head 1.2; access; symbols pkgsrc-2013Q2:1.2.0.30 pkgsrc-2013Q2-base:1.2 pkgsrc-2012Q4:1.2.0.28 pkgsrc-2012Q4-base:1.2 pkgsrc-2011Q4:1.2.0.26 pkgsrc-2011Q4-base:1.2 pkgsrc-2011Q2:1.2.0.24 pkgsrc-2011Q2-base:1.2 pkgsrc-2009Q4:1.2.0.22 pkgsrc-2009Q4-base:1.2 pkgsrc-2008Q4:1.2.0.20 pkgsrc-2008Q4-base:1.2 pkgsrc-2008Q3:1.2.0.18 pkgsrc-2008Q3-base:1.2 cube-native-xorg:1.2.0.16 cube-native-xorg-base:1.2 pkgsrc-2008Q2:1.2.0.14 pkgsrc-2008Q2-base:1.2 pkgsrc-2008Q1:1.2.0.12 pkgsrc-2008Q1-base:1.2 pkgsrc-2007Q4:1.2.0.10 pkgsrc-2007Q4-base:1.2 pkgsrc-2007Q3:1.2.0.8 pkgsrc-2007Q3-base:1.2 pkgsrc-2007Q2:1.2.0.6 pkgsrc-2007Q2-base:1.2 pkgsrc-2007Q1:1.2.0.4 pkgsrc-2007Q1-base:1.2 pkgsrc-2006Q4:1.2.0.2 pkgsrc-2006Q4-base:1.2 pkgsrc-2006Q3:1.1.0.2 pkgsrc-2006Q3-base:1.1; locks; strict; comment @# @; 1.2 date 2006.10.31.03.31.20; author taca; state dead; branches; next 1.1; 1.1 date 2006.09.27.16.10.59; author taca; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2006.11.10.11.50.26; author salo; state dead; branches; next ; desc @@ 1.2 log @Update openssh package to 4.4.1 (openssh-4.4p1). - A few pkglint warning clean up. - Major changes are here. For complete changes, see http://www.openssh.com/txt/release-4.4. Changes since OpenSSH 4.3: ============================ Security bugs resolved in this release: * Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. * On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. This release includes the following new functionality and fixes: * Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post- authentication options are supported and more are expected to be added in future releases. * Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. * Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. * Add optional logging of transactions to sftp-server(8). * ssh(1) will now record port numbers for hosts stored in ~/.ssh/authorized_keys when a non-standard port has been requested. * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. * Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. * Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. * Many manpage fixes and improvements * New portable OpenSSH-specific features: - Add optional support for SELinux, controlled using the --with-selinux configure option (experimental) - Add optional support for Solaris process contracts, enabled using the --with-solaris-contracts configure option (experimental) This option will also include SMF metadata in Solaris packages built using the "make package" target - Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option. @ text @$NetBSD: patch-ay,v 1.1 2006/09/27 16:10:59 taca Exp $ Secunia Advisory SA22091 --- deattack.h.orig Wed Jul 4 13:46:57 2001 +++ deattack.h @@@@ -25,6 +25,7 @@@@ /* Return codes */ #define DEATTACK_OK 0 #define DEATTACK_DETECTED 1 +#define DEATTACK_DOS_DETECTED 2 -int detect_attack(u_char *, u_int32_t, u_char[8]); +int detect_attack(u_char *, u_int32_t); #endif @ 1.1 log @Add patches to fix the problem reported by Secunia Advisory SA22091 (also CVS-2006-4924); "OpenSSH Identical Blocks Denial of Service Vulnerability" referring to OpenBSD's CVS repository. Bump PKGREVISION. @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @Pullup ticket 1909 - requested by taca security update for openssh Revisions pulled up: - pkgsrc/security/openssh/Makefile 1.172, 1.173, 1.174 - pkgsrc/security/openssh/distinfo 1.55, 1.56, 1.57 - pkgsrc/security/openssh/hacks.mk 1.2 - pkgsrc/security/openssh/options.mk 1.9, 1.10 - pkgsrc/security/openssh/patches/patch-aa 1.42, 1.43 - pkgsrc/security/openssh/patches/patch-ab 1.24, 1.25 - pkgsrc/security/openssh/patches/patch-ac 1.16 - pkgsrc/security/openssh/patches/patch-ad 1.12 - pkgsrc/security/openssh/patches/patch-ae 1.12 - pkgsrc/security/openssh/patches/patch-af 1.10 - pkgsrc/security/openssh/patches/patch-ag 1.9 - pkgsrc/security/openssh/patches/patch-ah 1.24 - pkgsrc/security/openssh/patches/patch-ai 1.10 - pkgsrc/security/openssh/patches/patch-aj 1.7 - pkgsrc/security/openssh/patches/patch-ak 1.8 - pkgsrc/security/openssh/patches/patch-al 1.7 - pkgsrc/security/openssh/patches/patch-am 1.7 - pkgsrc/security/openssh/patches/patch-an 1.8 - pkgsrc/security/openssh/patches/patch-ao 1.9 - pkgsrc/security/openssh/patches/patch-ap 1.8 - pkgsrc/security/openssh/patches/patch-aq 1.6 - pkgsrc/security/openssh/patches/patch-ar 1.7 - pkgsrc/security/openssh/patches/patch-as 1.5 - pkgsrc/security/openssh/patches/patch-at removed - pkgsrc/security/openssh/patches/patch-au 1.3 - pkgsrc/security/openssh/patches/patch-av 1.5 - pkgsrc/security/openssh/patches/patch-aw 1.2 - pkgsrc/security/openssh/patches/patch-ax removed - pkgsrc/security/openssh/patches/patch-ay removed - pkgsrc/security/openssh/patches/patch-az removed Module Name: pkgsrc Committed By: taca Date: Tue Oct 31 03:31:20 UTC 2006 Modified Files: pkgsrc/security/openssh: Makefile distinfo hacks.mk options.mk pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ad patch-ae patch-af patch-ag patch-ah patch-ai patch-aj patch-ak patch-al patch-am patch-an patch-ao patch-ap patch-aq patch-ar patch-as patch-au patch-av patch-aw Removed Files: pkgsrc/security/openssh/patches: patch-at patch-ax patch-ay patch-az Log Message: Update openssh package to 4.4.1 (openssh-4.4p1). - A few pkglint warning clean up. - Major changes are here. For complete changes, see http://www.openssh.com/txt/release-4.4. Changes since OpenSSH 4.3: ============================ Security bugs resolved in this release: * Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. * On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. This release includes the following new functionality and fixes: * Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post- authentication options are supported and more are expected to be added in future releases. * Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. * Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. * Add optional logging of transactions to sftp-server(8). * ssh(1) will now record port numbers for hosts stored in ~/.ssh/authorized_keys when a non-standard port has been requested. * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. * Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. * Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. * Many manpage fixes and improvements * New portable OpenSSH-specific features: - Add optional support for SELinux, controlled using the --with-selinux configure option (experimental) - Add optional support for Solaris process contracts, enabled using the --with-solaris-contracts configure option (experimental) This option will also include SMF metadata in Solaris packages built using the "make package" target - Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option. --- Module Name: pkgsrc Committed By: taca Date: Tue Nov 7 07:08:26 UTC 2006 Modified Files: pkgsrc/security/openssh: Makefile distinfo options.mk Log Message: Update hpn-patch to hpn12v13 since old one has gone. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Nov 8 01:49:22 UTC 2006 Modified Files: pkgsrc/security/openssh: Makefile distinfo pkgsrc/security/openssh/patches: patch-aa patch-ab Log Message: Update openssh package to 4.5.1 (openssh-4.5p1). Changes: Security bugs resolved in this release: * Fix a bug in the sshd privilege separation monitor that weakened its verification of successful authentication. This bug is not known to be exploitable in the absence of additional vulnerabilities. This release includes the following non-security fixes: * Several compilation fixes for portable OpenSSH * Fixes to Solaris SMF/process contract support (bugzilla #1255) @ text @d1 1 a1 1 $NetBSD: patch-ay,v 1.1 2006/09/27 16:10:59 taca Exp $ @