Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog, as demonstrated using sender addresses to Postgrey.
So all needed is to remove <dev-perl/net-server-0.88 from the tree - if there were not the problem with missing mips keyword in newer versions.
Perl any particular version that is ready for stable marking? 0.93 is already stable on a couple of arches.
i don't see any reason not to go with 0.94 - been almost a month, no direct bugs quoth the perl (not counting this one of course)
though...this bug would just as easily be solved if we ~mips one of the later ebuilds, 0.88 is stable for all arch's except mips (which is only keyworded in older versions). just a thought, my personal opinion is that this isn't worth a gsla unless we have something forcing users to use 0.87 out there...?
Michael, the point is that no user is forced to run --deep --update, so to make sure our users get the update, it's necessary either to send out a GLSA or to remove all earlier versions so the user sees the update. With regard to mips it's up to the mips team as mips is not a security-wise supported architecture. net-server-0.88 is of course fine as it is. I just did not look if removing the earlier mips keyworded version would break any other mips keyworded ebuild, so maybe KEYWORDS="-* ~mips" is needed. If the security team chooses to send out a GLSA, this would suffice as well, of course.
just let me know what you'd like perl herd to do, ebuild providing/keyword wise we're all set minus the mips stable in post 0.87.
Arches please test and mark stable net-server 0.94 (any version > 0.88 will do).
1) emerges fine, but I was surprised there was no message telling me that the test phase is entered, just went to the tests after
>>> Source compiled.
2) passes collision test
3) passes test suite
Portage 2.1-r1 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4, 2.6.17-gentoo-r4 i686)
System uname: 2.6.17-gentoo-r4 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.15
app-admin/eselect-compiler: [Not Present]
dev-util/ccache: [Not Present]
dev-util/confcache: [Not Present]
sys-devel/autoconf: 2.13, 2.59-r7
sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo"
FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS
amd64 and sparc done
(In reply to comment #5)
> just let me know what you'd like perl herd to do, ebuild providing/keyword wise
> we're all set minus the mips stable in post 0.87.
Well, I don't mind if you act or the security team.
(In reply to comment #6)
> Arches please test and mark stable net-server 0.94 (any version > 0.88 will
No, 0.88 is fine as well; I wrote <0.88. It's just the question, if there will be a GLSA or if the earlier versions will be removed. In fact version 0.94 is problematic, since the current stable postgrey version has problems with it:
|* 2006-07-17: version 1.27
| - fix socket permissions with Net::Server >= 0.94 (Leos Bitto)
no postgrey available on ppc64, so not hitting the problem. 0.94 stable on ppc64
mmm, i filled a GLSA request because it's "B1?", but execution of code doesn't seem possible according to mitre.org .
i'd vote for crash only (but then i'd vote yes for glsa).
This may change the GLSA severity and the bug severity.
(In reply to comment #12)
> no postgrey available on ppc64, so not hitting the problem. 0.94 stable on
Point is, this doesn't fix anything. Either removing older versions than 0.88 or a GLSA does.
this one is ready for glsa. Currently, this seems to be more a B3 for me, since only DoS seems be the impact in the advisories I've seen abouot to this.
-> I tend to say no.
0.94 ppc stable
Rerating and voting YES DoS.
stable on hppa
Note that at least all recent amavisd-new users are safe from this one.
ia64, mips don't forget to mark stable to benifit from the GLSA.
Does not affect current (2008.0) release. Removing release.