Oct 1 23:47:13 2013 New Revision: 329009 URL: http://svnweb.freebsd.org/changeset/ports/329009 Log: - Update to 1.2.9 - Add vuxml entry - Prevent install target from copying patch backup files Changes: https://raw.github.com/polarssl/polarssl/60ad84f43f46b0d3673eaca8b9847d7e01b83c5e/ChangeLog Security: ccefac3e-2aed-11e3-af10-000c29789cb5 Security: CVE-2013-5915 Modified: head/security/polarssl/Makefile head/security/polarssl/distinfo head/security/vuxml/vuln.xml Modified: head/security/polarssl/Makefile ============================================================================== --- head/security/polarssl/Makefile Tue Oct 1 23:24:09 2013 (r329008) +++ head/security/polarssl/Makefile Tue Oct 1 23:47:13 2013 (r329009) @@ -1,9 +1,8 @@ # $FreeBSD$ PORTNAME= polarssl -PORTVERSION= 1.2.8 +PORTVERSION= 1.2.9 DISTVERSIONSUFFIX= -gpl -PORTREVISION= 1 CATEGORIES= security devel MASTER_SITES= http://polarssl.org/download/ EXTRACT_SUFX= .tgz @@ -32,7 +31,7 @@ BINFILES= aescrypt2 benchmark dh_client # cmake install is broken, so we do it by hand do-install: - @${TAR} -C ${WRKSRC}/include -cf - polarssl | ${TAR} -C ${STAGEDIR}${PREFIX}/include -xf - + @cd ${WRKSRC}/include && ${COPYTREE_SHARE} ${PORTNAME} ${STAGEDIR}${PREFIX}/include "! -name *.orig" ${INSTALL_DATA} ${WRKSRC}/library/libpolarssl.a ${STAGEDIR}${PREFIX}/lib/ ${INSTALL_DATA} ${WRKSRC}/library/libpolarssl.so ${STAGEDIR}${PREFIX}/lib/libpolarssl.so.0 cd ${STAGEDIR}${PREFIX}/lib/ && ${LN} -sf libpolarssl.so.0 libpolarssl.so Modified: head/security/polarssl/distinfo ============================================================================== --- head/security/polarssl/distinfo Tue Oct 1 23:24:09 2013 (r329008) +++ head/security/polarssl/distinfo Tue Oct 1 23:47:13 2013 (r329009) @@ -1,2 +1,2 @@ -SHA256 (polarssl-1.2.8-gpl.tgz) = 23cf931e322ab397d26c89b7e805cf2229df46c5196f4f67ebfc0e285848637b -SIZE (polarssl-1.2.8-gpl.tgz) = 998609 +SHA256 (polarssl-1.2.9-gpl.tgz) = d125a6e7eb6eb3e5110035df1469099c5463837b1ef734e60771095dafc0ef56 +SIZE (polarssl-1.2.9-gpl.tgz) = 999668 Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Oct 1 23:24:09 2013 (r329008) +++ head/security/vuxml/vuln.xml Tue Oct 1 23:47:13 2013 (r329009) @@ -51,6 +51,46 @@ Note: Please add new entries to the beg --> + + polarssl -- Timing attack against protected RSA-CRT implementation + + + polarssl + 1.2.9 + + + + +

PolarSSL Project reports:

+
+

The researchers Cyril Arnaud and Pierre-Alain Fouque + investigated the PolarSSL RSA implementation and discovered + a bias in the implementation of the Montgomery multiplication + that we used. For which they then show that it can be used to + mount an attack on the RSA key. Although their test attack is + done on a local system, there seems to be enough indication + that this can properly be performed from a remote system as + well.

+

All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected + if a third party can send arbitrary handshake messages to your + server.

+

If correctly executed, this attack reveals the entire private + RSA key after a large number of attack messages (> 600.000 on + a local machine) are sent to show the timing differences.

+
+ + + + CVE-2013-5915 + https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 + https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released + + + 2013-10-01 + 2013-10-02 + + + chromium -- multiple vulnerabilities