Date: Mon, 29 Mar 2010 00:48:36 +0200 From: Frank Bartels <knarf@knarf.de> To: java@freebsd.org, secteam@freebsd.org Subject: portaudit prevents installation of linux-sun-jdk16 Message-ID: <20100328224836.GA49926@server-king.de>
index | next in thread | raw e-mail
[-- Attachment #1 --] Hi java@freebsd.org & secteam@FreeBSD.org, I think this is both a java and a portaudit issue. I've just learnt I have to use at least Java 6 Update 10 for Firefox 3.6: http://www.java.com/en/download/faq/firefox_newplugin.xml So had a look at the versions of /usr/ports/java/*jdk16* on my FreeBSD machine. linux-sun-jdk-1.6.0.18 seems to be the only port in the tree that meets the requirements. But if I try to make it, portaudit prevents the build: ===> linux-sun-jdk-1.6.0.18 has known vulnerabilities: => jdk -- jar directory traversal vulnerability. Reference: <http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a .html> But if I have a look at the reference URL, 1.6 does not seem to be affected. I did a portaudit -F in order to make sure my database is up to date. So is this a false positive that should get fixed? There was a PR on this in 2007: http://www.freebsd.org/cgi/query-pr.cgi?pr=115558&cat= The reason for this PR to get closed was it was reproducable with linux-sun-jdk-1.6.0.02. http://freebsd.monkey.org/freebsd-java/200708/msg00101.html My open questions: 1. Is linux-sun-jdk-1.6.0.18 still vulnerable? Sorry, I don't have a bad.jar, but I'm willing to test. 2. Shouldn't http://portaudit.freebsd.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html get updated in order to make clear at least linux-sun-jdk-1.6.0.02 was vulnerable? 3. Why does portaudit think it's vulnerable even if the auditfile does not seem to contain a matching entry for linux-sun-jdk-1.6.0.18? $ grep 18e5428f-ae7c-11d9-837d-000e0c2e438a auditfile jdk<=1.2.2p11_3|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability jdk>=1.3.*<=1.3.1p9_4|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability jdk>=1.4.*<=1.4.2p7|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability jdk>=1.5.*<=1.5.0p1_1|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability linux-ibm-jdk<=1.4.2_1|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability linux-sun-jdk<=1.4.2.08_1|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability linux-sun-jdk>=1.5.*<=1.5.2.02,2|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability linux-blackdown-jdk<=1.4.2_2|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability diablo-jdk<=1.3.1.0_1|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability diablo-jdk-freebsd6<=i386.1.5.0.07.00|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability linux-jdk>=0|http://portaudit.FreeBSD.org/18e5428f-ae7c-11d9-837d-000e0c2e438a.html|jdk -- jar directory traversal vulnerability Thanks for listening, Knarf [-- Attachment #2 --] 0 *H 01 0 + 0 *H 0(0V0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CA0 090728000001Z 100728235959Z01 0 UDE10 UBayern10UMunchen1-0+U $StartCom Verified Certificate Member10U Frank Bartels1 0 *H knarf@knarf.de0"0 *H 0 X)(2.Enޙdn/oq BMЖ]:_NxL)kΚL[au6c'L8` ݄ 9)6͒t[ ]̍,F7:n45GL_Icm#;#o'ț9W8A 6dp~=Dr7$|$4ZH?z?.%)<"44">3B$Ĉ1*3;zo 00 U 0 0 U 0 U %0++0 U xCTT*M"c0U 0knarf@knarf.de0U #0Uo1ʹ k1 㬻0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0GU >0:06 +7 0%0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0+00 StartCom Ltd.0Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at http://www.startssl.com/policy.pdf0cU \0Z0+)'%http://www.startssl.com/crtu2-crl.crl0+)'%http://crl.startssl.com/crtu2-crl.crl0+009+0-http://ocsp.startssl.com/sub/class2/client/ca0B+06http://www.startssl.com/certs/sub.class2.client.ca.crt0#U 0http://www.startssl.com/0 *H ^U/}re @忎wN`v[ R(d J_6 E 4.=5ѧk x$ZSnБc_sEY/|x A)pFLdd<=vEx cs ) fQVj\5M 0aX%*6:#J7yG=0xN_o GHC$XA_+Mߤwo\)dq4o/Zs9saf7$>l00ʠ0 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 071024210254Z 121022210254Z01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CA0"0 *H 0 (E,3* U]"gFSݤ>}m w鞆 FA7~ |-ql"/Q?Vp `G&viĜ73 {B'87ds N fz 1%TII|2o/mD \ t :08VGqǴ3Rp}JTzF;&X}rD Q 6 [0W0 U 00 U 0 U Uo1ʹ k1 㬻0U #0N @[i04hCA0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 U 0 0=+10/0-+0!http://www.startssl.com/sfsca.crt0`U Y0W0,*(&http://cert.startcom.org/sfsca-crl.crl0'%#!http://crl.startssl.com/sfsca.crl0]U T0P0L +70;0/+#http://cert.startcom.org/policy.pdf05+)http://cert.startcom.org/intermediate.pdf0+00' Start Commercial (StartCom) Ltd.0Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at http://cert.startcom.org/policy.pdf0 `HB 0P `HB CAStartCom Class 2 Primary Intermediate Free SSL Email Certificates0 *H y/7MWYӻ|=jOx;ԥmGE^= <O)D O Ÿq :rDӾkf V-Fa2~y8g$$~#, !f|L1Qgr01@(Bsx)2IiIH'`fiGVI Fc}]jE6>_U 7) L\W,P$$&{ؕvYL#<d :q9C-`>^,ݐ/|x]@0U_% Pqnq:@VOqI^?H33DQA8Tk~W%79xJӉԥa3ӌ I2t$`ΜX/qȻkO>B(M> JI#K%8|P/!6,uCêgǍz =7 ClArMU',5Mvw<Zʪy/1o0k001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 2 Primary Intermediate Client CAV0 + 0 *H 1 *H 0 *H 1 100328224836Z0# *H 1v!;`8w=z =$I0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H - vO~U eݿ"VfzuIQ(1Կ qt+ "*rnK73=o UŋiחfnAﱚ#r\j c ӤL38# JwQ= HB#b dC@ #jH3yτ Cn f||Rl+Euy8Am${j >hg¢wK/KGH:zCBElmlVz=help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100328224836.GA49926>