pkgsrc/net, branch pkgsrc_2004Q4

Pullup ticket 357 - requested by Lubomir Sedlacik

2005-03-14T21:35:41Z

security fix for ethereal Revisions pulled up: - pkgsrc/net/ethereal/Makefile 1.104,1.105 - pkgsrc/net/ethereal/PLIST 1.20 - pkgsrc/net/ethereal/distinfo 1.36 - pkgsrc/net/ethereal/patches/patch-aa removed - pkgsrc/net/ethereal/patches/patch-ab removed Module Name: pkgsrc Committed By: salo Date: Mon Mar 14 15:09:28 UTC 2005 Modified Files: pkgsrc/net/ethereal: Makefile PLIST distinfo Removed Files: pkgsrc/net/ethereal/patches: patch-aa patch-ab Log Message: Update to version 0.10.10 This release fixes three security and stability-related issues: - Matevz Pustisek discovered a buffer overflow in the Etheric dissector. (CAN-2005-0704) - The GPRS-LLC dissector could crash if the "ignore cipher bit" option was enabled. (CAN-2005-0705) - Diego Giago discovered a buffer overflow in the 3GPP2 A11 dissector. This flaw was later reported by Leon Juranic. (CAN-2005-0699) - Leon Juranic discovered a buffer overflow in the IAPP dissector. - A bug in the JXTA dissector could make Ethereal crash. - A bug in the sFlow dissector could make Ethereal crash. Everyone is encouraged to upgrade. New and updated features: ========================= - Tree view item context menus now let you browse to the display filter reference and wiki pages for a particular protocol. - Online help has been expanded. - VoIP call analysis (including nifty connection diagrams) has been added. - GSS-API decryption has been greatly enhanced. New protocol support: ===================== AgentX, BUDB, DTP, G.723, IDP, INAP, KINK, Realplayer Data Protocol, Retix Spanning Tree Protocol, RTCP-XR, XML, XNS, SPP Updated protocol support: ========================= 3GPP2 A11, ACSE, AMR, ATM, BER, BSSGP, BUTC, CDP, CLNP, CoSine L2, DAAP, DCE/RPC, DCOM, DIAMETER, DNP, DNS, Etheric, FCP, FW-1, Gnutella, GPRS, GSM A, GSM MAP, H.225, H.245, H.248, H.450, HTTP, IAX2, ICQ, IEEE 802.11, IEEE 802.3 Slow Protocols, IP, iSCSI, ISUP, Juniper, JXTA, Kerberos, L2TP, LDAP, MIP, MPLS, NDMP, NSIP, NTP, OSPF, OXID, PostgreSQL, RADIUS, RDT, Redback, RMCP, RTP, RTSP, SCSI, SCTP, SDP, SPNEGO, SSL, STUN, TCAP, TCP, TZSP New and updated capture file support: ===================================== DBS Etherwatch, Lucent/Ascend, Nettl, Tcpdump (Redback) --- Module Name: pkgsrc Committed By: tron Date: Mon Mar 14 15:34:57 UTC 2005 Modified Files: pkgsrc/net/ethereal: Makefile Log Message: Remove unnecessary "post-patch" target".

Remove RIPEMD-160 checksum which sneaked in.

2005-03-14T15:26:50Z

Pullup ticket 347 - requested by Matthias Scheler

2005-03-10T12:07:17Z

security fix for ethereal Revisions pulled up: - pkgsrc/net/ethereal/Makefile 1.103 - pkgsrc/net/ethereal/distinfo 1.33, 1.35 - pkgsrc/net/ethereal/patches/patch-aa 1.11 - pkgsrc/net/ethereal/patches/patch-ab 1.3 Module Name: pkgsrc Committed By: salo Date: Mon Jan 31 22:53:54 UTC 2005 Modified Files: pkgsrc/net/ethereal: distinfo Added Files: pkgsrc/net/ethereal/patches: patch-aa Log Message: Remove attributes in prototype for unnamed pointers. ethereal svn version is laready fixed. From PR pkg/29065 by Greg A. Woods. --- Module Name: pkgsrc Committed By: tron Date: Thu Mar 10 10:05:33 UTC 2005 Modified Files: pkgsrc/net/ethereal: Makefile distinfo Added Files: pkgsrc/net/ethereal/patches: patch-ab Log Message: Fix security vulernability in dissector for CDMA2000 A11 packets. Bump package revision.

Backout misimport.

2005-03-04T07:58:04Z

Please pay more attention to where are you committing stuff.

stopgap to make building on amd64 possible (hopefully, as untested due

2005-03-04T07:09:45Z

to lack of one :). Will need to be revisited.

Pullup ticket 326 - requested by Matthias Scheler

2005-03-02T22:15:42Z

security fix for gftp Revisions pulled up: - pkgsrc/net/gftp/DESCR 1.3 - pkgsrc/net/gftp/Makefile.common 1.8 - pkgsrc/net/gftp/PLIST 1.9 - pkgsrc/net/gftp/distinfo 1.8-1.9 - pkgsrc/net/gftp/patches/patch-aa 1.3 - pkgsrc/net/gftp/patches/patch-ab 1.5 - pkgsrc/net/gftp/patches/patch-ac 1.1 - pkgsrc/net/gftp/patches/patch-ad 1.1 - pkgsrc/net/gftp-gtk1/DESCR 1.2 - pkgsrc/net/gftp-gtk1/Makefile 1.7 Module Name: pkgsrc Committed By: tron Date: Wed Mar 2 14:36:53 UTC 2005 Modified Files: pkgsrc/net/gftp: DESCR Makefile.common PLIST distinfo pkgsrc/net/gftp-gtk1: DESCR Added Files: pkgsrc/net/gftp/patches: patch-aa patch-ab Log Message: Update "gftp" and "gftp-gtk1" package to version 2.0.18. Changes since version 2.0.17: - Added support for the FSP protocol (http://fsp.sourceforge.net/) - SSH2: Fixed segfault that could occur when renaming a file (bug introduced in 2.0.18rc1) - SSH2: Fixes for parsing the directory listing from the commercial SSH server - FTP: added pasv_behind_router option. If this is enabled, then the IP address that is in the PASV response will be ignored. Instead the IP address of the remote host will be used - FTP: removed the quote filename functionality in the SITE CHMOD and SITE UTIME commands - Chmod: Fixes for setting the group execute bit (bug introduced in 2.0.18rc1) - Fixes so that the text port will prompt you for your password when a URL is entered on the command line - In the text port, convert the string from UTF8 to the users' current locale before it is displayed - Fixes for when the host system does not have getaddrinfo() (bug introduced in 2.0.18rc1) - Rewrote and improved the URL parser so that the :, @ characters are allowed in directories and passwords - Security Fix: Ignore the file paths that are returned by the remote server - FreeBSD and HP/UX fixes - GNOME HIG fixes - Many other small changes and improvements. See the ChangeLog file in the distribution for a detailed list of changes. - Updated language translations (cs de en_CA en_GB es hu nl zh_CN) --- Module Name: pkgsrc Committed By: tron Date: Wed Mar 2 20:43:21 UTC 2005 Modified Files: pkgsrc/net/gftp: distinfo pkgsrc/net/gftp-gtk1: Makefile Added Files: pkgsrc/net/gftp/patches: patch-ac patch-ad Log Message: Fix build problems in "gftp-gtk1" package caused by update to version 2.0.18.

Pullup ticket 324 - requested by Thomas Klausner

2005-03-01T20:47:50Z

security fix for wu-ftpd Revisions pulled up: - pkgsrc/net/wu-ftpd/Makefile 1.26 - pkgsrc/net/wu-ftpd/distinfo 1.13 - pkgsrc/net/wu-ftpd/patches/patch-ak 1.4 Module Name: pkgsrc Committed By: wiz Date: Tue Mar 1 16:06:37 UTC 2005 Modified Files: pkgsrc/net/wu-ftpd: Makefile distinfo Added Files: pkgsrc/net/wu-ftpd/patches: patch-ak Log Message: Apply patch from Rainer Schoepf in http://marc.theaimsgroup.com/?l=bugtraq&m=110960890901497&w=2 to fix http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities Bump PKGREVISION.

Pullup ticket 296 - requested by Lubomir Sedlacik

2005-02-19T21:38:04Z

security fix for tcpdump Revisions pulled up: - pkgsrc/net/tcpdump/Makefile 1.13 - pkgsrc/net/tcpdump/distinfo 1.5 - pkgsrc/net/tcpdump/patches/patch-aa removed - pkgsrc/net/tcpdump/patches/patch-ab removed Module Name: pkgsrc Committed By: reed Date: Tue Jan 25 18:55:43 UTC 2005 Modified Files: pkgsrc/net/tcpdump: Makefile distinfo Removed Files: pkgsrc/net/tcpdump/patches: patch-aa patch-ab Log Message: Update to tcpdump-3.8.3 (as prompted by Chris Ross on tech-pkg list). Changes include: Fixes for print-isakmp.c CVE: CAN-2004-0183, CAN-2004-0184 http://www.rapid7.com/advisories/R7-0017.html IP-over-IEEE1394 printing. some MINGW32 changes. updates for autoconf 2.5 fixes for print-aodv.c - check for too short packets formatting changes to print-ascii for hex output. check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c, print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c, print-ip.c, print-lwres.c, print-ospf.c, print-pim.c, print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c print-ether.c - better handling of unknown types. print-isoclns.c - additional decoding of types. print-llc.c - strings for LLC names added. print-pfloc.c - various enhancements print-radius.c - better decoding to strings. changed syntax of -E argument so that multiple SAs can be decrypted fixes for Digital Unix headers and Documentation __attribute__ fixes CDP changes from Terry Kennedy . IPv6 mobility updates from Kazushi Sugyo Fixes for ASN.1 decoder for 2.100.3 forms. Added a count of packets received and processed to clarify numbers. Incorporated WinDUMP patches for Win32 builds. PPPoE payload length headers. Fixes for HP C compiler builds. Use new pcap_breakloop() and pcap_findalldevs() if we can. BGP output split into multiple lines. Fixes to 802.11 decoding. Fixes to PIM decoder. SuperH is a CPU that can't handle unaligned access. Many fixes for unaligned access work. Fixes to Frame-Relay decoder for Q.933/922 frames. Clarified when Solaris can do captures as non-root. Added tests/ subdir for examples/regression tests. New -U flag. -flush stdout after every packet New -A flag -print ascii only support for decoding IS-IS inside Cisco HDLC Frames more verbosity for tftp decoder mDNS decoder new BFD decoder cross compilation patches RFC 3561 AODV support. UDP/TCP pseudo-checksum properly for source-route options. sanitized all files to modified BSD license Add support for RFC 2625 IP-over-Fibre Channel. fixes for DECnet support. Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI. RFC 2684 encapsulation of BPDUs. This is a security fix update.

Pullup ticket 267 - requested by Adrian Portelli

2005-02-04T08:02:37Z

security fix for snort Revisions pulled up: - pkgsrc/net/snort/Makefile.common 1.17 - pkgsrc/net/snort/PLIST 1.18 - pkgsrc/net/snort/distinfo 1.24 - pkgsrc/net/snort-mysql/Makefile 1.12 - pkgsrc/net/snort-contrib/DESCR removed - pkgsrc/net/snort-contrib/Makefile removed - pkgsrc/net/snort-contrib/PLIST removed - pkgsrc/net/snort-contrib/distinfo removed Module Name: pkgsrc Committed By: adrianp Date: Fri Jan 28 23:02:41 UTC 2005 Modified Files: pkgsrc/net/snort: Makefile Makefile.common PLIST Log Message: Update to snort 2.3.0 2005-01-25 - Snort 2.3.0 Final Released * Fixed issue with sfPortscan reporting incorrect IP datagram length. Thanks Jon Hart for the test case and finding the bug, and Marc Norton for resolving the issue. * Threshold/Suppression now prints properly when logging to syslog. Thanks Sekure for pointing out the problem. Thanks Steve Sturges for working on the fix. * Threshold memcap argument now correctly handles non-integer input. Thanks nnposter for the patch. * Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were not decoded properly. Thanks Dan Roelker for the fix. * Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your work on putting it all together. 2004-12-15 - Snort 2.3.0 RC2 Released * Small performance improvement to arpspoof and also fixed a problem where the list of configured IP/MAC entries would contain only one entry and leaked memory (Jeff Nathan). * Fixed a problem affecting MacOS X where linking may fail with non-standard libraries when global symbols are encountered multiple times (Jeff Nathan). * Ignore RST|ACK midstream pickup case so we don't get an evasive TCP alerts. Thanks for the report, Sekure. Thanks Dan Roelker for the fix. * Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the logdir config will work if the default or command-line logdir does not exist on the system. Thanks Dan Roelker. * Fixed bug when setting the doe_ptr on a successful pcre match. It is now set relative to base_ptr. Thanks Steve Sturges for the fix. * Added from_beginning and multiplier options for byte_jump. from_beginning skips bytes from the beginning of the content, instead of from the location immediately following the number of bytes to skip. multiplier takes a numeric argument, and skips x times that number of bytes. Thanks again to Steve Sturges. * In "fast" output, now log only actual packet contents when UDP data length is greater than actual data length. Thanks Brian Caswell for spotting this, and Andrew Mullican for working on the fix. * Please check the ChangeLog for further details. 2004-11-18 - Snort 2.3.0 RC1 Released * Added IPS functionality from Snort-Inline. A big thanks to the Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor Julien). Also, Thanks Dan Roelker for doing the integrating of Snort-Inline into the official Snort project. * Added new portscan detector. The design and implementation was headed up by Dan Roelker, and included Marc Norton and Jeremy Hewlett. * Numerous changes for better 64bit Snort support from Jeremy Hewlett and Marc Norton. Additionally, an --enable-64bit-gcc option was added to configure. However, there are still some memory alignment issues to work out before 64bit mode is fully functional, patches are welcomed. Thanks Chris Baker for doing 64bit testing. * Added not_established keyword to the flow detection option. This allows snort to do dynamic firewall rulesets. Experimental for now. * Added an enforce_state keyword to stream4 so we won't pick up midstream sessions. This works well for asynchronous links and also for just monitoring legitimate traffic. * Relocated ./contrib files to http://www.snort.org/dl/contrib as many are not maintained by Sourcefire and are out of date. The rpm and schema files have been relocated in their respective 'rpm' and 'schemas' directories under the snort parent directory. * perfmonitor config line can now be configured with "accumulate" or "reset." Thanks Marc Norton for the feature, and Barry Basselgia for pointing out the issue. Thanks Scott Dexter and Andreas Ostling for doing some initial testing. * Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson and Clay McClure. Thanks guys. * Fixed reference times to match log time for first packet, for an event generated by a reassembled packet. Incremented event ID to give unique ID for each packet. Also made unified logging compatible with Windows. Thanks Andrew Mullican for the fix. * Fixed linux perfmonitoring stats for the 2.6 kernel. Thanks to everyone that reported this bug. Thanks Dan Roelker for the fix. * Get thresholding/suppression to work for alerts that do not contain an ip header (primarily decode alerts). Thanks Brian Caswell. * Fix conditions where snort would log double web alerts that contained only content options (no uricontents). Thanks to kawa for finding and reporting this bug. * Fix suppression/thresholding bug for non-rule alerts. Thanks to Alex Butcher for reporting it to us. * Many other bug fixes, please check the ChangeLog for details. --- Module Name: pkgsrc Committed By: taca Date: Sat Jan 29 03:27:58 UTC 2005 Modified Files: pkgsrc/net/snort: distinfo Log Message: Update distinfo for snort-2.3.0. --- Module Name: pkgsrc Committed By: adrianp Date: Fri Jan 28 23:03:59 UTC 2005 Modified Files: pkgsrc/net/snort-mysql: Makefile Log Message: Sync and minor tidy up for snort 2.3.0 release. --- Module Name: pkgsrc Committed By: adrianp Date: Fri Jan 28 22:51:27 UTC 2005 Removed Files: pkgsrc/net/snort-contrib: DESCR Makefile PLIST distinfo Log Message: As of snort 2.3.0 all contrib files are now available from: http://www.snort.org/dl/contrib/

Pullup ticket 249 - requested by Todd Vierling

2005-01-27T13:31:24Z

security fix for bind9 Revisions pulled up: - pkgsrc/net/bind9/Makefile 1.65 - pkgsrc/net/bind9/distinfo 1.20 Module Name: pkgsrc Committed By: tron Date: Wed Jan 26 09:32:31 UTC 2005 Modified Files: pkgsrc/net/bind9: Makefile distinfo Log Message: Apply ISC patch to fix a potential DoS in BIND 9.3.0 reported in VU#938617. Bump package version number to 9.3.0pl1 because of this.