- Implement an idea from Lex van Roon <r3boot@r3blog.nl.eu.org> providing
an alert/heartbeat deletion performance improvement in the order of
3000% (preludedb-admin already benefit from it, next Prewikka release
will benefit from it too).
- Fix --with-(perl|python|swig) detection path ordering.
- Verbose error reporting on logfile opening error.
- Various bug fixes.
- Fix checking for swig/perl/python when full path to the
application is specified.
- Fix OpenBSD getaddrinfo() AI_ADDRCONFIG issue (apply to
some other system as well).
- Fix workaround for system with broken libtool,
that prevented the use of plugin (#168).
From debian changelog:
signing-party (0.4.7-1) unstable; urgency=low
* gpg-mailkeys: use right content-type for attached key,
thanks Wesley Landaker
* gpgsigs: recognize rvk (revoker), found in ksp-dc6.txt.
v0.998
- declare socket as opened before calling fatal_ssl_error
because the SSL_error_trap set up from HTTP::Daemon
needs this
- accept_SSL sets errors on $socket (the accepted socket)
not $self (the listening socket if called from accept)
so it can be queried from SSL_error_trap
- note in BUGS section that IO::Socket::SSL is not thread-safe
Note: The previous update from 0.97 broke all https:// URLs in p5-libwww,
will address that in next commit (to p5-libwww)
host monkeybyte.org[69.16.221.13] said: 550-"The
recipient cannot be verified. Please check all recipients of this 550
message to verify they are valid." (in reply to RCPT TO command)
"A security issue has been reported in Heimdal, which potentially can be
exploited by malicious, local users to perform certain actions with
escalated privileges.
The security issue is caused due to missing checks for whether the
"setuid()" call has succeeded in the bundled rcp application. This may
be exploited to perform certain actions with root privileges if the
"setuid()" call fails due to e.g. resource limits."
http://secunia.com/advisories/21436/http://www.pdc.kth.se/heimdal/advisory/2006-08-08/
Bump PKGREVISION.
v0.997
- fix readline (e.g. getline,getlines,<>) so that it behaves
regarding $/ like written in the $/ dokumentation.
v0.996
- removed links and comments to inofficial release of
Net::SSLeay, because there is a newer version already
v0.995
- add support for Diffie Hellman Key Exchange.
See parameter SSL_dh_file and SSL_dh.
v0.994
- hide DEBUG statements and remove test to load Debug.pm
because packets like Spamassisin cannot cope with it
(at least the OpenBSD port)
v0.993
- added SSL_cert and SSL_key parameter which do not take
a file name like SSL_cert_file and SSL_key_file but
an internal X509* resp. EVP_PKEY* value. Useful for
dynamically created certificates and keys.
- added test for sysread/syswrite behavior (which was changed
in v0.991)
v0.992
- _set_rw_error does $!||=EAGAIN only if error is one of
SSL_WANT_READ|SSL_WANT_WRITE (patch from Mike Smith
<mike at mailchannels dot com>)
- Fix Makefile.PL to allow detectection of failures in PREREQ_PM
(http://rt.cpan.org/Public/Bug/Display.html?id=20563, patch
by alexchorny at gmail dot com)
v0.991
- sysread and syswrite ar no longer the same as read and write,
but can return already if only parts of the data are read
or written (which is the usual semantic for sysread and syswrite)
This should fix problems with HTTP::Daemon::SSL
v0.99
- just upgrade Version number because I've screwed up upload
of v0.98 to cpan
v0.98
- Maintainer changed to <Steffen_Ullrich at genua dot de>
- Better support for nonblocking sockets:
. exports $SSL_ERROR which contains the latest error from
the openssl library. Exports constants SSL_WANT_READ and
SSL_WANT_WRITE es special errors which will be set if
openssl wants to write or read during nonblocking connects,
accepts, reads or writes.
. accept,accept_SSL,connect and connect_SSL don't block
anymore if the socket is nonblocking.
Instead $! will be set from the underlying IO::Socket::INET
connect or accept if it failed there (usually EAGAIN or
EINPROGRESS) or if the underlying openssl needs to read or
write $! will be set to EAGAIN and $SSL_ERROR will be set
to SSL_WANT_READ or SSL_WANT_WRITE
. syswrite returns undef and sets $!,$SSL_ERROR if it fails
to write instead of returning 0.
- Bugfixes (http://rt.cpan.org/Public/Bug/Display.html?id=Bugid)
. Bug 18439: fileno 0 should be valid
. Bug 15001: sysread interpretes buffer "0" as ""
- peer_certifcate returns X509 struct string if no field
for extraction was specified
- get_peer_certificate returns the certificate instead of the
IO::Socket::SSL object
security update, recommended by gnupg.org
(fixes CVE-2006-3746)
changes:
* More DSA2 tweaks.
* Fixed a problem uploading certain keys to the smart card.
* Fixed 2 more possible memory allocation attacks.
* Added Norwegian translation.
since they always need a C compiler, even when the source code is
completely in C++.
For some other packages, stated in the comment that a C compiler is
really not needed.
in PR 32761.
Noteworthy changes in version 1.1.0 (2005-10-01)
------------------------------------------------
* You can now configure the backend engine file name and home
directory to be used, as default and per context.
* Information about the recipients of an encrypted text is now
available at decryption time.
* New status GPGME_STATUS_PLAINTEXT. This is analyzed by the decrypt
and verify handlers, the information about the plaintext filename,
if available is made available in the new field file_name of the
respective result structure.
* The code for "automagically detecting the thread library" has been
removed from libgpgme. It is deprecated since version 0.4.3.
Since then, you had to link against libgpgme-pthread for
applications using pthread and libgpgme-pth for applications using
GNU Pth.
The code was removed because it caused compilation problems on
systems where the pthread.h header from GNU Pth is available in
addition to the system header (FreeBSD 6 and later for example).
* There is a new flag for keys and subkeys, is_qualified, which
indicates if a key can be used for qualified signatures according
to local government regulations.
* You can associate a filename with a data object using the new
function gpgme_data_set_file_name(). This filename will be stored
in the output when encrypting or signing the data and will be
returned when decrypting or verifying the output data.
* You can now set notation data at signature creation with the new
function gpgme_sig_notation_add().
* Interface changes relative to the 1.0.3 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
gpgme_set_engine_info NEW
gpgme_ctx_get_engine_info NEW
gpgme_ctx_set_engine_info NEW
gpgme_recipient_t NEW
gpgme_decrypt_result_t EXTENDED: New field recipients.
gpgme_verify_result_t EXTENDED: New fields pubkey_algo, hash_algo.
gpgme_decrypt_result_t EXTENDED: New field plaintext_filename.
gpgme_verify_result_t EXTENDED: New field plaintext_filename.
GPGME_STATUS_PLAINTEXT NEW
gpgme_key_t EXTENDED: New field is_qualified.
gpgme_subkey_t EXTENDED: New field is_qualified.
gpgme_data_get_file_name NEW
gpgme_data_set_file_name NEW
gpgme_sig_notation_flags_t NEW
GPGME_SIG_NOTATION_HUMAN_READABLE NEW
GPGME_SIG_NOTATAION_CRITICAL NEW
gpgme_sig_notation_clear NEW
gpgme_sig_notation_add NEW
gpgme_sig_notation_get NEW
had actually been ignoring LTCONFIG_OVERRIDE anyway and just using
the default LIBTOOL_OVERRIDE to replace libtool scripts in packages.
This just formalizes the fact that LTCONFIG_OVERRIDE is not used
meaningfully by pkgsrc.
* Version 1.4.1 (released 2006-06-14)
** Replaced inactive ifdefs to enable openpgp support in test programs.
** Fixed bug in OpenPGP authentication handshake.
** Fixed typographical in man pages.
** Build fixes of the manual.
** Added Swedish translation.
** API and ABI modifications:
No changes since last version.
2.0.12:
Bugs fixed in this release:
bug #1455772: Implement more portable fix for converting UTF-8 in
comments. The previous one broke the Windows installer.
2.0.11:
Bugs fixed in this release:
* fixes to make code compile with g++ 4.1.
* bug #1455772: Properly convert comments to/from UTF-8 to ensure the
script is not corrupted when copied to the firewall
* bug #1455748: "make firewall script executable".
Bugs fixed in policy compiler for iptables:
* bug #1375432: avoid using '-m state' twice for stateless rules with
with custom services.
* bug#1364060: change shell pattern to match names of conntrack modules
in Linux 2.6.
Bugs fixed in policy compiler for ipfilter:
* bug #1386226: removed nat.conf when nat rules are removed.
* bug #1393004: use 'egrep -s' on Solaris.
- Fix a bug where some rules marked silent would trigger an alert.
- Load Sonicwall and Spamassassin ruleset by default.
- Fix rule syntax problem in Sonicwall ruleset.
- Fix rule indexing problem in Squid ruleset.
- Postfix rule consistency fix.
and add a new helper target and script, "show-buildlink3", that outputs
a listing of the buildlink3.mk files included as well as the depth at
which they are included.
For example, "make show-buildlink3" in fonts/Xft2 displays:
zlib
fontconfig
iconv
zlib
freetype2
expat
freetype2
Xrender
renderproto
set OVERRIDE_DIRDEPTH to find any libtool scripts deeper in the WRKSRC
tree unless they're named something other than "libtool".
SHLIBTOOL_OVERRIDE generally doesn't need to be specified either -- just
define it to the empty list and shlibtool-override will look for libtool
scripts.
Since the heimdal install process will install additional headers in
${PREFIX}/include/krb5 depending on what the configure process detects,
simply query the source Makefile at install-time for the extra headers
that it will install and dynamically add them to the PLIST.
changes:
- Fix asn1_octet_der to handle writes of zero-length buffers, before
it did not write the ASN.1 length for a zero-length buffer. This caused
ASN.1 encodings to be incorrect on 64-bit platforms.
- Add self test that attempt to trigger the above bug.
- Fix test of -Wno-pointer-sign.
- Improve cross-compilation to MinGW by using AC_LIBTOOL_WIN32_DLL.
Noteworthy changes in version 1.4.4 (2006-06-25)
------------------------------------------------
* User IDs are now capped at 2048 byte. This avoids a memory
allocation attack (see CVE-2006-3082).
[was already fixed in pkgsrc]
* Added support for the SHA-224 hash. Like the SHA-384 hash, it
is mainly useful when DSS (the US Digital Signature Standard)
compatibility is desired.
* Added support for the latest update to DSA keys and signatures.
This allows for larger keys than 1024 bits and hashes other than
SHA-1 and RIPEMD/160. Note that not all OpenPGP implementations
can handle these new keys and signatures yet. See
"--enable-dsa2" in the manual for more information.
"parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions,
allows remote attackers to cause a denial of service (gpg crash) and
possibly overwrite memory via a message packet with a large length,
which could lead to an integer overflow, as demonstrated using the
--no-armor option."
Patch from GnuPG CVS repository.
Bump PKGREVISION.
Always use "man" instead of catpages.
Make sure "run" directory is precreated, so you don't get:
/usr/bin/sudo sudo: can't mkdir /var/run/sudo: No such file or directory
Bump PKGREVISION.
Okayed by maintainer back in December. The only concern was
that /var/run may not be for all platforms, but this is same
as other packages to (not specific to sudo).
Pkgsrc changes:
- none
Relevant changes since version 5.31:
====================================
- modified addfile to accept indirect filehandles
-- ref. rt.cpan.org #19627 and #19641
- modified shasum to warn rather than die for file errors
-- to follow conventions of GNU sha1sum/md5sum
- added new capabilities to the "addfile" method
-- now able to accept file names as well as handles
-- includes mode for portable digest calculation
-- thanks to Adam Kennedy for emails and ideas
ref. File::LocalizeNewlines
- used expanded addfile interface to simplify shasum (sumfile)
-- regex a tad less general than 5.37, but handles all
known newline variants in UNIX/Windows/MacOS
- enhanced WARNING messages from shasum checkfile processing
-- to mimic behavior of md5sum
- improved error handling of checksum files in shasum
-- to better mimic the behavior of md5sum
- refined line-break regex in shasum (ref. sub sumfile)
-- catches multiple CR's preceding LF
thanks to Gisle Aas for suggested patch
- changed loop vars to signed int's in shadump (ref. src/sha.c)
-- to prevent type mismatch warnings
- added "portable" option to shasum
-- to make digests match across Windows/Unix/MacOS
- enabled bundling of shasum command line options
-- to mimic behavior of md5sum
- removed \r's from text files in t/nist directory
-- resolves SIGNATURE clashes (rt.cpan.org #18983)
- changed suffix on SHA64_MAX (src/sha.h) to ULL
-- eliminates gcc warnings (rt.cpan.org #18988)
- specified minimum Perl version for module and Makefile.PL
-- closes rt.cpan.org #18984
- made minor code changes to silence compiler warnings
-- resulting from signed/unsigned integer mixing
> - 6/4/2006 1.2.5 (sarah)
> - Added base64 encoding support for MAC addresses presented on the screen for FLoP extended database -- Juergen Leising
> - Added base64 encoding support for rebuild of packet in pcap format for FLoP extended database -- Juergen Leising
> - Fixed issue with Oracle and schema version in base_db.inc.php -- Nikns
> - Fixed bug when alerts with sig references would fail to archive causing duplicates error -- Nikns
> - Added base64 encoding support for ICMP payload additional table in base_qry_alert.php -- Juergen Leising
> - Added check for PHP Logging Level against E_NOTICES in setup/index.php -- Nikns
> - Fixed bug when certain preprocessor alerts would not be cached (for example arpspoof) -- Nikns
> - Added setup/setup_db.inc.php with CreateBASEAG() to resolve redundancy in setup and base_db_setup.php -- Nikns
> - Removed unnecessary and broken search index stuff from Create BASE AG, since schemas are already with them -- Nikns
> - Added XSSPrintSafe() (array safe htmlspecilchars() function) and made filterSql() use ADOdb qmagic() -- Nikns
> - Changed input type of the password field to actually be password in setup3.php -- Nikns
> - Filtered all unfiltred (mainly auth system stuff) $_POST and $_GET variables using filterSql() -- Nikns
> - Santized all $_SERVER variables to be protected against XSS attacks -- Nikns
> - Added "Clear Data Tables" option in base_maintenance.php and "Repair Tables" option to execute CreateBASEAG() -- Nikns
> - Make use of FLoP's event reference. Signature name of alert which trigered "Tagged Packet" alert is shown too -- Nikns
> - Updated chinese.lang.php -- Johnson Chiang
> - Fixed Time error in searches -- Jeff Kell
> - Fixed refresh issue with ~ directories -- Kevin Johnson
> - Fixed cookie stored data and authentication scheme to correct Nikns' report on session forge issue -- GaRaGeD
> - Updated link to the Nessus plug in DB -- Jonathan W Miner
> - Fixed display after deleting alerts -- Bruce Briggs
> - Fixed Bug #1466392 - Back button doesn't work after refresh. -- Juergen Leising
> - Patches from jhart@spoofed.org to add missing ICMP and TCP type and codes - GaRaGeD
> - add support for ICMP redirect decoding. - Jon Hart
> - add decoding support for ICMP source quench and ICMP parameter problem - Jon Hart
> - split up "flags" into DF and MF, much like tcp flags are currently handled - Jon Hart
these indices web browser will often timeout before delete operation completes.
Update to libpreludedb 0.9.8. Changes:
- Always use prelude_escape_binary() when inserting additional data, even in case
we're inserting a string, since the database field might be of a type that require
binary kind of escaping. Fix#143.
- Implement reading of message_processing_model, security_model, security_level.
Handling of community member is deprecated (IDMEFv16 update).
- Fix a bug where Service->ip_version would not be read from database.
- Error reporting improvement.
The changes since the 2.5 release include:
msfconsole:
* Tab completion improvements
* Remember last used exploit after save
* Improved reload/rexploit/rcheck commands
* Security fixes for handling terminal escapes
msfcli:
* Security fixes for handling terminal escapes
msfweb:
* Security fixes when using defanged mode
meterpreter:
* Addition of the SAM password dump extension
* Improvements to the VNC injection
msfpescan:
* PE fingerprinting via the -S option
* Additional information via the -D option
* Major bug fixes to PE format parser
exploits:
* Major rewrites of many exploit modules
* Reliability improvements across the entire set
* 42 new exploits added since 2.5 was released
* Improved IPS evasion for SMB/DCERPC/HTTP modules
libraries:
* Human-friendly SMB and DCERPC error codes
* Reworking of the entire DCERPC API
* Incremental improvements to the SMB stack
* Integration of commonly-duplicated routines
* Major improvements to PEInfo module
