From owner-freebsd-questions@FreeBSD.ORG Fri Oct 6 03:40:19 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7B8B216A407 for ; Fri, 6 Oct 2006 03:40:19 +0000 (UTC) (envelope-from freebsd-questions@m.gmane.org) Received: from ciao.gmane.org (main.gmane.org [80.91.229.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id F01F043D49 for ; Fri, 6 Oct 2006 03:40:18 +0000 (GMT) (envelope-from freebsd-questions@m.gmane.org) Received: from root by ciao.gmane.org with local (Exim 4.43) id 1GVgZ8-0002MH-Ct for freebsd-questions@freebsd.org; Fri, 06 Oct 2006 05:40:02 +0200 Received: from 62-2-105-50.static.cablecom.ch ([62.2.105.50]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 06 Oct 2006 05:40:02 +0200 Received: from wolf by 62-2-105-50.static.cablecom.ch with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 06 Oct 2006 05:40:02 +0200 X-Injected-Via-Gmane: http://gmane.org/ To: freebsd-questions@freebsd.org From: Alain Wolf Date: Fri, 06 Oct 2006 05:18:27 +0200 Lines: 44 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: 62-2-105-50.static.cablecom.ch User-Agent: Thunderbird 1.5.0.7 (Windows/20060909) X-Enigmail-Version: 0.94.0.0 OpenPGP: id=6CB1BC68; url=http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x579319666CB1BC68 Sender: news Subject: port php5 - what I am supposed to do here? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Oct 2006 03:40:19 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello List, Portuadit telles my about the "open_basedir Race Condition Vulnerability", OK. By reading the advisory on http://www.hardened-php.net/advisory_082006.132.html I can safely say this does not apply to our environment, we don't use open_basedir or safe_mode and Suhosin is planned anyway (after test). With a "portsnap fetch update" I get a new version php5-5.1.6_1 in my portstree, OK. But "portmanager -u" or even manually with "make install clean" everything fails with the following message: ===> php5-5.1.6_1 has known vulnerabilities: => php -- open_basedir Race Condition Vulnerability. Reference: => Please update your ports tree and try again. *** Error code 1 So what to do now? There are quite a lot if dependencies which i can't update too now. Also installing/enabling Suhosin seems not possible anymore now. Any suggestions are welcome. Greetings fomr Switzerland Alain Wolf -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFJcsDV5MZZmyxvGgRAn4oAKDBqaGjcOflahgH4XRp6WCg0T6qLQCg3uni vk77USw9+yElWvFCJBcDHxs= =4wj4 -----END PGP SIGNATURE-----