summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2009-08-29Convert to user-destdir.wiz2-4/+11
2009-08-29Add user-destdir support.obache1-6/+7
2009-08-27Switch to postgresql82 and hope it works. postgresql81 is gone.wiz1-2/+2
2009-08-26bumping revision due graphics/ImageMagick updatesno1-2/+2
2009-08-26Update dropbear to 0.52. Build an scp binary and call it dbscp so itsnj5-55/+52
doesn't conflict with openssh. Changes since 0.50: 0.52 - Wed 12 November 2008 - Add "netcat-alike" option (-B) to dbclient, allowing Dropbear to tunnel standard input/output to a TCP port-forwarded remote host. - Add "proxy command" support to dbclient, to allow using a spawned process for IO rather than a direct TCP connection. eg dbclient remotehost is equivalent to dbclient -J 'nc remotehost 22' remotehost (the hostname is still provided purely for looking up saved host keys) - Combine netcat-alike and proxy support to allow "multihop" connections, with comma-separated host syntax. Allows running dbclient user1@host1,user2@host2,user3@host3 to end up at host3 via the other two, using SSH TCP forwarding. It's a bit like onion-routing. All connections are established from the local machine. The comma-separated syntax can also be used for scp/rsync, eg rsync -a -e dbclient m@gateway,m2@host,martello:/home/matt/ ~/backup/ to bounce through a few hosts. - Add -I "idle timeout" option (contributed by Farrell Aultman) - Allow restrictions on authorized_keys logins such as restricting commands to be run etc. This is a subset of those allowed by OpenSSH, doesn't yet allow restricting source host. - Use vfork() for scp on uClinux - Default to PATH=/usr/bin:/bin for shells. - Report errors if -R forwarding fails - Add counter mode cipher support, which avoids some security problems with the standard CBC mode. - Support zlib@openssh.com delayed compression for client/server. It can be required for the Dropbear server with the '-Z' option. This is useful for security as it avoids exposing the server to attacks on zlib by unauthenticated remote users, though requires client side support. - options.h has been split into options.h (user-changable) and sysoptions.h (less commonly changed) - Support "dbclient -s sftp" to specify a subsystem - Fix a bug in replies to channel requests that could be triggered by recent versions of PuTTY 0.51 - Thu 27 March 2008 - Make a copy of password fields rather erroneously relying on getwpnam() to be safe to call multiple times - If $SSH_ASKPASS_ALWAYS environment variable is set (and $SSH_ASKPASS is as well) always use that program, ignoring isatty() and $DISPLAY - Wait until a process exits before the server closes a connection, so that an exit code can be sent. This fixes problems with exit codes not being returned, which could cause scp to fail.
2009-08-26bump revision because of graphics/jpeg updatesno33-53/+66
2009-08-25Remove BROKEN_IN variable. It was no maintained, and there was nowiz1-3/+1
defined workflow for setting it, removing it, or removing packages depending on it.
2009-08-25Get rid of now unnecessary EXTRACT_OPTS_ZIP.wiz2-4/+2
2009-08-24Update to 0.9.15. Upstream changes:hasso4-32/+39
- Make Prelude-Manager thread backend independant. - Add missing dlpreopening support for the SMTP plugin. - Win32 compilation fixes. - Various fixes and update. Also various pkgsrc related fixes including DESTDIR support.
2009-08-24Update to 0.9.17. From Rumko via PR 41763. Upstream changes:hasso3-10/+11
Changes in 0.9.17: ================== - Do not provide an exhaustive list of unreachable linked alert, rather, tell the user how many linked alert are not reachable any more. - String encoding fixes, do not mix unicode and bytestring, and more generally, use unicode for internal string storage. This fixes a lot of possible exception with particular specific user input, or with localization enabled. - Inline filter didn't work as expected when viewing events starting with a specific offset, because the offset keyword wasn't removed from the generated link. - Error handling improvement (back / retry button weren't always working as expected). - Fix exception when no protocol was available. - Improve navigation button link (make the link cover the whole button). Changes in 0.9.16: ================== - Multiples advanced filter within the same column wouldn't display correctly. - Correctly restore input field when switching between advanced/simple filter mode. - Fix multiple bug that would results in inconsistant filtered "state" and reset button. - Using the classification simple filter now also trigger a search on impact.completion. - Fix multiple alert deletion checkbox, (#357). - Various bug fixes. Changes in 0.9.15: ================== - Make it obvious when a column is filtered by replacing the old sober star with a big "[filtered]" red marker. If the column filter is saved, then the marker color will go from red to black. - Once the user filtered a given field by clicking on it, deny further click so that it is clear that the filter is currently active. - Re-write the inline filter implementation using Cheetah + Jquery, in place of generating an enormous amount of javascript code. This drastically reduce the size of the events listing HTML page, and will allow for much easier modification of the inline-filters. - Only propose filter operator relevant to the selected path. - Inline filter now present a single input field (with no path and operator selection). Using this field, the user can filter on what is seen in the associated column. For example, in the classification column, the filter will trigger a search on classification.text, classification.reference.name and classification.reference.origin. There is also an [advanced] button allowing the user to specify both the path and the operator. - Implement a reset button in each inline filter column, that allow to switch between different version of the filter: last saved filters, default filters, or current filters. - The user can now click an alert completion to set an inline filter on the completion value. - Clicking on a port / protocol now trigger a CSS menu allowing to filter on the port and protocol information, or to get information concerning this port / protocol. - Clicking on a classification reference now trigger a CSS menu which allow to filter on the reference, or to get more information concerning it. - Clicking on classification now add a filter on the selected classification (previously, it would have unfolded aggregated alerts for the selected entry, which is now done clicking the alert count). - Until now, the default user that was automatically created by Prewikka if there was no administrative user was "admin". As of now you can define the initial administrative username and password from the configuration file. (fix #289). - Fix escaping for reference details URI parameters. - Fix ModPython content-type handling. - Invalid variable name, fix #339. - Update to JQuery 1.3.2, and fit small JQuery API change. - If the installed libprelude or libpreludedb version is too old, Prewikka will require the user to upgrade. Currently, Prewikka depend on libpreludedb 0.9.12, and libprelude 0.9.23. - Fix IDMEFDatabase exception on empty criteria string (fixes #346). - Analyzer retrieval fixes and speedup (fixes #350).
2009-08-24Update to 0.9.15.3. No normal upstream changelog. Pkgsrc package reworked,hasso6-42/+102
but it's not final yet. From Rumko via PR 41763.
2009-08-24Update to 0.9.0-beta6. Rewritten from scratch in Python instead of lua.hasso6-94/+90
From Rumko via PR 41763.
2009-08-23Make it build on DragonFly. From Rumko via PR 41763.hasso3-2/+24
2009-08-23Update to 0.9.15. Changes since 0.9.14:hasso5-41/+56
- Make the Prelude-LML UDP server IPv6 compatible. - Implement 'idmef-alter' and 'idmef-alter-force' option, alloing to include static values into IDMEF events generated using a given format. - New PPP/PPTPD/L2TP ruleset, by Alexander Afonyashin <firm <at> iname.com>, with slight modification from Pierre Chifflier <p.chifflier <at> inl.fr>. Close #340. - Fix CISCO VPN ruleset so that the 'Authentication rejected' rule will trigger even if the 'server' field does not contain a word (fix #328). - Remove dos-style end-of-lines (Closes #338) - Fixes possible off by one when parsing variable reference number, and remove un-needed check that would always evaluate to TRUE.Thanks Steve Grubb <sgrubb <at> redhat.com> for reporting this problem (and running flexelint on the Prelude sources)! - Update for libtool 2.x compatibility. - This simplify the whole regular expression handling a lot, making the code much easier to read, and fixing potential problem with ovector assignement. This code should also improve performance by a small factor. - Change CISCO references urls to their new location, add CISCO ASA rule to handle discarded tcp or udp packets. - Various fixes and update.
2009-08-23Add libprelude bindings.hasso1-1/+5
2009-08-23Import ruby bindings to libprelude.hasso5-0/+63
2009-08-23Import python bindings to libprelude.hasso5-0/+74
2009-08-23Import perl bindings to libprelude.hasso4-0/+78
2009-08-23Import lua bindings for libprelude.hasso5-0/+65
2009-08-23Update to 0.9.24. No normal upstream changelog except git log. Splitted uphasso15-121/+214
the package to the base (with c++ bindings) and scripting languages bindings. All hard work done by Rumko <rumcic at gmail.com>.
2009-08-21Fix tyopagc1-1/+1
2009-08-20Updating security/p5-IO-Socket-SSL from 1.27 to 1.30sno2-6/+6
Upstream changes: v1.30 2009.08.19 - fix test t/memleak_bad_handshake.t v1.29 2009.08.19 - fixed thanks for version 1.28 v1.28 2009.08.19 - fix memleak when SSL handshake failed. Thanks richardhundtu[AT]gmail[DOT]com
2009-08-16Bump PKGREVISION for libevent ABI bump.wiz4-8/+8
2009-08-14Update to Mixminion-0.0.8alpha3.joerg6-110/+48
- support for newer Python versions - various bug fixes and security improvements - moved from LGPL to MIT license Based on the update by Christian Sturm in wip with additional fixes from me.
2009-08-13Update to 2.8.3. Changes:snj4-19/+18
* Version 2.8.3 (released 2009-08-13) ** libgnutls: Fix patch for NUL in CN/SAN in last release. Code intended to be removed would lead to an read-out-bound error in some situations. Reported by Tomas Hoger <thoger@redhat.com>. A CVE code have been allocated for the vulnerability: [CVE-2009-2730]. ** libgnutls: Fix rare failure in gnutls_x509_crt_import. The function may fail incorrectly when an earlier certificate was imported to the same gnutls_x509_crt_t structure. ** libgnutls-extra, libgnutls-openssl: Fix MinGW cross-compiling build error. ** tests: Made self-test mini-eagain take less time. ** doc: Typo fixes. ** API and ABI modifications: No changes since last version. * Version 2.8.2 (released 2009-08-10) ** libgnutls: Fix problem with NUL bytes in X.509 CN and SAN fields. By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS into 1) not printing the entire CN/SAN field value when printing a certificate and 2) cause incorrect positive matches when matching a hostname against a certificate. Some CAs apparently have poor checking of CN/SAN values and issue these (arguable invalid) certificates. Combined, this can be used by attackers to become a MITM on server-authenticated TLS sessions. The problem is mitigated since attackers needs to get one certificate per site they want to attack, and the attacker reveals his tracks by applying for a certificate at the CA. It does not apply to client authenticated TLS sessions. Research presented independently by Dan Kaminsky and Moxie Marlinspike at BlackHat09. Thanks to Tomas Hoger <thoger@redhat.com> for providing one part of the patch. [GNUTLS-SA-2009-4]. ** libgnutls: Fix return value of gnutls_certificate_client_get_request_status. Before it always returned false. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3668>. ** libgnutls: Fix off-by-one size computation error in unknown DN printing. The error resulted in truncated strings when printing unknown OIDs in X.509 certificate DNs. Reported by Tim Kosse <tim.kosse@filezilla-project.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3651>. ** libgnutls: Return correct bit lengths of some MPIs. gnutls_dh_get_prime_bits, gnutls_rsa_export_get_modulus_bits, and gnutls_dh_get_peers_public_bits. Before the reported value was overestimated. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3607>. ** libgnutls: Avoid internal error when invoked after GNUTLS_E_AGAIN. Report and patch by Tim Kosse <tim.kosse@filezilla-project.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3671> and <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3670>. ** libgnutls: Relax checking of required libtasn1/libgcrypt versions. Before we required that the runtime library used the same (or more recent) libgcrypt/libtasn1 as it was compiled with. Now we just check that the runtime usage is above the minimum required. Reported by Marco d'Itri <md@linux.it> via Andreas Metzler <ametzler@downhill.at.eu.org> in <http://bugs.debian.org/540449>. ** minitasn1: Internal copy updated to libtasn1 v2.3. ** tests: Fix failure in "chainverify" because a certificate have expired. ** API and ABI modifications: No changes since last version.
2009-08-12recursive bump for icu shlib version change except already done.obache2-3/+4
2009-08-11recurse: PKGREV bump for ImageMagick shlib name changedrochner2-2/+4
2009-08-11bump PKGREVISION for ImageMagick shlib name changedrochner1-1/+2
2009-08-10Removing incorrect dependency to PAR::Dist and add license informationsno1-3/+6
according to META.yml (to remove cyclic depend).
2009-08-09Update to 2.3. Update HOMEPAGE and MASTER_SITES. Set packager information.wiz2-10/+12
* Noteworthy changes in release 2.3 (2009-07-29) [stable] - Libtasn1 is now an official GNU project. - Solve build problem on Tru64 related to TRUE/FALSE. - More careful decoding of OIDs. - Fixed warning in ASN1.y. - Use "Software libraries" info dircategory. - Drop GPL/LGPL copies from the manual (not needed there). - New configure parameters to set packaging specific information. The parameters are --with-packager, --with-packager-version, and --with-packager-bug-reports. See <http://article.gmane.org/gmane.comp.lib.gnulib.bugs/17791> for more details.
2009-08-09Add and enable ssssagc1-1/+2
2009-08-09Initial import of security/ssss-0.5 into the packages collection.agc5-0/+63
Shamir's Secret Sharing Scheme (SSSS) is an implementation of a threshold scheme for sharing a secret between third parties, and requiring a threshold of those parties to collaborate to reveal the secret. Taken from the Wikipedia article about Secret Sharing: In cryptography, a secret sharing scheme is a method for distributing a secret amongst a group of participants, each of which is allocated a share of the secret. The secret can only be reconstructed when the shares are combined together; individual shares are of no use on their own. Shamir's scheme is provable secure: in a (t,n) scheme one can prove that it makes no difference whether an attacker has t-1 valid shares at his disposal or none at all; as long as he has less than t shares, there is no better option than guessing to find out the secret.
2009-08-08This works fine with python 2.5bouyer1-2/+2
2009-08-06Update john to 1.7.3.1. Add license. Update patch-aa.zafer3-30/+15
Changelog: The following changes have been made between John 1.7.3 and 1.7.3.1: * Corrected the x86 assembly files for building on Mac OS X. * Merged in some generic changes from JtR Pro. The following changes have been made between John 1.7.2 and 1.7.3: * Two Blowfish-based crypt(3) hashes may now be computed in parallel for much better performance on modern multi-issue CPUs with a sufficient number of registers (e.g., x86-64). * Bitslice DES assembly code for x86-64 has been converted to use instruction pointer relative addressing (needed for Mac OS X support). * New make targets: macosx-universal, macosx-x86-64, solaris-x86-64-cc, solaris-x86-64-gcc, solaris-x86-sse2-cc, solaris-x86-sse2-gcc, solaris-x86-mmx-cc, solaris-x86-mmx-gcc, solaris-x86-any-cc, linux-ia64; other changes to the Makefile. * Minor bug fixes. * "DumbForce" and "KnownForce" external mode samples have been added to the default john.conf.
2009-08-06PKGREVISION bump for elisp packages because of bytecode format changesminskim2-3/+4
in emacs23.
2009-08-05security/EasyPG can be built with emacs23.minskim1-2/+2
2009-08-03Update to 1.5.5. Changelog:hasso2-7/+7
pcsc-lite-1.5.5: Ludovic Rousseau 28 July 2009 - add the reader interface name if provided by the device - SCardTransmit(): return SCARD_E_UNSUPPORTED_FEATURE if SCARD_PROTOCOL_RAW is requested by unsupported - SCardConnect() and SCardReconnect(): set dwActiveProtocol to SCARD_PROTOCOL_UNDEFINED if SCARD_SHARE_DIRECT is used (conform to MSDN). Contrary to Windows winscard behavior, the reader is accessed in shared mode and not exclusive mode if SCARD_SHARE_DIRECT is used. - SCardControl(): correctly check for buffer overflow (bug introduced in pcsc-lite 1.5.4) - some other minor improvements and bug corrections
2009-08-03Update to 0.11.9.hasso3-7/+8
New in OpenSC 0.11.9; 2009-07-29; Andreas Jellinghaus * New rutoken_ecp driver by Aktiv Co. / Aleksey Samsonov * Allow more keys/certificates/files etc. with entersafe tokens * Updates pkcs11.h from scute fixing warnings * Small fixes in rutoken driver * Major update for piv driver with increased compatibility
2009-08-03Update to 0.6.17.hasso3-39/+7
New in OpenCT 0.6.17, 2009-07-29; Andreas Jellinghaus * add support for Rutoken ECP (ccid driver) * small bugfixes
2009-08-03Update to 0.2.6. Changes include fixes in the export file is fixed, nowhasso2-6/+6
includes the new function we added in 0.2.5. Also the MSVC build was fixed.
2009-08-03Update to 1.3.11. Changelog:hasso2-7/+7
1.3.11 - 28 July 2009, Ludovic Rousseau - add support of Raritan D2CIM-DVUSB VM/CCID, Feitian SCR301, Softforum XecureHSM, 2 Neowave Weneo tokens, Synnix STD200, Aktiv Rutoken ECP, Alcor Micro SCR001, ATMEL AT91SC192192CT-USB, Panasonic USB Smart Card Reader 7A-Smart, Gemalto GemProx DU and SU - remove support of Reiner-SCT cyberJack pinpad(a) on request of Reiner-SCT. You should user the Reiner-SCT driver instead - define CFBundleName to CCIDCLASSDRIVER so that non class drivers have a higher priority. Used by pcsc-lite 1.5.5 and up. Add a --disable-class configure option so that the Info.plist does not define a Class driver. Default is class driver. - do not power up a card with a voltage not supported by the reader - add support of PIN_PROPERTIES_STRUCTURE structure and FEATURE_IFD_PIN_PROPERTIES - adds support of FEATURE_MCT_READERDIRECT. Only the Kobil TriB@nk reader supports this feature for now. This is used for the Secoder functionality in connected mode. - add support of a composite device. No change needed with libhal. use --enable-composite-as-multislot on Mac OS X since libhal is not available on Mac OS X or with libusb on Linux - some minor bugs removed
2009-08-02Update to 1.7.2p1.hasso3-16/+16
Changes in 1.7.2p1 since 1.7.2: =============================== * Fixed the expansion of the %h escape in #include file names introduced in sudo 1.7.1. Changes in 1.7.2 since 1.7.1: ============================= * A new #includedir directive is available in sudoers. This can be used to implement an /etc/sudo.d directory. Files in an includedir are not edited by visudo unless they contain a syntax error. * The -g option did not work properly when only setting the group (and not the user). Also, in -l mode the wrong user was displayed for sudoers entries where only the group was allowed to be set. * Fixed a problem with the alias checking in visudo which could prevent visudo from exiting. * Sudo will now correctly parse the shell-style /etc/environment file format used by pam_env on Linux. * When doing password and group database lookups, sudo will only cache an entry by name or by id, depending on how the entry was looked up. Previously, sudo would cache by both name and id from a single lookup, but this breaks sites that have multiple password or group database names that map to the same uid or gid. * User and group names in sudoers may now be enclosed in double quotes to avoid having to escape special characters. * BSM audit fixes when changing to a non-root uid. * Experimental non-Unix group support. Currently only works with Quest Authorization Services and allows Active Directory groups fixes for Minix-3. * For Netscape/Mozilla-derived LDAP SDKs the certificate and key paths may be specified as a directory or a file. However, version 5.0 of the SDK only appears to support using a directory (despite documentation to the contrary). If SSL client initialization fails and the certificate or key paths look like they could be default file name, strip off the last path element and try again. * A setenv() compatibility fix for Linux systems, where a NULL value is treated the same as an empty string and the variable name is checked against the NULL pointer.
2009-07-30make this build with newer OpenSSL versionsdrochner3-1/+63
tested with: -1.0.0beta3 (which already identifies itself as 1.0.0) -the snapshot in NetBSD-current (identifies itself as 1.1.0) -the 0.9.8 we had in -current before
2009-07-28Updating package for p5 module IO::Socket::SSL from 1.26 to 1.27sno2-6/+6
Upstream changes: v1.27 2009.07.24 - changed possible local/utf-8 depended \w in some regex against more explicit [a-zA-Z0-9_]. Fixed one regex, where it assumed, that service names can't have '-' inside - fixed bug https://rt.cpan.org/Ticket/Display.html?id=48131 where eli[AT]dvns[DOT]com reported warnings when perl -w was used. While there made it more aware of errors in Net::ssl_write_all (return undef not 0 in generic_write)
2009-07-24Update to 1.5.1. No detailed changelog, but from announcements:hasso3-7/+8
1.5.1 release provides some bug fixes and a fix for the recently announced HMAC vulnerability in the XML Signature specification (CVE-2009-0217). 1.5.0 release provides more bug fixes, partial support for Inclusive Canonicalization 1.1, and support for the Xerces 3.x official release and 32/64-bit portability APIs.
2009-07-23sortjnemeth1-2/+2
2009-07-22disable the openssl compatibility library -- no pkg I know of needsdrochner5-5/+35
it, and it only has a potential to conflict with the real openssl (bad things will happen if a program links or dlopen()s both) bump PKGREVISION (the bug fixed in the added patches is already fixed upstream, will be in the next release)
2009-07-22Remove empty PLIST.common_end.wiz1-1/+0
2009-07-22Remove USE_DIRS from pkgsrc.wiz6-12/+6
Shared directories can now be created independently by the pacakges needing them and will be removed automatically by pkg_delete when empty. Packages needing empty directories can use the @pkgdir command in PLIST. Discussed and ok'd in thread starting at http://mail-index.netbsd.org/tech-pkg/2009/06/30/msg003546.html
2009-07-21Puntroy4-150/+0
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-05 04:36:51 +0000