From owner-freebsd-ports-bugs@FreeBSD.ORG Tue Nov 9 02:10:31 2004 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4AAF716A4CE for ; Tue, 9 Nov 2004 02:10:31 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1A58A43D58 for ; Tue, 9 Nov 2004 02:10:31 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) iA92AUS5024502 for ; Tue, 9 Nov 2004 02:10:30 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id iA92AUcW024500; Tue, 9 Nov 2004 02:10:30 GMT (envelope-from gnats) Resent-Date: Tue, 9 Nov 2004 02:10:30 GMT Resent-Message-Id: <200411090210.iA92AUcW024500@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, David Thiel Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5312716A4CE for ; Tue, 9 Nov 2004 02:09:51 +0000 (GMT) Received: from redundancy.redundancy.org (redundancy.redundancy.org [198.144.201.242]) by mx1.FreeBSD.org (Postfix) with SMTP id F293443D53 for ; Tue, 9 Nov 2004 02:09:50 +0000 (GMT) (envelope-from lx@redundancy.redundancy.org) Received: (qmail 99802 invoked by uid 1000); 9 Nov 2004 02:10:10 -0000 Message-Id: <20041109021010.99801.qmail@redundancy.redundancy.org> Date: 9 Nov 2004 02:10:10 -0000 From: David Thiel To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: ports/73699: Update: security/samhain 2.0.1 -> 2.0.2 (security update) X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: David Thiel List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Nov 2004 02:10:31 -0000 >Number: 73699 >Category: ports >Synopsis: Update: security/samhain 2.0.1 -> 2.0.2 (security update) >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Tue Nov 09 02:10:30 GMT 2004 >Closed-Date: >Last-Modified: >Originator: David Thiel >Release: FreeBSD 4.9-STABLE i386 >Organization: >Environment: System: FreeBSD redundancy.redundancy.org 4.9-STABLE FreeBSD 4.9-STABLE #15: Wed Nov 19 21:41:32 PST 2003 lx@redundancy.redundancy.org:/usr/obj/usr/src/sys/REDUNDANCY i386 >Description: Updating the Samhain integrity checking system to 2.0.2, a security bugfix release. All users are advised to upgrade. Changes: * A buffer overflow in the database update code has been fixed that was found during an internal code review. It can (only) be triggered if samhain is running in 'update' mode (command line option '-t update'), and may be exploitable by a local user, if this user controls a directory checked by samhain. Versions affected: samhain 1.8.9 - 2.0.1 (inclusive). * A segfault in the email code caused by an uninitialized variable has been fixed. * A segfault caused by a NULL pointer dereference has been fixed. >How-To-Repeat: >Fix: diff -ruN samhain.old/Makefile samhain/Makefile --- samhain.old/Makefile Mon Nov 8 11:31:33 2004 +++ samhain/Makefile Mon Nov 8 11:32:05 2004 @@ -17,7 +17,7 @@ # PORTNAME= samhain -PORTVERSION= 2.0.1 +PORTVERSION= 2.0.2 CATEGORIES= security MASTER_SITES= http://la-samhna.de/archive/ \ http://cold.darkambient.net/ diff -ruN samhain.old/distinfo samhain/distinfo --- samhain.old/distinfo Mon Nov 8 11:31:33 2004 +++ samhain/distinfo Mon Nov 8 11:32:37 2004 @@ -1,2 +1,2 @@ -MD5 (samhain_signed-2.0.1.tar.gz) = 604b242ff4069bb6b14913e1a862c102 -SIZE (samhain_signed-2.0.1.tar.gz) = 1024211 +MD5 (samhain_signed-2.0.2.tar.gz) = d7a5604a7cba939bf9c683784f501d0e +SIZE (samhain_signed-2.0.2.tar.gz) = 1024411 >Release-Note: >Audit-Trail: >Unformatted: