02:00 eadler 

Clean up the portaudit port
- let the ports-secteam maintain this port instead of secteam.  This should
assign PRs to the appropriate place. [1]
- recent freebsd versions should use pkg audit instead of portaudit
- stagify
- remove mention of preference file format changes which changed in 2004

PR:		ports/184004 (partial
Discussed with:	simon (many months ago) [1]

 

21:32 simon 

Portaudit 0.6.0:

Fix remote code execution which can occur with a specially crafted
audit file.  The attacker would need to get the portaudit(1) to
download the bad audit database, e.g. by performing a man in the
middle attack.

Add signature verification of the portaudit database.  The public key
is for the database generated for portaudit.FreeBSD.org is included
in the distribution.

Submitted by:   Michael Gmelin <freebsd@grem.de>
Reported by:    Michael Gmelin <freebsd@grem.de>, Joerg Scheinert
Security:       Remote code execution
Security:      
http://vuxml.FreeBSD.org/6d329b64-6bbb-11e1-9166-001e4f0fb9b1.html
Feature safe:   yes
With hat:       so