ports/129240: [vuxml] eliminate false-positive for samba due to the entry in old portaudit.xml

[Eygene Ryabinkin]

>Number:         129240
>Category:       ports
>Synopsis:       [vuxml] eliminate false-positive for samba due to the entry in old portaudit.xml
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 27 20:30:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Eygene Ryabinkin
>Release:        FreeBSD 7.1-PRERELEASE i386
>Organization:
Code Labs
>Environment:

System: FreeBSD 7.1-PRERELEASE i386

>Description:

Samba version specification that is found in the old portaudit.xml file
inside ports-mgmt/portaudit-db/databases has improper entry that cathes
modern Samba port:
-----
$ pkg_version -T samba-3.2.4 'samba>=3.*<3.0.5,1' && echo Found!
Found!
-----

>How-To-Repeat:

Run the above command or do 'cd /usr/ports/net/samba32-devel;
make check-vulnerable', it should produce something like this:
-----
===>  samba-3.2.4 has known vulnerabilities:
=> Multiple Potential Buffer Overruns in Samba.
   Reference: <http://www.FreeBSD.org/ports/portaudit/2de14f7a-dad9-11d8-b59a-00061bc2ad93.html>
=> Please update your ports tree and try again.
*** Error code 1
-----

>Fix:

The following patch fixes the things, at least for me:
--- portaudit.xml-fix-old-VuXML-entries-for-samba.diff begins here ---
>From 601cd8355609580f914c27e15c25bbee25219f6d Mon Sep 17 00:00:00 2001
From: Eygene Ryabinkin <rea-fbsd at codelabs.ru>
Date: Thu, 27 Nov 2008 23:04:40 +0300

Very old portaudit.xml in ports-mgmt/portaudit-db/database has 4 years
old entry for samba that renders current port, net/samba32-devel to be
marked as vulnerable.  This happens due to the bad version specification
that spans over port epoches, thus caching samba32-devel that has no
portepoch:
-----
$ pkg_version -T samba-3.2.4 'samba>=3.*<3.0.5,1' && echo Found!
Found!
-----

Applied modification fixes the things,
-----
$ pkg_version -T samba-3.2.4 'samba>=3.*<3.0a20' && echo Found!
$ pkg_version -T samba-3.2.4 'samba>=3.0.0.b1,1<3.0.5,1' && echo Found!
-----
and seem to catch originally intended versions properly:
-----
$ pkg_version -T samba-3.0a19 'samba>=3.*<3.0a20' && echo Found!
Found!
$ pkg_version -T samba-3.0a19 'samba>=3.0.0.b1,1<3.0.5,1' && echo Found!
$ pkg_version -T samba-3.0.1,1 'samba>=3.0.0.b1,1<3.0.5,1' && echo Found!
Found!
$ pkg_version -T samba-3.0.1,1 'samba>=3.*<3.0a20' && echo Found!
-----

Samba revision history was traced by using CVS logs,
  http://www.freebsd.org/cgi/cvsweb.cgi/ports/net/samba3/Makefile
Particularily, portepoch was bumped at the Makefile's version 1.92:
  http://www.freebsd.org/cgi/cvsweb.cgi/ports/net/samba3/Makefile.diff?r1=1.91;r2=1.92

Note well: the added port specification will catch version 3.0.20,
for example,
-----
$ pkg_version -T samba-3.0.20 'samba>=3.*<3.0a20' && echo Found!
Found!
-----
but FreeBSD's 3.0.20 is be named '3.0.20,1', so we seem to be safe
here, since this particular specification will catch only 3.0.x:
-----
$ pkg_version -T samba-3.1.32 'samba>=3.*<3.0a20' && echo Found!
-----

Signed-off-by: Eygene Ryabinkin <rea-fbsd at codelabs.ru>
---
 ports-mgmt/portaudit-db/database/portaudit.xml |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/ports-mgmt/portaudit-db/database/portaudit.xml b/ports-mgmt/portaudit-db/database/portaudit.xml
index 168072a..bcae088 100644
--- a/ports-mgmt/portaudit-db/database/portaudit.xml
+++ b/ports-mgmt/portaudit-db/database/portaudit.xml
@@ -287,7 +287,8 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <affects>
       <package>
 	<name>samba</name>
-        <range><ge>3.*</ge><lt>3.0.5,1</lt></range>
+        <range><ge>3.0.0.b1,1</ge><lt>3.0.5,1</lt></range>
+        <range><ge>3.*</ge><le>3.0a20</le></range>
 	<range><lt>2.2.10</lt></range>
       </package>
       <package>
-- 
1.6.0.4
--- portaudit.xml-fix-old-VuXML-entries-for-samba.diff ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted: