svn commit: r324357 - in head/security: putty putty/files vuxml

Wed Aug 7 16:11:19 UTC 2013

Author: mandree
Date: Wed Aug  7 16:11:17 2013
New Revision: 324357
URL: http://svnweb.freebsd.org/changeset/ports/324357

Log:
  Upgrade PuTTY to new 0.63 beta upstream release, adding vulnerability info.
  
  Quoting the upstream's change log:
  
  - Security fix: prevent a nefarious SSH server or network attacker from
    crashing PuTTY at startup in three different ways by presenting a maliciously
    constructed public key and signature.
  - Security fix: PuTTY no longer retains the private half of users' keys in
    memory by mistake after authenticating with them.
  - Revamped the internal configuration storage system to remove all fixed
    arbitrary limits on string lengths. In particular, there should now no longer
    be an unreasonably small limit on the number of port forwardings PuTTY can
    store.
  - Port-forwarded TCP connections which close one direction before the other
    should now be reliably supported, with EOF propagated independently in the
    two directions. This also fixes some instances of port-forwarding data
    corruption (if the corruption consisted of losing data from the very end of
    the connection) and some instances of PuTTY failing to close when the session
    is over (because it wrongly thought a forwarding channel was still active
    when it was not).
  - The terminal emulation now supports xterm's bracketed paste mode (allowing
    aware applications to tell the difference between typed and pasted text, so
    that e.g. editors need not apply inappropriate auto-indent).
  - You can now choose to display bold text by both brightening the foreground
    colour and changing the font, not just one or the other.  - PuTTYgen will now
    never generate a 2047-bit key when asked for 2048 (or more generally n−1 bits
    when asked for n).
  - Some updates to default settings: PuTTYgen now generates 2048-bit keys by
    default (rather than 1024), and PuTTY defaults to UTF-8 encoding and 2000
    lines of scrollback (rather than ISO 8859-1 and 200).
  - Unix: PSCP and PSFTP now preserve the Unix file permissions, on copies in
    both directions.
  - Unix: dead keys and compose-character sequences are now supported.
  - Unix: PuTTY and pterm now permit font fallback (where glyphs not present in
    your selected font are automatically filled in from other fonts on the
    system) even if you are using a server-side X11 font rather than a Pango
    client-side one.
  - Bug fixes too numerous to list, mostly resulting from running the code
    through Coverity Scan which spotted an assortment of memory and resource
    leaks, logic errors, and crashes in various circumstances.
  
  Security:	4b448a96-ff73-11e2-b28d-080027ef73ec
  Security:	CVE-2013-4206
  Security:	CVE-2013-4207
  Security:	CVE-2013-4208
  Security:	CVE-2013-4852

Deleted:
  head/security/putty/files/patch-timing.c
Modified:
  head/security/putty/Makefile
  head/security/putty/distinfo   (contents, props changed)
  head/security/vuxml/vuln.xml

Modified: head/security/putty/Makefile
==============================================================================

--- head/security/putty/Makefile	Wed Aug  7 16:06:21 2013	(r324356)
+++ head/security/putty/Makefile	Wed Aug  7 16:11:17 2013	(r324357)
@@ -1,8 +1,7 @@
 # $FreeBSD$
 
 PORTNAME=	putty
-PORTVERSION=	0.62
-PORTREVISION=	3
+PORTVERSION=	0.63
 CATEGORIES=	security ipv6
 MASTER_SITES=	http://the.earth.li/~sgtatham/putty/%SUBDIR%/ \
 		ftp://ftp.chiark.greenend.org.uk/users/sgtatham/putty-latest/

Modified: head/security/putty/distinfo
==============================================================================
--- head/security/putty/distinfo	Wed Aug  7 16:06:21 2013	(r324356)
+++ head/security/putty/distinfo	Wed Aug  7 16:11:17 2013	(r324357)
@@ -1,2 +1,2 @@
-SHA256 (putty-0.62.tar.gz) = 8d187e86ee18c839895d263607b61788778564e3720e8d85c5305a04f9da0573
-SIZE (putty-0.62.tar.gz) = 1783106
+SHA256 (putty-0.63.tar.gz) = 81e8eaaf31be7d9a46b4f3fb80d1d9540776f142cd89d0a11f2f8082dc68f8b5
+SIZE (putty-0.63.tar.gz) = 1887913

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Wed Aug  7 16:06:21 2013	(r324356)
+++ head/security/vuxml/vuln.xml	Wed Aug  7 16:11:17 2013	(r324357)
@@ -51,6 +51,48 @@ Note:  Please add new entries to the beg
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="4b448a96-ff73-11e2-b28d-080027ef73ec">
+    <topic>PuTTY -- Four security holes in versions before 0.63</topic>
+    <affects>
+      <package>
+	<name>putty</name>
+	<range><lt>0.63</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Simon Tatham reports:</p>
+	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html">
+	  <p>This [0.63] release fixes multiple security holes in previous versions of
+	    PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
+	    underrun buffers and crash. [...]
+	  </p><p>
+	    These vulnerabilities can be triggered before host key verification,
+	    which means that you are not even safe if you trust the server you
+	    <em>think</em> you're connecting to, since it could be spoofed over the
+	    network and the host key check would not detect this before the attack
+	    could take place.
+	  </p><p>
+	    Additionally, when PuTTY authenticated with a user's private key, the
+	    private key or information equivalent to it was accidentally kept in
+	    PuTTY's memory for the rest of its run, where it could be retrieved by
+	    other processes reading PuTTY's memory, or written out to swap files
+	    or crash dumps. This release fixes that as well.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2013-4206</cvename>
+      <cvename>CVE-2013-4207</cvename>
+      <cvename>CVE-2013-4208</cvename>
+      <cvename>CVE-2013-4852</cvename>
+    </references>
+    <dates>
+      <discovery>2013-07-08</discovery>
+      <entry>2013-08-07</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="e6839625-fdfa-11e2-9430-20cf30e32f6d">
     <topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
     <affects>
