Date: Tue, 23 Aug 2016 08:23:08 +0200 From: Gerhard Schmidt <estartu@ze.tum.de> To: Roger Marquis <marquis@roble.com>, freebsd-security@freebsd.org Subject: Re: Ports EOL vuxml entry Message-ID: <a0a8f797-859e-23f7-7606-72a7dc50acb0@ze.tum.de> In-Reply-To: <3sHwFX4YYpz1y2W@mailrelay2.lrz.de> References: <6c3a84dc-5669-039c-6fa1-92565dd47dff@ze.tum.de> <3sHwFX4YYpz1y2W@mailrelay2.lrz.de>
next in thread | previous in thread | raw e-mail | index | archive | help
Am 22.08.2016 um 15:54 schrieb Roger Marquis: >> today there was a new entry added to the vuxml file including all >> outdated ports. Where is the value in this Entry. > > This is good news for many of us Gerhard, who depend on the output of > 'pkg audit' for vulnerability information. Is an outdated (EOL) port a vulnerability? I don't think so. It's a possible vulnerability, but not a real one. >> In this file should only are real vulnerabilities and not maybe >> vulnerable not existing ports. > > You raise two issues here, A) what constitutes a 'real' vulnerability > and B) how else would you be warned of probable vulnerabilities (due to > unmaintained and unaudited code). There is 'pkg version' of course but > few sites use this flag and fewer still use it for vulnerability > information. A real vulnerability is a bug in the software that allows a attacker to gain access to a system or a higher level of access on a system. Most code is really unaudited. Many of the recent security problem where in well maintained code. So saying that unaudited and unmaintained code is a vulnerability is wrong. It's a security risk. But the vuxml database is not about security risks. It's about actual and proven vulnerabilities. >> Right now this breaks my system to find vulnerable ports on my systems >> because all systems with legacy code show up with this entry. > > Can you post details of how it breaks your system? I'm monitoring my FreeBSD Servers (about 60 of them) with icinga an have a test that queries pkg audit if any of the installed packages are vulnerable. I have some servers that run legacy code that still needs python24. Every one of this machines reports right now that there is a vulnerable package installed and there is no way to tell pkg audit to stop reporting it. Sure i can filter python24 from the pkg audit output so it doesn't trigger the warning. But if a real vulnerability is reported for python24 i don't get it. I know that's a theoretical possibility, but still it reduces my systems reliability. >> Maybe pkg audit should be print a warning (suppressible by a commandline >> switch or a whiltelist in the config file) when discontinued ports are >> installed. > > A command line switch to ignore deprecated, discontinued and otherwise > unadited ports is an excellent idea though I don't think there will be > much demand for it. A default 'warn if deprecated' will no doubt be the > modal usage and benefit the larger community (who have until now been > mislead by the output of 'pkg audit'). As stated in the original mail. Outdated unmaintained ports should not be part of the vulnerability Database because they are no vulnerability. They are a different kind of Security risk and pkg audit should report them by default as that, but not as vulnerability. There should be a way to state that the sysadmin is aware of the outdated port and prevent pkg audit from reporting it over and over again. We could do that easily in the pkg.conf. A line like ignore_outdated=python24 would be sufficient. Regards Estartu -- ---------------------------------------------------------- Gerhard Schmidt | E-Mail: schmidt@ze.tum.de Technische Universität München | Jabber: estartu@ze.tum.de WWW & Online Services | Tel: +49 89 289-25270 | PGP-PublicKey Fax: +49 89 289-25257 | on request -- ------------------------------------------------- Gerhard Schmidt | E-Mail: schmidt@ze.tum.de TU-München | Jabber: estartu@ze.tum.de WWW & Online Services | Tel: 089/289-25270 | Fax: 089/289-25257 | PGP-Publickey auf Anfrage
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?a0a8f797-859e-23f7-7606-72a7dc50acb0>