head	1.2;
access;
symbols
	pkgsrc-2013Q2:1.2.0.38
	pkgsrc-2013Q2-base:1.2
	pkgsrc-2012Q4:1.2.0.36
	pkgsrc-2012Q4-base:1.2
	pkgsrc-2011Q4:1.2.0.34
	pkgsrc-2011Q4-base:1.2
	pkgsrc-2011Q2:1.2.0.32
	pkgsrc-2011Q2-base:1.2
	pkgsrc-2009Q4:1.2.0.30
	pkgsrc-2009Q4-base:1.2
	pkgsrc-2008Q4:1.2.0.28
	pkgsrc-2008Q4-base:1.2
	pkgsrc-2008Q3:1.2.0.26
	pkgsrc-2008Q3-base:1.2
	cube-native-xorg:1.2.0.24
	cube-native-xorg-base:1.2
	pkgsrc-2008Q2:1.2.0.22
	pkgsrc-2008Q2-base:1.2
	pkgsrc-2008Q1:1.2.0.20
	pkgsrc-2008Q1-base:1.2
	pkgsrc-2007Q4:1.2.0.18
	pkgsrc-2007Q4-base:1.2
	pkgsrc-2007Q3:1.2.0.16
	pkgsrc-2007Q3-base:1.2
	pkgsrc-2007Q2:1.2.0.14
	pkgsrc-2007Q2-base:1.2
	pkgsrc-2007Q1:1.2.0.12
	pkgsrc-2007Q1-base:1.2
	pkgsrc-2006Q4:1.2.0.10
	pkgsrc-2006Q4-base:1.2
	pkgsrc-2006Q3:1.2.0.8
	pkgsrc-2006Q3-base:1.2
	pkgsrc-2006Q2:1.2.0.6
	pkgsrc-2006Q2-base:1.2
	pkgsrc-2006Q1:1.2.0.4
	pkgsrc-2006Q1-base:1.2
	pkgsrc-2005Q4:1.2.0.2
	pkgsrc-2005Q4-base:1.2
	pkgsrc-2005Q3:1.1.0.4
	pkgsrc-2005Q3-base:1.1
	pkgsrc-2005Q2:1.1.0.2;
locks; strict;
comment	@# @;


1.2
date	2005.10.19.10.34.33;	author adrianp;	state dead;
branches;
next	1.1;

1.1
date	2005.08.03.20.37.44;	author adrianp;	state Exp;
branches
	1.1.2.1;
next	;

1.1.2.1
date	2005.08.03.20.37.44;	author salo;	state dead;
branches;
next	1.1.2.2;

1.1.2.2
date	2005.08.03.23.15.40;	author salo;	state Exp;
branches;
next	;


desc
@@


1.2
log
@Update to metasploit 2.5
This is a maintenance release - all updates to 2.4 have been rolled into
2.5, along with some new exploits and minor features.
@
text
@$NetBSD: patch-aa,v 1.1 2005/08/03 20:37:44 adrianp Exp $

--- msfweb.orig	2005-08-03 21:12:33.000000000 +0100
+++ msfweb	2005-08-03 21:04:52.000000000 +0100
@@@@ -616,7 +616,18 @@@@
     my $res = {};
     
     foreach (keys(%{$state})) {
-        if (m/^OPT\_(.*)/ && defined($state->{$_})) { $res->{$1} = $state->{$_} }
+        if (m/^OPT\_(.*)/ && defined($state->{$_})) {
+			my $name = $1;
+			
+			# Block all options starting with underscore (thanks Dino!)
+			if ($name !~ /^_/) {
+				$res->{$name} = $state->{$_};
+			}
+			else {
+				# XXX - report a possible "refang" attack?
+				next;
+			}
+		}
     }
     return $res;
 }
@


1.1
log
@Add patch to address msfweb "refang" security update
Bump to nb2
make pkglint happy
@
text
@d1 1
a1 1
$NetBSD$
@


1.1.2.1
log
@file patch-aa was added on branch pkgsrc-2005Q2 on 2005-08-03 20:37:44 +0000
@
text
@d1 24
@


1.1.2.2
log
@Pullup ticket 652 - requested by Adrian Portelli
security fix for msf

Revisions pulled up:
- pkgsrc/security/msf/Makefile		1.7
- pkgsrc/security/msf/distinfo		1.6
- pkgsrc/security/msf/patches/patch-aa	1.1

   Module Name:		pkgsrc
   Committed By:	adrianp
   Date:		Sat Jul  2 12:12:33 UTC 2005

   Modified Files:
   	pkgsrc/security/msf: Makefile PLIST distinfo

   Log Message:
   - The tarball has been updated but the version number not incremented,
     so deal with this.
   - No official changelog in the tarball for what's changed
   - PLIST fixes
   - Looks like:
   	Updated certificate for online updates
   	Updated exploits notably Solaris LPD Command Execution
   	Fixes for console interface
---
   Module Name:		pkgsrc
   Committed By:	adrianp
   Date:		Wed Aug  3 20:37:44 UTC 2005

   Modified Files:
   	pkgsrc/security/msf: Makefile distinfo
   Added Files:
   	pkgsrc/security/msf/patches: patch-aa

   Log Message:
   Add patch to address msfweb "refang" security update
   Bump to nb2
   make pkglint happy
@
text
@a0 24
$NetBSD: patch-aa,v 1.1.2.1 2005/08/03 23:15:40 salo Exp $

--- msfweb.orig	2005-08-03 21:12:33.000000000 +0100
+++ msfweb	2005-08-03 21:04:52.000000000 +0100
@@@@ -616,7 +616,18 @@@@
     my $res = {};
     
     foreach (keys(%{$state})) {
-        if (m/^OPT\_(.*)/ && defined($state->{$_})) { $res->{$1} = $state->{$_} }
+        if (m/^OPT\_(.*)/ && defined($state->{$_})) {
+			my $name = $1;
+			
+			# Block all options starting with underscore (thanks Dino!)
+			if ($name !~ /^_/) {
+				$res->{$name} = $state->{$_};
+			}
+			else {
+				# XXX - report a possible "refang" attack?
+				next;
+			}
+		}
     }
     return $res;
 }
@