From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Aug 31 19:20:04 2009 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C10A510656C7 for ; Mon, 31 Aug 2009 19:20:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 9B09C8FC1F for ; Mon, 31 Aug 2009 19:20:04 +0000 (UTC) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n7VJK4Qp069672 for ; Mon, 31 Aug 2009 19:20:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n7VJK4nT069671; Mon, 31 Aug 2009 19:20:04 GMT (envelope-from gnats) Resent-Date: Mon, 31 Aug 2009 19:20:04 GMT Resent-Message-Id: <200908311920.n7VJK4nT069671@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Matthias Andree Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4071D1065670 for ; Mon, 31 Aug 2009 19:12:15 +0000 (UTC) (envelope-from matthias.andree@gmx.de) Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by mx1.freebsd.org (Postfix) with SMTP id 9F9218FC1E for ; Mon, 31 Aug 2009 19:12:14 +0000 (UTC) Received: (qmail invoked by alias); 31 Aug 2009 19:12:13 -0000 Received: from g229215065.adsl.alicedsl.de (EHLO mandree.no-ip.org) [92.229.215.65] by mail.gmx.net (mp063) with SMTP; 31 Aug 2009 21:12:13 +0200 Received: from rho.emma.line.org (vmfreebsd [192.168.0.6]) by merlin.emma.line.org (Postfix) with ESMTP id 8BD8894DAF; Mon, 31 Aug 2009 21:12:11 +0200 (CEST) Received: by rho.emma.line.org (Postfix, from userid 500) id E8CA933E77; Mon, 31 Aug 2009 21:12:10 +0200 (CEST) Message-Id: <20090831191210.E8CA933E77@rho.emma.line.org> Date: Mon, 31 Aug 2009 21:12:10 +0200 (CEST) From: Matthias Andree To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: secteam@FreeBSD.org Subject: ports/138418: [PATCH] security/vuxml: add dns/dnsmasq entries CVE-2009-2957 and CVE-2009-2958 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Aug 2009 19:20:04 -0000 >Number: 138418 >Category: ports >Synopsis: [PATCH] security/vuxml: add dns/dnsmasq entries CVE-2009-2957 and CVE-2009-2958 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Mon Aug 31 19:20:04 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Matthias Andree >Release: FreeBSD 7.2-RELEASE-p2 i386 >Organization: >Environment: System: FreeBSD rho.emma.line.org 7.2-RELEASE-p2 FreeBSD 7.2-RELEASE-p2 #0: Wed Jun 24 00:57:44 UTC 2009 >Description: Add entry for dns/dnsmasq CVE-2009-2957 and CVE-2009-2958, TFTP DoS and unprivileged code injection (this was handled as one update by the upstream so it should be safe to merge them). Port maintainer (secteam@FreeBSD.org) is cc'd. Generated with FreeBSD Port Tools 0.77 >How-To-Repeat: >Fix: --- vuxml-1.1_1.patch begins here --- Index: vuln.xml =================================================================== RCS file: /home/ncvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.2015 diff -u -u -r1.2015 vuln.xml --- vuln.xml 25 Aug 2009 08:20:28 -0000 1.2015 +++ vuln.xml 31 Aug 2009 19:10:41 -0000 @@ -34,6 +34,44 @@ --> + + dnsmasq -- TFTP server remote code injection vulnerability + + + dnsmasq + 2.50 + + + + +

Simon Kelley reports:

+
+

+ Fix security problem which allowed any host permitted to + do TFTP to possibly compromise dnsmasq by remote buffer + overflow when TFTP enabled. Thanks to Core Security + Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro + Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and + Pablo Annetta. This problem has Bugtraq id: 36121 + and CVE: 2009-2957

+

+ Fix a problem which allowed a malicious TFTP client to + crash dnsmasq. Thanks to Steve Grubb at Red Hat for + spotting this. This problem has Bugtraq id: 36120 and + CVE: 2009-2958

+
+ + + + 2009-2957 + 2009-2958 + + + 2009-08-23 + 2009-08-31 + + + apache22 -- several vulnerability --- vuxml-1.1_1.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: