Portaudit question
Chris
racerx at makeworld.com
Wed Sep 8 11:09:04 PDT 2004
Matthew Seaman wrote:
> On Wed, Sep 08, 2004 at 10:01:23AM -0500, Chris wrote:
>
>>While running portaudit, I get the complaint;
>>
>>Affected package: FreeBSD-502010
>>Type of problem: multiple vulnerabilities in the cvs server code.
>>Reference:
>><http://www.FreeBSD.org/ports/portaudit/d2102505-f03d-11d8-81b0-000347a4fa7d.html>
>>Note: To disable this check add the uuid to `portaudit_fixed' in
>>/usr/local/etc/portaudit.conf
>>
>>Am I to assume this is only if you run a cvs server? OR -
>>does this relate to the SA's put out earlier this year about the src.
>
>
> Did you read the referenced portaudit page or any of the links
> supplied by it? There are several vulnerabilities, most of which
> affect the CVS server, but one fairly minor that affects the CVS
> client.
>
> The FreeBSD advisory SA-O4:07.cvs refers to a different problem:
>
> http://www.vuxml.org/freebsd/0792e7a7-8e37-11d8-90d1-0020ed76ef5a.html
> ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc
>
> As you can see, the VuXML entry you're getting warnings about is dated
> a month after the security advisory:
>
> http://www.vuxml.org/freebsd/d2102505-f03d-11d8-81b0-000347a4fa7d.html
>
> However, the update given in the security advisory is to a version of
> CVS unaffected by either vulnerability. Update your system to the
> latest patchlevel and the problem will be fixed.
This has been done, 5.2.1-RELEASE-p9
--
Best regards,
Chris
Working capital doesn't.
More information about the freebsd-questions
mailing list