From owner-freebsd-ports@FreeBSD.ORG Fri Oct 13 18:24:58 2006 Return-Path: X-Original-To: freebsd-ports@freebsd.org Delivered-To: freebsd-ports@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2068316A47C for ; Fri, 13 Oct 2006 18:24:58 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from smtpout.mac.com (smtpout.mac.com [17.250.248.186]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6EA9F43D8A for ; Fri, 13 Oct 2006 18:22:45 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from mac.com (smtpin05-en2 [10.13.10.150]) by smtpout.mac.com (Xserve/8.12.11/smtpout16/MantshX 4.0) with ESMTP id k9DIMfi0017053; Fri, 13 Oct 2006 11:22:41 -0700 (PDT) Received: from [17.214.13.96] (a17-214-13-96.apple.com [17.214.13.96]) (authenticated bits=0) by mac.com (Xserve/smtpin05/MantshX 4.0) with ESMTP id k9DIMc4v013775; Fri, 13 Oct 2006 11:22:40 -0700 (PDT) In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <992A886C-590E-4EFA-A2CB-B3FE26D7E102@mac.com> Content-Transfer-Encoding: 7bit From: Chuck Swiger Date: Fri, 13 Oct 2006 11:22:38 -0700 To: Bill Blue X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAA== X-Brightmail-scanned: yes Cc: "freebsd-ports@freebsd.org" Subject: Re: php5-5.1.6 & 5.1.6_1 X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Oct 2006 18:24:58 -0000 On Oct 13, 2006, at 10:43 AM, Bill Blue wrote: > It took some massaging, but I was finally able to get all the ports > re-compiled except one, that in the subject line. > > php5-5.1.6 refuses to build because of Known Vulnerabilities: php > -- _ecalloc integer overflow vulnerability, > > php5-5.1.6_1 refuses to build also because of Known > Vulnerabilities: php -- open_basedir race condition vulnerabilities. > > Any suggestions? 1) Install PHP anyway, knowing that it contains known, exploitable vulnerabilities, via: cd /usr/ports/lang/php5 && DISABLE_VULNERABILITIES=yes make install Be aware that people are actively exploiting PHP-based apps using this hole right now. Be prepared to reinstall your machine completely from scratch after it gets hacked. 2) Live without PHP and anything which uses it. I recommend choosing option #2, where possible, otherwise restricting the use of PHP to machines which do not contain confidential or important data, and are kept in your network's DMZ or similiar "semi- trusted" subnet, rather than on your internal LAN. -- -Chuck