Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 51585 - net-misc/sitecopy-0.13.4 using vulnerable libneon
Summary: net-misc/sitecopy-0.13.4 using vulnerable libneon
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High enhancement (vote)
Assignee: Gentoo Security
URL: http://www.openpkg.org/security/OpenP...
Whiteboard: B2 [glsa?]
Keywords:
Depends on:
Blocks:
 
Reported: 2004-05-20 12:16 UTC by Sune Kloppenborg Jeppesen
Modified: 2011-10-30 22:39 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen gentoo-dev 2004-05-20 12:16:16 UTC
Original libneon bug #51490
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2004-05-21 00:47:45 UTC
No official upstream fix.
I suppose we should include the neon 0.24.6 corrected files as a patch.

agriffis, there is no maintainer and you were the last to act on this one : do you think you can produce a patched 0.13.4-r2 ?
Comment 2 Kurt Lieber (RETIRED) gentoo-dev 2004-05-28 10:39:59 UTC
also cc'ing lanius since he was recently active in the changelog.
Comment 3 Kurt Lieber (RETIRED) gentoo-dev 2004-06-03 06:20:58 UTC
Emailed the author asking for a status update.  He confirmed the vulnerability and did not have any immediate plans to issue a patched version of his software that is not vulnerable.

Recommend hard masking in portage and issuing a GLSA.
Comment 4 Kurt Lieber (RETIRED) gentoo-dev 2004-06-03 06:34:36 UTC
Sent to gentoo-dev:

"Re: http://bugs.gentoo.org/show_bug.cgi?id=51585

The author of that package has indicated he has no immediate plans to release a new version of his program that contains the fixes for the security vulnerability.  This package also seems to be unmaintained in portage at the moment, so unless someone wants to pick up the maintainership of this package and backport the fixes to it, it will be security masked in portage in 24 hours and we'll be issuing a GLSA explaining the issue.

--kurt"
Comment 5 Thierry Carrez (RETIRED) gentoo-dev 2004-06-05 03:06:25 UTC
The masking GLSA is ready but cannot be sent until sitecopy is hard-masked.
Comment 6 Kurt Lieber (RETIRED) gentoo-dev 2004-06-05 04:02:46 UTC
hard masked in portage.
Comment 7 Thierry Carrez (RETIRED) gentoo-dev 2004-06-05 04:57:03 UTC
Temporary GLSA 200406-03 issued
Comment 8 Kurt Hindenburg 2004-06-12 01:06:50 UTC
Is this patch good enough to un-mask this package?  I've tested it and it appears to not ever use the libneon packaged with sitecopy (libneon/ is not compiled).  If the user tries to use --nodep, econf will die.

--- sitecopy-0.13.4-r1.ebuild   2004-04-26 14:24:47.000000000 -0500
+++ sitecopy-0.13.4-r9.ebuild   2004-06-12 02:07:49.141909824 -0500
@@ -20,7 +20,8 @@
        gnome? (
                gnome-base/gnome-libs
                =x11-libs/gtk+-1*
-       )"
+       )
+       >=net-misc/neon-0.24.6"

 src_compile() {
        local myconf=""
@@ -41,6 +42,10 @@
                && myconf="${myconf} --enable-nls" \
                || myconf="${myconf} --disable-nls"

+       # Bug 51585, GLSA 200406-03
+       einfo "Forcing the use of the system-wide neon library (BR #51585)."
+       myconf="${myconf} --with-neon"
+
        econf ${myconf} || die "econf failed"

        emake || die "emake failed"
Comment 9 Thierry Carrez (RETIRED) gentoo-dev 2004-06-15 12:56:10 UTC
We currently lack a maintainer for this package, so evaluation could take a little while. Thank you for providing this patch !
Comment 10 Thomas L. Kjeldsen 2004-07-12 08:36:59 UTC
Just for the records: The solution suggested by Kurt V. Hindenburg is now used by the FreeBSD port.

http://www.freebsd.org/cgi/query-pr.cgi?pr=68461
Comment 11 Kurt Lieber (RETIRED) gentoo-dev 2004-07-16 07:16:47 UTC
sent mail to -dev asking for someone to take on this package.  Will remove from portage in 3 days if no action.

Comment 12 Chris White (RETIRED) gentoo-dev 2004-07-16 10:11:41 UTC
configure: using neon library 0.24.6

uses the right neon version

>>> net-misc/sitecopy-0.13.4-r2 merged.

compiled

in cvs.
Comment 13 Thierry Carrez (RETIRED) gentoo-dev 2004-07-19 00:38:20 UTC
x86, ppc, sparc : please package.unmask, test and mark net-misc/sitecopy-0.13.4-r2 stable.
Comment 14 Thierry Carrez (RETIRED) gentoo-dev 2004-08-02 04:43:21 UTC
*bump*
x86, ppc, sparc : please package.unmask, test and mark net-misc/sitecopy-0.13.4-r2 stable.
*bump*
Comment 15 Jason Wever (RETIRED) gentoo-dev 2004-08-07 09:37:41 UTC
Stable on sparc.  Staying on the bug until it's removed from package mask
Comment 16 Pieter Van den Abeele (RETIRED) gentoo-dev 2004-08-12 12:58:12 UTC
stable on ppc
Comment 17 Chris White (RETIRED) gentoo-dev 2004-08-13 22:24:05 UTC
Stable on x86.

used sitecopy with one of my websites.
setup with the website.
syncronized, modified files, deleted files, moved files
sync'ed with my site.

All works well.

GLSA part next.
Comment 18 Chris White (RETIRED) gentoo-dev 2004-08-13 22:25:39 UTC
Er.. removing the cc for x86 would help....

*cough* no one saw that... *cough*
Comment 19 Chris White (RETIRED) gentoo-dev 2004-08-14 23:37:19 UTC
"Stable on sparc.  Staying on the bug until it's removed from package mask"

Weeve:

sitecopy is package.unmasked now, removing sparc from CC.
Comment 20 Sune Kloppenborg Jeppesen gentoo-dev 2004-08-15 08:12:53 UTC
Updated GLSA. Question is should we rerelease it?
Comment 21 Thierry Carrez (RETIRED) gentoo-dev 2004-09-01 04:22:07 UTC
Good question... Information provided in that GLSA is correct but superseded by more recent information. I think we should issue an "UPDATE:"-type GLSA for these things but I also think it would confuse most users if not properly presented (it should talk about the previous state to explain the update a little more).

More opinions needed.
Comment 22 Thierry Carrez (RETIRED) gentoo-dev 2004-09-02 07:53:33 UTC
GLSA update has been decided not to be needed. Closing.
Sitecopy, welcome back.