On 25/07/2010 19:06:30, ajtiM wrote:> Hi!
> portaudit -a shows:
>
> Affected package: mDNSResponder-214
> Type of problem: mDNSResponder -- corrupted stack crash when parsing bad
> resolv.conf.
> Reference:
>
<http://portaudit.FreeBSD.org/1cd87e2a-81e3-11df-81d8-00262d5ed8ee.html>
>
> Affected package: opera-10.10.20091120_2
> Type of problem: opera -- Data URIs can be used to allow cross-site
scripting.
> Reference:
>
<http://portaudit.FreeBSD.org/77b9f9bc-7fdf-11df-8a8d-0008743bf21a.html>
>
> Affected package: linux-f10-pango-1.22.3_1
> Type of problem: pango -- integer overflow.
> Reference: <http://portaudit.FreeBSD.org/4b172278-3f46-11de-
> becb-001cc0377035.html>
>
> 3 problem(s) in your installed packages found.
>
> You are advised to update or deinstall the affected package(s) immediately.
>
> Do I need to deinstall those ports or is safe anyway?
No, it's not in any way "safe" to ignore what portaudit tells you.
However that does not mean that you necessarily have to delete the
referenced packages.
What you need to do is read the referenced vuXML data, look at the
reports referenced therein and decide if:
a) The vulnerability affects you, given your usage patterns. For
instance, you might be running a server where all users also have
root access, in which case, you don't need to worry about
privilege escalation attacks from logged in users.
b) The vulnerability affects you, but you can mitigate or prevent
any attack. Eg. you can cause a vulnerable daemon to bind only
to the loopback interface, or apply strict firewall rules to
prevent attacks over the network.
c) The software in question is mission critical, and removing it
would have a worse effect on you than some possible exploit.
If the software fails all of the above, then yes, you should certainly
remove it. Otherwise, you need to keep an eye out for any updates or
fixes and apply them ASAP.
In the particular case of linux-f10-pango -- this is a long standing
vulnerability with no real prospect of a software patch becoming
available. Unfortunately that port is a vital part of the linuxulator,
so a lot of people are keeping it installed under case (c).
mDNSResponse can be fixed by a very simple patch, and exploiting the bug
depends on being able to control the contents of /etc/resolv.conf, which
pretty much implies the attacker would already have root access to your
machine. Keep an eye out for when the update hits the ports and apply
it as soon as possible.
The opera bug is more severe. Your vulnerability to it depends on your
usage patterns with that browser. It looks like the opera devs are on
the case, but in the mean time it might be an idea to switch to using an
alternate browser temporarily.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
JID: matthew@infracaninophile.co.uk Kent, CT11 9PW
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 267 bytes
Desc: OpenPGP digital signature
Url :
http://lists.freebsd.org/pipermail/freebsd-security/attachments/20100725/d8e0cdd2/signature.pgp