From owner-freebsd-ports@FreeBSD.ORG  Sun Mar 11 21:40:31 2012
Return-Path: <owner-freebsd-ports@FreeBSD.ORG>
Delivered-To: ports@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 47CD6106564A;
	Sun, 11 Mar 2012 21:40:31 +0000 (UTC)
	(envelope-from simon@FreeBSD.org)
Received: from emx.nitro.dk (emx.nitro.dk [IPv6:2a01:4f8:120:7384::102])
	by mx1.freebsd.org (Postfix) with ESMTP id 049F08FC16;
	Sun, 11 Mar 2012 21:40:31 +0000 (UTC)
Received: from mailscan.leto.nitro.dk (mailscan.leto.nitro.dk [127.0.1.4])
	by emx.nitro.dk (Postfix) with ESMTP id 5E84E21313B;
	Sun, 11 Mar 2012 21:40:30 +0000 (UTC)
Received: from emx.nitro.dk ([127.0.1.2])
	by mailscan.leto.nitro.dk (mailscan.leto.nitro.dk [127.0.1.4])
	(amavisd-new, port 10024)
	with LMTP id MJxxggS-aNes; Sun, 11 Mar 2012 21:40:28 +0000 (UTC)
Received: from [192.168.4.23] (unknown [89.100.2.211])
	(using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	by emx.nitro.dk (Postfix) with ESMTPSA id 0031E213139;
	Sun, 11 Mar 2012 21:40:27 +0000 (UTC)
From: "Simon L. B. Nielsen" <simon@FreeBSD.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Date: Sun, 11 Mar 2012 21:40:26 +0000
References: <201203112132.q2BLWwTZ074498@repoman.freebsd.org>
To: ports@FreeBSD.org,
 security@FreeBSD.org
Message-Id: <0E8E530C-BD7D-46BD-80A0-BE947D73429E@FreeBSD.org>
Mime-Version: 1.0 (Apple Message framework v1257)
X-Mailer: Apple Mail (2.1257)
Cc: 
Subject: Upgrade port audit now!
X-BeenThere: freebsd-ports@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Porting software to FreeBSD <freebsd-ports.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
	<mailto:freebsd-ports-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports>
List-Post: <mailto:freebsd-ports@freebsd.org>
List-Help: <mailto:freebsd-ports-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
	<mailto:freebsd-ports-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 11 Mar 2012 21:40:31 -0000

Hey,

If you have portaudit installed, you should upgrade sooner rather than =
later!

Begin forwarded message:

> From: "Simon L. Nielsen" <simon@FreeBSD.org>
> Subject: cvs commit: ports/ports-mgmt/portaudit Makefile pkg-plist =
ports/ports-mgmt/portaudit/files portaudit-cmd.sh
> Date: 11 March 2012 21:32:58 GMT
> To: ports-committers@FreeBSD.org, cvs-ports@FreeBSD.org, =
cvs-all@FreeBSD.org
>=20
> simon       2012-03-11 21:32:58 UTC
>=20
>  FreeBSD ports repository
>=20
>  Modified files:
>    ports-mgmt/portaudit Makefile pkg-plist=20
>    ports-mgmt/portaudit/files portaudit-cmd.sh=20
>  Log:
>  Portaudit 0.6.0:
>=20
>  Fix remote code execution which can occur with a specially crafted
>  audit file.  The attacker would need to get the portaudit(1) to
>  download the bad audit database, e.g. by performing a man in the
>  middle attack.
>=20
>  Add signature verification of the portaudit database.  The public key
>  is for the database generated for portaudit.FreeBSD.org is included
>  in the distribution.
>=20
>  Submitted by:   Michael Gmelin <freebsd@grem.de>
>  Reported by:    Michael Gmelin <freebsd@grem.de>, Joerg Scheinert
>  Security:       Remote code execution
>  Security:       =
http://vuxml.FreeBSD.org/6d329b64-6bbb-11e1-9166-001e4f0fb9b1.html
>  Feature safe:   yes
>  With hat:       so

--=20
Simon L. B. Nielsen
FreeBSD Deputy Security Officer