portaudit provides a system to check if installed ports are listed in a
database of published security vulnerabilities.
After installation it will update this security database automatically and
include its reports in the output of the daily security run.
If you have found a vulnerability not listed in the database, please contact
the FreeBSD Security Officer <security-officer@FreeBSD.org>. Refer to
http://www.freebsd.org/security/#sec
for more information.
WWW: http://people.freebsd.org/~eik/portaudit/
Oliver Eikemeier <eik@FreeBSD.org>
Retire ports-mgmt/portaudit, it stopped working a month ago when pkg_tools
support was removed. Also retire three ports requiring it, and a few optionnal
dependencies.
With hat: portmgr
Noticed by: ak
Sponsored by: Absolight
Detect pkgNG. When pkgNG is present and there is packages managed by pkgNG,
give user a warning and run pkg audit -F instead.
PR: ports/185147
Submitted by: ohauer
Clean up the portaudit port
- let the ports-secteam maintain this port instead of secteam. This should
assign PRs to the appropriate place. [1]
- recent freebsd versions should use pkg audit instead of portaudit
- stagify
- remove mention of preference file format changes which changed in 2004
PR: ports/184004 (partial
Discussed with: simon (many months ago) [1]
Forgot to bump the version in the previous commit. Eventhough
this is a minor change, it's still new and should tell people
that they can upgrade to this version.
Hat: secteam
Add support for an alternative openssl location, for example when installed
via the Ports Collection.
PR: 166561
Submitted by: Eugene Grosbein <eugen@grosbein.pp.ru>
Portaudit 0.6.0:
Fix remote code execution which can occur with a specially crafted
audit file. The attacker would need to get the portaudit(1) to
download the bad audit database, e.g. by performing a man in the
middle attack.
Add signature verification of the portaudit database. The public key
is for the database generated for portaudit.FreeBSD.org is included
in the distribution.
(This parts add the portaudit public key missed in initial commit.)
Submitted by: Michael Gmelin <freebsd@grem.de>
Reported by: Michael Gmelin <freebsd@grem.de>, Joerg Scheinert
Security: Remote code execution
Security:
http://vuxml.FreeBSD.org/6d329b64-6bbb-11e1-9166-001e4f0fb9b1.html
Feature safe: yes
With hat: so
Portaudit 0.6.0:
Fix remote code execution which can occur with a specially crafted
audit file. The attacker would need to get the portaudit(1) to
download the bad audit database, e.g. by performing a man in the
middle attack.
Add signature verification of the portaudit database. The public key
is for the database generated for portaudit.FreeBSD.org is included
in the distribution.
Submitted by: Michael Gmelin <freebsd@grem.de>
Reported by: Michael Gmelin <freebsd@grem.de>, Joerg Scheinert
Security: Remote code execution
Security:
http://vuxml.FreeBSD.org/6d329b64-6bbb-11e1-9166-001e4f0fb9b1.html
Feature safe: yes
With hat: so
Add some improvements via Doug:
This patch changes the order in which the conf file is read vs.
when the default variable assignments are made in order to provide
the ability to override them in the conf file. It also adds the
ability to include a conf file in the same directory as the script.
The patch also changes some of the = assignments to := where
having a null setting by mistake would be fatal.
The use case for these changes is the ability to "package" all
of the elements together in one place for use on multiple systems
that can all mount the same central location.
PR: 154518
Submitted by: dougb
Hat: secteam
Feature safe: yes
Don't enclose URLs in <>, it makes them harder to copy&paste and URLs are
not email addresses.
PR: ports/127214 (first half)
Reviewed by: simon
Feature safe: yes
Download portaudit database from http://portaudit.FreeBSD.org/ instead
of http://www.FreeBSD.org/ports/portaudit/.
This is primarily done to work around bug in lighttpd on www.FreeBSD.org
where If-Modified-Since isn't handled correctly possibly resulting in
users behind web proxies getting an outdated version of the portaudit
database.
Bump portaudit version number.
Big thanks to the reporter for the detailed PR with good information
about reproducing the issue.
PR: www/134505
Reported by: Christian Ullrich <chris@chrullrich.net>
Prodding by: remko, Christian Ullrich
- Fix portaudit -Fq to actually be quiet. [1]
- Remove support for FreeBSD older than 4.11 and 5.3.
- Remove conditional dependency on bzip2 which I can't really see how
could be activated automatically.
Reported by: "J. Martin Petersen" <jmp@alvorlig.dk> [1]
PR: ports/117845 [1]
With hat: maintainer / secteam
