ports/161161: Security update for quagga

Mike Tancsa mike at sentex.net
Fri Sep 30 14:40:09 UTC 2011


>Number:         161161
>Category:       ports
>Synopsis:       Security update for quagga
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 30 14:40:08 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Mike Tancsa
>Release:        RELENG_8
>Organization:
Sentex Communications
>Environment:
FreeBSD 8.2-STABLE #0: Mon Sep 12 21:26:35 EDT 2011 
>Description:
There is a security update for quagga that fixes a number of bugs and vulnerabilities.
http://www.cert.fi/en/reports/2011/vulnerability539178.html
(CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, CVE-2011-3326 and CVE-2011-3327).

>How-To-Repeat:
install the existing port
>Fix:
http://www.quagga.net/download/quagga-0.99.20.tar.gz has been released.

SIZE (quagga-0.99.20.tar.gz) = 2232051
SHA256 (quagga-0.99.20.tar.gz) = b7a98cc6b022bb0cb405557b3d920cf513150f64384dbd0a2248b5bd248df58b


Patch attached with submission follows:

begin 644 quagga-port.tgz
M'XL(`.72A4X``^T\^W?:N-+[*_XK5))LF[TQ;Y*&7GI*$])RF@`+I+W=S1YJ
M;`&^,;;7C]`TR__^S4 at R?F`@W=WV?O=<U-.`I=%H-"_-2#*_^\IDHN1_^):E
M4"B<5*L$/Z$D/_E#L7A<*9:KQ7*Y1`K%4J54_(%4ORE5HOBNISA`BF-9WB:X
M^9128T-[<G+_)>5W+O\KY9:.=8-^DS&`'\>5RCKYE^!?(/_RR4FE"/*O%([+
M/Y#"-Z$F4?['Y;]'VG1.;,OQ7*):AD%53[=,,A/Z0,:64R-0N)Y(>^1<\2A1
M'0H?&FMAI4SZU/;H;$0=`N(L`^"'J34+`8+RVO%52JY(7Y_9+ at STS]',?77A
M4/JZ?YZSG,E+:0_Z[HN:&J<L;U(OG]#4HSM2S!6+)1BN6,P73O.E,BF5:J5*
MK5PARDR;Z672_&R3?4`H=3N]0;MQU:QGQ#RPXGVSUV]UVO5,(7=ZFBL56&6O
M^;[%:T^EL\:@^:;3:S7[]0Q00'3[[EBZ:O0'S=ZPWQI@]=3S[%I>T)9#,C5K
M;AJ6HN7)C90)VN?S><[Q<X\!T^BCP'SWD6"E1\$IZ<0!YQJ#L[?K9RL!/UKM
M`?QO]NJ9D>7H[BM/F4`3S%<ZZUQ=-=N#>@;%27JM[EWQB'V4CDBGW[W`S]=O
MNI4CTNK+K3YQ+!^4R[7&WEQQJ`3]VQ>7K;,!#&W9U!Q-;$W^M2"?_O83^4)'
MCB(7?I*DZWYSV+@>=`:=SB4`&OK(LRR#*+YG3:FB48=!O+EJO`/Q9^ZIRYXO
MSQ%YZTVDJMOL75:'KZ];E^=U5LF^#L^;W6;[O/\/@)PH\]O:_@/J2?^\U5OD
M#<6<Y+$6^=`N`LB==^].<T5\?`Z/2'+N.;%<>WP<?,%/1[?%ASG!+VPZN>=2
MJWW1 at 6Y"2Z5.=P"Z"+,"G>R?9S+9IJF,P"KI9YLZ^HR:GF(0;".:0F>6F<U8
MXS&3;;=Q!>#P%QDQ!4!=59AE at T$31F0(BZ(8MOO]1B:+?XGKVVAVY%GOXJQ8
M?7YRF`#M=!L_7P,+L0-6D(ZM_.Y3^3+1MU0^*1QF2="W-VB<OP>B0/['I(>B
M=DA#NZ..I[L4Y^*&X_3;5UT`Q8\`93:3638/SKK]SMF[YJ"?R5Z[E,!SO at 60
MEGI+P9'A'&W'\BSP:((S;DC'^>55X_*R<\:[:L9,,0Q+)<_0Y[D$)49FOCHE
M8\4%$B,3:'>&H*W#1KO=N6Z?-3/9@>^8K!6JA?(JIFGYILKFPWI*4DXW5</7
M*/@Z5\OA5'*V0W.SVY>@X1>7C3>H6W)K_P%H:ER^;O2;B[SH`GW'9/^ATQ>^
M:D%>ULESML)(E^?+OF-8P]1;&:<,_MMRI!PU-7TL<16_[H&!]!!2E at 5>37?J
MH,>]YD7K7\O!B"Q3IEXR_:S,;",!Y4[!)O.BR15.(#)$L_T>:+ELO49#A'[B
MVX*(+ZU?FF$M/"P83\7S,'#&2XB at 9A&=Z&6,26#J$N/0$PV6!)-JSYKMQNO+
MYA"LN7<H11[J at EK!E[0^;WJ=Z^ZR$WM*]$IAI^"7[U+D5&3`Q7K@"2B*'4*S
MD1:)>?0_]K'_$)S,H11YB(B#>FI^PZP8F_H#6,$XDOAS/7^G.'G'-_-;I^C>
MNZIECKDN1$A)FR&8D6*`+GI"=>*#BDDF^/Y^\#'@_5J6@;]*LFW9;;%=/,S=
M25+_#):>01\5M9[A;`SY2;KOW at Q7*IDKBK$_R@$"#R%+65LX6=8WJH)Q_2`Q
M14O5AH!1'UJ#MT.V`&Q at D>[JKB9U+UO]P;!__?H?8LFH9[/`'\.E:4VO5&N&
M?HID`Q[BJH4+'<,&R]$J';"BI%$QU[VI#/9H*[.E/%;ZXEJ!"\R&:9BNJVQ&
M$%E]-N"Q^(ID`+;HQ!%!H]M*Y\JR<94OJZ2PQ6P#`8ZG:'?KN^/"MJ&W:\YL
M"1QA&'Q`1(65L>@#ZN399.:Q+ZS+VO'"!7/#J)YJRRP068\G6#L/X]0%BVBN
M%"-0HW?40#<=M(>^7#:6=<#](8JAGNF=+<,R0T.OHT^$G%)AUI.96*G3YJSI
M+ILTK/=RL&@O$6(XV#M#O>@%*4/.G9*YXJG3Y:.TI`K7O;A_7?%]6UR)%-/$
MOXALF^N)-*]Q/Q"?R"`[Y]Z;ZN:D5I,RKP#F[&UG0;+UOU*R(:8HSH^63U3%
M)"-?-S3"50CSM05!QT(@@(68#I1E#M00R\9`UJVMP169JL at Y^S95]?$]P66:
M>!:!=8_\S*0(L:6.09N;3<'`F!''P!:AKT"Q7*62*$04+B)6`OD6==RI;L>0
M1&2:F`DLKRS0NV>(!"'<8'Q'Q/F0(\=IBBO15G0P10]2C!5$492#-,&0F7)/
M1G1)#]6(;D(DK:B>#O[@OA:C"L@(%I;X3L'&W"4-PS*-"3"L26;6]@U7%D*2
M>0W30[%"I"0Y:3C9$A&=T8;$)ZT_2WZB)98-I?4(O;SH\=C<*`U9X.J7PS\N
M6TI#E7#'A&Q+G,`#6:X'V0H$DX;!W4^_.8#(;0'>(1+(L<>W^!?BMU8;M/OR
M4CQQ_]'M]`>R:$AXL9=L5F(,U-^HW\%=00\-%;0_E\O%IM70M(1+ at N[`#/`+
M+"QWU!SJ/C[SE57LGL45/_8`JY?B&QYCA5._R;8[-W$`CF'(\0'`QV8_`1$G
MT7"M(W(/;A6-<:[#X at 74N.!JMOK2Y5A".6`P%A1P6</\@!WIQ(T-98+ at N;40
M]+/G*!`/N$-;\:8`FL?/(F$?I40?SHQPRBL\B2S'FQ at 3!8N0N(E];4BDGSQY
M0OJ0&E-2R)T>YRK#*MN,Q%7$)2:=$UUCQL0Q\\5%,37NX'-).^`&##+!I<ZD
MX!-!'C/%]$'W[HDZA16`>]H5[RBTE,37^%0H''XE6$C'-V:$3!4-B`%/1#0+
M-$,'@Z8P)YHC'0<7 at -2^:/E`L6).*$XZP<5X&OH:MP\/N36K!E5,;LN]JP61
M<6?C0^\=T"C2K?V'W-EUCT6.P2XO[ITLH[)PS)JT1WI4M9#RL6/-F%:#5P,5
MP.^*1ZCB&#JT`H3+%B5KS"?(9"CVK[$;8!(2M%WJ:Q9+YKF[AX`$9`P=3PMD
M/M7!R4%_:-;(Z)Y<P)KY6G<T\*&>,E)<1$3-"<PZ1W!99..8UISK"^`I%HHU
M^)\#N'9GT,0I#)`@<#03L$O%=?T9.A&D/A:!(`R;GCY3G""``*HB at 4Z.M,9H
M[8!SJMR!,X4E?3RF#B8Q8/2^?80"-BV/!2Y>..P3$`?(ZU?R:?^A=0Y"\3\1
MV025)[^]P#@1EU_"I3L\NSK'H,1RG'OA6GS7PX4>CTY0G6&F4=RY[`M"/^L>
M*;X`U6;H5-]!FH:^KM4_`4]DG\1CTT\QL`F"V7,^91=L)(3FD>H?JN^A(I6)
MK)$:[QRCM at 62-`SB@">[$\0Q_<D*4#;G+MG??XB0MEC%@Y;%>C-21/=-E*TE
MA7$4PFNN at O@X$]J6<"%"]U!ELJO8!H@&?`=W&JQ7$,7I\.R;&N`*-S*P'?=\
MF'JEH%,<RH)0IMK`@B1'..T8U*&G>E8\?$JU-+(:8PQN<)"C#=0Q'9^#>A)%
M5:GKZF"W*<A&@;)'B)DLB5&G$\?FE``_79N*\#*-+/3G?%0FQ,#6./:G"=$]
M15T>T:C1I:!<FB&3VM.X&C\-#'*-.:;@L\$[@OTH(_0;$2M"'Y(CN)Z#"9M/
M/5QSL!IHG#N8><`H3 at J^6%+@$D>?3!FN)QP6M`_,SR;9+O#.);WFX+K71J30
MP=--']3!(6>#WJ5\AK6,K%J6:/YL=D]61^N\.R)3%.B<DHE52Z%'HP;U,.1@
M_$JJ%VH(\\Y1)X=Q5V!HV`M0,(^QU5 at U+1PHGOHR2^/..(J=#0?=P/<E>\@3
M!(Z2D83C6H.4`2"1U2#:$8$M#Z.BJTL6D>%**FN)59W(+LF[(]W,FY9AP6)"
MY"F14_B]-$.<:)BIK]@]6QR3S`9Y1N>__W#1:J,??!OI**>*2::?J0I00,B'
M]H+-]V%!;EZD4BC,\RLIG"PI+&RA,-TW)$BL;:9Q$Q>9O_Q*!K(^WYAWJ71-
M'D/77^?8A6Y"+@&^GX6/+`!P/<LF?'V$)8GE3<$6`KJN;/H!&`2$[`3L/WW_
MX7^]B%L5FNZ"<QY;WV2,S?=_"H52L1C>_RE7\/Y/\?AD=__G>Y1^ZY<F><:U
M0!8787+`D=SDRR&IDU*I7"I4BU+_;:-4/=X`.#I13I^KZO&H4"J-1 at 5U5"E4
MJ]6345D[+174<;58+E8+X^-*^7E%&VD%I52J/!]51QI\:./J\]'.$?QGBK!_
M^W8B:]15G6\QQC;[/RD<@_U7"N5"\1BT#>V_5-S9_W<I%\'NR9R.7$@G:I(D
M%F_,DU@(BY%'<">+GW8<X5[+G<ZB;!VO@[";2)[89Y&"JUWLL\QN?)&[(HL1
ML!HO@)79Q:^["JMDMYEHY#:3A/MJUZ;^F=B&XL'#S(4A(;#05=]0'..>B/N!
MK/LEI"N?V3<%LZ0V]:#EB$BXP8:'!Q!\*V1,(8N*S at RPWF+Z]J9]37YA^YM\
MBV>NN(2=6UHV))82Y*#O?%.?ZH[5<J=XG&'Q_1V!R\.;;8H^8[N__/A*(3,+
M.*6;=Y9QASCP.!EP>/=$`7X"G4'?J6(RWHMPC*CP!_='<8MI9F&Z$R4P)TD?
M/GRHD91;>']>_A'[%SOA?Y]N!66+_9=+QQ6(6TM at _1589`IH_]63W?W?[U+V
MGN0QW<33[&YC\+:.3[6\[SHL#94DMCDH?R'9Q/8S[@]BP"^Q?>WX#:7E39K8
M+:6Q'L.6W*6.(=QR6RF!*IJOQ_&D7`%+[\MS^-3.L:M at V%O%?9K]$A at X`XN>
M,!U*F>O6>1TR*"GS!K[L/\#C0LK`@,$N`V&[A:LCEU[B=8F\Z1N&H(%M$5#(
M4?GYN&+ at GLU]L*/$D=TD$=UDC\!9$['9B#NRNH>'$>P6149L_4=W/%:V,?`<
M#&A?!%1D.`D-3:/:^E%Q#$8O&R?L at TO$VDYDK.@&;B1B#[93S)$`ES/X/V`<
MRZ<3?!/23F%;9BW/&)Z;!(YU'(N,#;YX95LHN74#'<3P8OPS=EJAD:DUHY$3
M=O#HJQ3 at XG&3,#%V/B7D%L.)+/WS2`.>LS/-D.V,WV*P<.(Q!1$3QRW[:[9O
M/EE5'MRMPNLEF<=L;:G+7<IS?GMYA8=<Z=:(+;?*GT9DYR^%(1NFCH:=F=T"
M2U=/T)@:_DJ><*$G[^+\MFJN9[BWCX3<K#JZF-:S+H(,KO#\)%#N)=A>2W(Z
MY7)EC,H8ZV,D\DG*]HK^+BWN$4A2YIFN9JN3_)HYQ at E\\4*BKJ+N4L6_L43B
M/QL"SXTAT)\M6^*_2K%:@/BO6BI6R\?PC^5_N_>_OD]A'AEO=D@'!^Q:\,$!
MJ^+WB=E7_O(*M(OK3P("JU5#AY0E!!,]\.V6Y3=S(KY'[F'P"G[7%+_Q&]J&
M/L++HH at HI\2>C/BC:R4><X4H>9$VQ=8YC8!P&X2Q'00&W at X"Q(@6_E:/$G\T
M$L_A9()G0"!VS(.7WD8^'A_FILEZ=4K56]>?I;1`S at DI\6H#[O0Z^LCWZ&K;
M6#>\M&$FU+-L;[5^JKC3U5I]G%8W=&:*O=KP[W0<M_1>G2JZN=IBZ.8M.JJ4
M%FNR6CG3JBF5$&TX]ZGUWKU-W=46R++GEG,+#1'Y)V"$'K#/8:@0*[B8H2RA
M-K>[HQ1Q1``T?Y;"U`B`[J8H1Z3=<)4M[=IH(X"Y90!^$W\32(J2VND2M@%3
M&B[;H6/]<UJ]?I<B3'8NFZJ-K&6X1@=<?4+O4B7JSOR4T?'&9:K98(-OZE:*
M=H-MIE92)87+'EYY2ZF>8M*S6G_'DH6T>G9%*J7!2[$1-(,U8OBBN!!XITSX
MRSI3X!X/C:KYK\95][*)[PT<'+`%B=VAS+GL=;.M`*5P^4J"\G=9-B$3;V=N
M`]D,P=[HW`*`[WIN`N$OCVZ"X`R+0KR":-Z9D33KBOJJ]6#@@]*1!+7I+_Z)
MQL@&#Z_Q(!T].(@G)P<'NYC]_VD)5WX0[3<:H_#HW_^H%$H%C/_+U>+Q[O<_
MOD>)R7_Y:E-.-__&,;;D?]5BJ03RKV+N=U*I'(/\JR?5XB[_^QXELO^_\6<W
M5A6$_P#'J?C]C6J^6"6%4JUR6BL6B&;YD]'RYS?V2+?7>=\Z;];"GQ'I-7^^
M;O6@!L;0Q\MS1FAYU_SXH=,#&DSKWXIN2`Q!^BL7V]^XD/;B[P?@ZP%9AO&C
M>#>"G1D&+TCP&\S18>X41\>>['P/[[3+G@\#B]=#\!(WB;U:D)6U;*0R>(="
MO$*!08+XT0?^4Q#BER'XNQ4L4L'>7;R0SZ\-PFA(AGBE2K-@;':'D3</365&
M^<@X*!LD)*1+"HP61![6F@[6L_-2F+EE`H2XJSI73':O=*+?<38$4M$@_,2S
M785=^U<9WU7,YGU;O#``2(*+H]#AB+UI(E at P5W1OB`>Z>(UT^:9+%N^7JA`M
M0I)'1/P>X5O0J;Z$9T)KC1E=XGZE8"YQZ.^^CI>)-4W'XU[%X#&+!DH"#.%7
MCBTNLR/`LE[*P:M]P=NGSYX?XJL7BG:'TXYH4_P]EBP[,&-OOV,>3]@.\YXD
MY9;:Z?HC1Y)06G5Q.S0K.2H,6_\$K!JRKY\DB9$XQ,MQZDRKQYXDO&<7:0H?
M$MV>'4H/4F:/?``6 at GB->S+'BWF&XGJ!4D'.S;E!M9S8\<WN/\15=I$E]=7:
M`[+_ at +-81,[*,AF'>KYCOF#;NY$W3'XER^Z!/"/;R'S+'JE$":""I$"SA`S8
M">#S*?X>D>?X]`78`6[@\^,$?LM6- at G>BDY!$1X0D=++'XODQQ_)"!*DVQ>(
MPC4HM4D1OZ-ML1DLI!BO&3\)@5 at 7WUBQ=0U=(0)IUG#);B9[4$0/;U9[]0(@
MLI8VS%[>27"7SP$9)79JZ@<'_-`4HGPVK_T'#KO at 8$+)P9#1$P-T9&\<NBRA
MF2/D702M]=5P/`(.0,MSP8C`8&8+5`"F)EDB*W at F@&_LQ.F(RC,3>(#P$&\3
M7LMF:.4O9/\9V\<:VHZ%;P,`L.#)XG`[>GH'C!>O=>W?/"PGQAU>3;X)=9C5
M+&ZR-X*ES!P3;`93'#J4&Q1J1'VL+$].P3- at LR`.C*.8)7_\@5*O%R6A/]P4
M&)^\!6K)'O.%PHNYDH2_J\2QH(,A^TB$)-5"#@4K5;N3743KP_4E5OTG5AB@
M*I1&?;\HCK39?,2A-FBO2G\ZE#)1P(@,]Q@`/Y-A\.!=-H)#>^0$QYWJ8T^<
MP^_O$7E"23$4=7)F^S]EPX/W;$R5E at 0SB1V&QU=?(@R-.>O$01:WM<#?$WFV
MMA\_(.-&']C%<OZHSH<KE.\_<_#VMDN'N)^UZ at 0.H_@L.T0G-/#/8,3N2:Q_
MA:S8-'^*-,7EL#N=^^\LL?`^_OL6?UL2N"7_@]3_.)'_G10*E5W^]SW*U^5_
M*PK"DL"3K\L!H^>`D42PW1Q`WO>NU7ZSS!+_4N)'4EX/_P;IW\K;Y8A^7>@?
M`4Z-_S<'^8^(21\?;:1QAX4<TKJ`-"JW#:%E5$<PN$R)FG9KQ*[LRJ[LRJ[L
MRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRJ[LRM]:_ at _F$VUP
$`'@`````
`
end


>Release-Note:
>Audit-Trail:
>Unformatted:



More information about the freebsd-ports-bugs mailing list