From owner-freebsd-ports-bugs@FreeBSD.ORG Fri Jul 29 16:50:20 2005 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C5E4916A41F for ; Fri, 29 Jul 2005 16:50:20 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3227943D48 for ; Fri, 29 Jul 2005 16:50:20 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j6TGoKgc030132 for ; Fri, 29 Jul 2005 16:50:20 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j6TGoJRf030131; Fri, 29 Jul 2005 16:50:19 GMT (envelope-from gnats) Resent-Date: Fri, 29 Jul 2005 16:50:19 GMT Resent-Message-Id: <200507291650.j6TGoJRf030131@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Dmitry A Grigorovich Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 75B0716A41F; Fri, 29 Jul 2005 16:46:23 +0000 (GMT) (envelope-from odip@bionet.nsc.ru) Received: from manticore.bionet.nsc.ru (manticore.bionet.nsc.ru [84.237.118.164]) by mx1.FreeBSD.org (Postfix) with ESMTP id D83AE43D48; Fri, 29 Jul 2005 16:46:22 +0000 (GMT) (envelope-from odip@bionet.nsc.ru) Received: by manticore.bionet.nsc.ru (Postfix, from userid 1001) id AA49A21720; Fri, 29 Jul 2005 23:46:19 +0700 (NOVST) Message-Id: <20050729164619.AA49A21720@manticore.bionet.nsc.ru> Date: Fri, 29 Jul 2005 23:46:19 +0700 (NOVST) From: Dmitry A Grigorovich To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: security@FreeBSD.org Subject: ports/84312: portaudit doesn't report about all security bugs X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2005 16:50:21 -0000 >Number: 84312 >Category: ports >Synopsis: portaudit doesn't report about all security bugs >Confidential: no >Severity: critical >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Jul 29 16:50:19 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Dmitry A Grigorovich >Release: FreeBSD 5.4-RELEASE-p2 i386 >Organization: ICiG SB RAS, Russia >Environment: System: FreeBSD manticore.bionet.nsc.ru 5.4-RELEASE-p2 FreeBSD 5.4-RELEASE-p2 #1: Wed Jul 27 19:15:09 NOVST 2005 root@manticore.bionet.nsc.ru:/usr/obj/usr/src/sys/ODIP i386 >Description: On the page http://www.vuxml.org/freebsd/651996e0-fe07-11d9-8329-000e0c2e438a.html reported that package apache+mod_ssl < 1.3.33+2.8.22_1 have security bug Also in /var/db/portaudit/ presented line: apache+mod_ssl<1.3.33+2.8.22_1|http://www.FreeBSD.org/ports/portaudit/651996e0-fe07-11d9-8329-000e0c2e438a.html|apache -- http request smuggling But port /usr/ports/www/apache13-modssl may install different packages: apache+mod_ssl-1.3.33+2.8.22 or apache+mod_ssl+mod_deflate-1.3.33+2.8.22 or some other. When I have installed apache+mod_ssl+mod_deflate-1.3.33+2.8.22 package then portaudit does not report about security bug !!! >How-To-Repeat: Update ports to current state cd /usr/ports/www/apache13-modssl Edit Makefile - remove PORTREVISION line This turn this port from current version apache+mod_ssl-1.3.33+2.8.22_1 to old version apache+mod_ssl-1.3.33+2.8.22 Try fetch apache+mod_ssl: root@manticore# make fetch ===> apache+mod_ssl-1.3.33+2.8.22 has known vulnerabilities: => apache -- http request smuggling. Reference: => Please update your ports tree and try again. *** Error code 1 Stop in /usr/ports/www/apache13-modssl. portaudit worked for apache+mod_ssl But try fetch apache+mod_ssl+mod_deflate: root@manticore# make WITH_APACHE_MODDEFLATE=yes fetch You may use the following build options: .... Ups - portaudit permit you install version with security bug !!! >Fix: I see two ways: 1) Add to portaudit all FLAVOURS ports of BASE port: E.g. when bug in mod_apache+mod_ssl also add mod_apache+mod_ssl+mod_deflate. This need some work for dependencies. 2) When checking security bugs in portaudit we need get name of BASE port: e.g. if we need checking mod_apache+mod_ssl+mod_deflate then we get BASE port as mod_apache+mod_ssl and check in portaudit this BASE port. >Release-Note: >Audit-Trail: >Unformatted: