154323

no flags

Update mail/exim to version 4.74 from 4.73 currently in ports.
This fixes a privilege escalation vulnerability, but I'm not sure it applies
to FreeBSD (CVE-2011-0017)

Changes according to the Changelog (http://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74):

TF/01 Failure to get a lock on a hints database can have serious
      consequences so log it to the panic log.

TF/02 Log LMTP confirmation messages in the same way as SMTP,
      controlled using the smtp_confirmation log selector.

TF/03 Include the error message when we fail to unlink a spool file.

DW/01 Bugzilla 139: Support dynamically loaded lookups as modules.
      With thanks to Steve Haslam, Johannes Berg & Serge Demonchaux
      for maintaining out-of-tree patches for some time.

PP/01 Bugzilla 139: Documentation and portability issues.
      Avoid GNU Makefile-isms, let Exim continue to build on BSD.
      Handle per-OS dynamic-module compilation flags.

PP/02 Let /dev/null have normal permissions.
      The 4.73 fixes were a little too stringent and complained about the
      permissions on /dev/null.  Exempt it from some checks.
      Reported by Andreas M. Kirchwitz.

PP/03 Report version information for many libraries, including
      Exim version information for dynamically loaded libraries.  Created
      version.h, now support a version extension string for distributors
      who patch heavily. Dynamic module ABI change.

PP/04 CVE-2011-0017 - check return value of setuid/setgid. This is a
      privilege escalation vulnerability whereby the Exim run-time user
      can cause root to append content of the attacker's choosing to
      arbitrary files.

PP/05 Bugzilla 1041: merged DCC maintainer's fixes for return code.
      (Wolfgang Breyha)

PP/06 Bugzilla 1071: fix delivery logging with untrusted macros.
      If dropping privileges for untrusted macros, we disabled normal logging
      on the basis that it would fail; for the Exim run-time user, this is not
      the case, and it resulted in successful deliveries going unlogged.
      Fixed.  Reported by Andreas Metzler.

Fix: Since all the heavy lifting was done in the update to 4.73, it seems just bumping
the version (as the attached patch does) will do the job.
Tested for two days with my set of options and it works fine.

I also included a spiffy feature I saw in the security/openssl port which
causes "make makesum" to always fetch all dist files, not just the ones
needed for the currently selected options.