Bug 216666 - multimedia/zoneminder - CVE-2016-10140
Summary: multimedia/zoneminder - CVE-2016-10140
Status: Closed Not A Bug
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Ivan
URL:
Keywords: security
Depends on:
Blocks:
 
Reported: 2017-01-31 04:15 UTC by Sevan Janiyan
Modified: 2017-02-06 02:49 UTC (History)
5 users (show)

See Also:
bugzilla: maintainer-feedback? (bsd)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sevan Janiyan 2017-01-31 04:15:21 UTC 
vulnerable & missing vuxml entry. Issue only exists if supplied sample config for apache is used.
Comment 1 Ivan 2017-01-31 07:00:00 UTC 
Supplied sample config for apache? But we supplying it for nginx. See readme.freebsd
Comment 2 Sevan Janiyan 2017-01-31 13:02:57 UTC 
(In reply to Ivan from comment #1)
I mean the sample config supplied in the distfile
Comment 3 Ivan 2017-01-31 13:36:03 UTC 
But what should I do as port maintainer? Port doesn't consist these sample configs and security flaw is a little bit obvious (at least in my readme I wrote about the possibility to leave img folder exposed).
Comment 4 Sevan Janiyan 2017-02-01 02:02:30 UTC 
In this case, you can safely ignore adding the vuxml if the supplied apache sample config is never used. Patch the file in the workdir as a common courtesy?
Comment 5 Nikolai Lifanov freebsd_committer freebsd_triage 2017-02-05 16:51:55 UTC 
Sevan, is there a published disclosure for this somewhere?
Can you provide a link to any of a reference, CVE, etc.?
Comment 6 Nikolai Lifanov freebsd_committer freebsd_triage 2017-02-05 16:53:05 UTC 
Ohh, OK. I see the CVE in the title.
We probably should have a vuxml entry for this but the decision should be made by bsd@abinet.ru.
Comment 7 Ivan 2017-02-05 16:55:36 UTC 
Hello, Nikolai,
can you tell me what should I do? I am not very experienced porter, but I can tell you that this very port in unaffected by CVE.
Comment 8 Jason Unovitch freebsd_committer freebsd_triage 2017-02-06 02:49:14 UTC 
(In reply to Sevan Janiyan from comment #4)
> ... the supplied apache sample config is never used. Patch the file in the workdir as a common courtesy?

I see no reason to add Makefile patching for a file that never gets installed.

(In reply to Ivan from comment #7)

If there were an OPTIONS for a vulnerability, even a non-default option, we would most definitely patch and document it. However there is nothing to do as the port could never have been vulnerable through any user configurable option.