August 2007 - CRUX - lists.crux.nu

Apache & PHP
by kevin.schenker＠tu-ilmenau.de 03 Sep '07

03 Sep '07

I have recently installed the apache web server and the mod_php module to be able to parse php files. In the documentation of php I found out that apache needs to be configured in the following way: 1) Load the libphp5.so using LoadModule 2) Insert line "AddType application/x-httpd-php .php" 3) Insert line "AddHandler cgi-script .cgi .php" However, the web server won't parse any php files, even though execution of CGI is allowed in the whole document root. Trying to access a php file causes my browser to show up a "save file" dialogue. If I remove the line "AddHandler cgi-script .cgi .php" php files located other than in the cgi-bin directory get executed. I have no explanation for this. As described in the httpd.conf file this line is needed whenever scripts should be executed which are not located in the cgi-bin directory. Im not sure if this is really related to Crux but maybe some others encountered similar problems. For the installation of the packages I used: prt-get depinst apache php4 mod_php Hope that someone can help me! Greets Kevin Schenker ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 2

buildling pkgutils on debian
by Matthias Pfeifer 29 Aug '07

29 Aug '07

Hi, i am planning to use pkgutils 5.30.0 in my debian/etch system to maintain installation of some programs/libraries, etc under $HOME. up to now i was only trying to build but got following error: g++ -DNDEBUG -O2 -Wall -pedantic -D_GNU_SOURCE -DVERSION=\"5.30.0\" -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -c -o pkgutil.o pkgutil.cc pkgutil.cc: In member function 'std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, pkgutil::pkginfo_t> pkgutil::pkg_open(const std::string&) const': pkgutil.cc:354: error: 'archive_read_open_filename' was not declared in this scope pkgutil.cc: In member function 'void pkgutil::pkg_install(const std::string&, const std::set<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&, const std::set<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) const': pkgutil.cc:393: error: 'archive_read_open_filename' was not declared in this scope pkgutil.cc: In member function 'void pkgutil::pkg_footprint(std::string&) const': pkgutil.cc:508: error: 'archive_read_open_filename' was not declared in this scope pkgutil.cc:535: error: 'archive_read_open_filename' was not declared in this scope make: *** [pkgutil.o] Fehler 1 it it at all possible to build pkgutils on a debian system? Where am i doing wrong? matthias

6 9

[Fwd: Binutils 2.18 available]
by Clemens Koller 28 Aug '07

28 Aug '07

Well... here it is. -------- Original-Nachricht -------- Betreff: Binutils 2.18 available Datum: Tue, 28 Aug 2007 18:08:01 -0400 Von: Daniel Jacobowitz <drow(a)false.org> An: binutils(a)sourceware.org I have placed binutils 2.18 on sourceware.org and ftp.gnu.org in the usual places, e.g. ftp://ftp.gnu.org/gnu/binutils/. 9d22ee4dafa3a194457caf4706f9cf01 binutils-2.18.tar.bz2 d71b23b4fb91e66802ca2b8f576629f4 binutils-2.18.tar.gz As usual, thanks to everyone who helped prepare this release. The branch remains open for bug fixes; if there are enough to justify it, I'll prepare a point release in one or two months. I built and tested the release for a selection of 38 ELF-based targets; the most popular platforms had no failures, and the others had only a small assortment of problems. Well, with one exception: the ARC disassembler appears to be broken, which messes up the gas testsuite awfully. -- Daniel Jacobowitz CodeSourcery -- Clemens Koller _______________________________ R&D Imaging Devices Anagramm GmbH Rupert-Mayer-Str. 45/1 81379 Muenchen Germany http://www.anagramm-technology.com Phone: +49-89-741518-50 Fax: +49-89-741518-19

1 0

ports/core (2.3): [notify] rsync: fix for CVE-2007-4091
by crux＠crux.nu 24 Aug '07

24 Aug '07

commit 4222576ab7fac83dd98447a2f9efb0fe7b9bc272 Author: Juergen Daubert <jue(a)jue.li> Date: Fri Aug 24 08:33:40 2007 +0200 [notify] rsync: fix for CVE-2007-4091 http://www.securityfocus.com/bid/25336 http://c-skills.blogspot.com/2007/08/cve-2007-4091.html diff --git a/rsync/.md5sum b/rsync/.md5sum index 5eeb02b..651c4f0 100644 --- a/rsync/.md5sum +++ b/rsync/.md5sum @@ -1,3 +1,4 @@ +46fcea1ac64c9e075d0338f8e35b1af6 rsync-2.6.9-fname-obo.diff 996d8d8831dbca17910094e56dcb5942 rsync-2.6.9.tar.gz f8dcfe5cf2afef1ea90107a6ff4540cd rsync.driver a71995f22768c931c5649a1336d25ffb rsyncd diff --git a/rsync/Pkgfile b/rsync/Pkgfile index 5bac4bd..39a8c5b 100644 --- a/rsync/Pkgfile +++ b/rsync/Pkgfile @@ -5,18 +5,22 @@ name=rsync version=2.6.9 -release=1 +release=2 source=(http://rsync.samba.org/ftp/$name/$name-$version.tar.gz \ - rsyncd.conf rsyncd rsync.driver) + rsyncd.conf rsyncd rsync.driver \ + $name-$version-fname-obo.diff) build () { cd $name-$version + + patch -p1 -i $SRC/$name-$version-fname-obo.diff + ./configure --prefix=/usr \ --mandir=/usr/man \ --with-rsh=ssh make make DESTDIR=$PKG install - + mkdir -p $PKG/etc/{rc.d,ports/drivers} $PKG/var/log install -m 755 $SRC/rsyncd $PKG/etc/rc.d install -m 644 $SRC/rsyncd.conf $PKG/etc diff --git a/rsync/rsync-2.6.9-fname-obo.diff b/rsync/rsync-2.6.9-fname-obo.diff new file mode 100644 index 0000000..2fa0113 --- /dev/null +++ b/rsync/rsync-2.6.9-fname-obo.diff @@ -0,0 +1,60 @@ +--- rsync-2.6.9.orig/sender.c 2006-09-20 03:53:32.000000000 +0200 ++++ rsync-2.6.9/sender.c 2007-07-25 15:33:05.000000000 +0200 +@@ -123,6 +123,7 @@ + char fname[MAXPATHLEN]; + struct file_struct *file; + unsigned int offset; ++ size_t l = 0; + + if (ndx < 0 || ndx >= the_file_list->count) + return; +@@ -133,6 +134,20 @@ + file->dir.root, "/", NULL); + } else + offset = 0; ++ ++ l = offset + 1; ++ if (file) { ++ if (file->dirname) ++ l += strlen(file->dirname); ++ if (file->basename) ++ l += strlen(file->basename); ++ } ++ ++ if (l >= sizeof(fname)) { ++ rprintf(FERROR, "Overlong pathname\n"); ++ exit_cleanup(RERR_FILESELECT); ++ } ++ + f_name(file, fname + offset); + if (remove_source_files) { + if (do_unlink(fname) == 0) { +@@ -224,6 +239,7 @@ + enum logcode log_code = log_before_transfer ? FLOG : FINFO; + int f_xfer = write_batch < 0 ? batch_fd : f_out; + int i, j; ++ size_t l = 0; + + if (verbose > 2) + rprintf(FINFO, "send_files starting\n"); +@@ -259,6 +275,20 @@ + fname[offset++] = '/'; + } else + offset = 0; ++ ++ l = offset + 1; ++ if (file) { ++ if (file->dirname) ++ l += strlen(file->dirname); ++ if (file->basename) ++ l += strlen(file->basename); ++ } ++ ++ if (l >= sizeof(fname)) { ++ rprintf(FERROR, "Overlong pathname\n"); ++ exit_cleanup(RERR_FILESELECT); ++ } ++ + fname2 = f_name(file, fname + offset); + + if (verbose > 2)

1 0

[patch] bash: don't link against obsoloete termcap
by Clemens Koller 23 Aug '07

23 Aug '07

Hi! Well, just in case you have termcap installed, bash will link against it, which is propably not what you want. The attached patch avoids that. ./configure says: --with-curses: This causes bash to be linked against the curses library instead of the default termcap library which is becoming obsolete. -- Clemens Koller __________________________________ R&D Imaging Devices Anagramm GmbH Rupert-Mayer-Straße 45/1 Linhof Werksgelände D-81379 München Tel.089-741518-50 Fax 089-741518-19 http://www.anagramm-technology.com --- Pkgfile.old 2007-05-29 17:24:38.000000000 +0200 +++ Pkgfile 2007-05-29 17:34:00.000000000 +0200 @@ -5,7 +5,7 @@ name=bash version=3.2.17 -release=1 +release=2 source=(http://ftp.gnu.org/gnu/$name/$name-3.2.tar.gz \ $name-3.2-001-017.patch \ $name-3.2-doc.patch \ @@ -21,7 +21,8 @@ build() { ./configure --prefix=/usr \ --exec-prefix= \ --mandir=/usr/man \ - --disable-nls + --disable-nls \ + --with-curses make -j1 make DESTDIR=$PKG install

2 1

port sdl_ttf in opt build error
by Hitoshi Satow 21 Aug '07

21 Aug '07

I am having problems building sdl_ttf in opt. _________________________________________________________________ More photos, more messages, more storageget 2GB with Windows Live Hotmail. http://imagine-windowslive.com/hotmail/?locale=en-us&ocid=TXT_TAGHM_migrati…

4 5

ports/opt (2.3): [notify] opera: updated to 9.23
by crux＠crux.nu 17 Aug '07

17 Aug '07

commit 9c8781a91ba0473d3af57cd47cc064b1f793501f Author: Simone Rota <sip(a)crux.nu> Date: Fri Aug 17 21:25:37 2007 +0200 [notify] opera: updated to 9.23 This release fixes a severe security problem, see: http://www.opera.com/support/search/view/865/ diff --git a/opera/.footprint b/opera/.footprint index 7bf7bce..186a367 100644 --- a/opera/.footprint +++ b/opera/.footprint @@ -6,11 +6,11 @@ drwxr-xr-x root/root usr/bin/ -rwxr-xr-x root/root usr/bin/opera drwxr-xr-x root/root usr/lib/ drwxr-xr-x root/root usr/lib/opera/ -drwxr-xr-x root/root usr/lib/opera/9.22-20070716.6/ --rwxr-xr-x root/root usr/lib/opera/9.22-20070716.6/missingsyms.so --rwxr-xr-x root/root usr/lib/opera/9.22-20070716.6/opera --rwxr-xr-x root/root usr/lib/opera/9.22-20070716.6/spellcheck.so --rwxr-xr-x root/root usr/lib/opera/9.22-20070716.6/works +drwxr-xr-x root/root usr/lib/opera/9.23-20070809.6/ +-rwxr-xr-x root/root usr/lib/opera/9.23-20070809.6/missingsyms.so +-rwxr-xr-x root/root usr/lib/opera/9.23-20070809.6/opera +-rwxr-xr-x root/root usr/lib/opera/9.23-20070809.6/spellcheck.so +-rwxr-xr-x root/root usr/lib/opera/9.23-20070809.6/works drwxr-xr-x root/root usr/lib/opera/plugins/ -rwxr-xr-x root/root usr/lib/opera/plugins/libnpp.so -rwxr-xr-x root/root usr/lib/opera/plugins/operaplugincleaner diff --git a/opera/.md5sum b/opera/.md5sum index cdaa6bb..50b7aa0 100644 --- a/opera/.md5sum +++ b/opera/.md5sum @@ -1 +1 @@ -e125cf9ce197a63f9587279feede27b5 opera-9.22-20070716.6-shared-qt.i386-en.tar.bz2 +8e9cb7d05c7a15d23c77d9eaaf5bbca3 opera-9.23-20070809.6-shared-qt.i386-en.tar.bz2 diff --git a/opera/Pkgfile b/opera/Pkgfile index 259302e..0460442 100644 --- a/opera/Pkgfile +++ b/opera/Pkgfile @@ -5,12 +5,12 @@ # Depends on: qt3 name=opera -version=9.22-20070716.6 +version=9.23-20070809.6 release=1 -source=(http://$name.nsc.no/linux/922/final/en/i386/shared/$name-$version-shared-qt.i386-en.tar.bz2) +source=(http://$name.nsc.no/linux/923/final/en/i386/shared/$name-$version-shared-qt.i386-en.tar.bz2) build() { - cd $name-$version-shared-qt.i386-en-655 + cd $name-$version-shared-qt.i386-en-* sed -i s:share/man:man: install.sh sed -i s:/usr/lib/netscape:/usr/lib/firefox: ini/pluginpath.ini

1 0

Re: bash#3.2.17-1 failed
by fikin 16 Aug '07

16 Aug '07

>>The dependencies of the core packages are not included >>in the core packages. That's CRUX' philosophy. >That's not correct. See [1] for the according CRUX rules. i followed following steps: 1) install core system 2) ports -u 3) prt-get sysup and 3) failed because: a) libarchive failed pkgutils b) bison failed bash (the fix was to first prt-get depinst all of them) so, what is wrong with this use case that it fails out of the box? core deps or prt-get? or the procedure? fikin

3 4

ports/core (2.3): [notify] openssl: added patch for CVE-2007-3108
by crux＠crux.nu 15 Aug '07

15 Aug '07

commit 71ea01fd4b43e4eb89c048427ed2ef8b0e75066f Author: Juergen Daubert <jue(a)jue.li> Date: Wed Aug 15 15:30:53 2007 +0200 [notify] openssl: added patch for CVE-2007-3108 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3108 http://www.securityfocus.com/bid/25163 diff --git a/openssl/.md5sum b/openssl/.md5sum index 1e9a478..a9a40d3 100644 --- a/openssl/.md5sum +++ b/openssl/.md5sum @@ -1,3 +1,4 @@ +30ad2995a2668db16ae3083c11a42307 CVE-2007-3108.patch 9d0df57845af8acd1027a7df5c18d017 mksslcert.sh 58daa890c3bc19bd6ce3451b2e5e335c openssl-0.9.8b-parallel-build.patch 3a7ff24f6ea5cd711984722ad654b927 openssl-0.9.8e.tar.gz diff --git a/openssl/CVE-2007-3108.patch b/openssl/CVE-2007-3108.patch new file mode 100644 index 0000000..abf0196 --- /dev/null +++ b/openssl/CVE-2007-3108.patch @@ -0,0 +1,126 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +- --- openssl-0.9.8e/crypto/bn/bn_mont.c 2006-06-16 03:01:14.000000000 +0200 ++++ openssl-0.9.8-cvs/crypto/bn/bn_mont.c 2007-06-29 10:13:25.000000000 +0200 +@@ -176,7 +176,6 @@ + + max=(nl+al+1); /* allow for overflow (no?) XXX */ + if (bn_wexpand(r,max) == NULL) goto err; +- - if (bn_wexpand(ret,max) == NULL) goto err; + + r->neg=a->neg^n->neg; + np=n->d; +@@ -228,19 +227,70 @@ + } + bn_correct_top(r); + +- - /* mont->ri will be a multiple of the word size */ +- -#if 0 +- - BN_rshift(ret,r,mont->ri); +- -#else +- - ret->neg = r->neg; +- - x=ri; ++ /* mont->ri will be a multiple of the word size and below code ++ * is kind of BN_rshift(ret,r,mont->ri) equivalent */ ++ if (r->top <= ri) ++ { ++ ret->top=0; ++ retn=1; ++ goto err; ++ } ++ al=r->top-ri; ++ ++# define BRANCH_FREE 1 ++# if BRANCH_FREE ++ if (bn_wexpand(ret,ri) == NULL) goto err; ++ x=0-(((al-ri)>>(sizeof(al)*8-1))&1); ++ ret->top=x=(ri&~x)|(al&x); /* min(ri,al) */ ++ ret->neg=r->neg; ++ + rp=ret->d; +- - ap= &(r->d[x]); +- - if (r->top < x) +- - al=0; +- - else +- - al=r->top-x; ++ ap=&(r->d[ri]); ++ ++ { ++ size_t m1,m2; ++ ++ v=bn_sub_words(rp,ap,np,ri); ++ /* this ----------------^^ works even in al<ri case ++ * thanks to zealous zeroing of top of the vector in the ++ * beginning. */ ++ ++ /* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */ ++ /* in other words if subtraction result is real, then ++ * trick unconditional memcpy below to perform in-place ++ * "refresh" instead of actual copy. */ ++ m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1); /* al<ri */ ++ m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1); /* al>ri */ ++ m1|=m2; /* (al!=ri) */ ++ m1|=(0-(size_t)v); /* (al!=ri || v) */ ++ m1&=~m2; /* (al!=ri || v) && !al>ri */ ++ nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1)); ++ } ++ ++ /* 'i<ri' is chosen to eliminate dependency on input data, even ++ * though it results in redundant copy in al<ri case. */ ++ for (i=0,ri-=4; i<ri; i+=4) ++ { ++ BN_ULONG t1,t2,t3,t4; ++ ++ t1=nrp[i+0]; ++ t2=nrp[i+1]; ++ t3=nrp[i+2]; ap[i+0]=0; ++ t4=nrp[i+3]; ap[i+1]=0; ++ rp[i+0]=t1; ap[i+2]=0; ++ rp[i+1]=t2; ap[i+3]=0; ++ rp[i+2]=t3; ++ rp[i+3]=t4; ++ } ++ for (ri+=4; i<ri; i++) ++ rp[i]=nrp[i], ap[i]=0; ++# else ++ if (bn_wexpand(ret,al) == NULL) goto err; + ret->top=al; ++ ret->neg=r->neg; ++ ++ rp=ret->d; ++ ap=&(r->d[ri]); + al-=4; + for (i=0; i<al; i+=4) + { +@@ -258,7 +308,7 @@ + al+=4; + for (; i<al; i++) + rp[i]=ap[i]; +- -#endif ++# endif + #else /* !MONT_WORD */ + BIGNUM *t1,*t2; + +@@ -278,10 +328,12 @@ + if (!BN_rshift(ret,t2,mont->ri)) goto err; + #endif /* MONT_WORD */ + ++#if !defined(BRANCH_FREE) || BRANCH_FREE==0 + if (BN_ucmp(ret, &(mont->N)) >= 0) + { + if (!BN_usub(ret,ret,&(mont->N))) goto err; + } ++#endif + retn=1; + bn_check_top(ret); + err: +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1.4.5 (GNU/Linux) + +iQCVAwUBRrGk++6tTP1JpWPZAQJbjwP/W/6mROtxOVU1gvvq/uFHCytNWHVaJfKA +7zh+v4OPQEIYekIBkEpNFgTJbHcyIZoyDNnwOetkRXvI4LDqvV1V5/pA5bzrKqDj +zv7Hj8R7DGqG8ad0Esf3l7SqqirI3curkIzm5/cALJBJxz/Pp7qyXNzzQgp55UPz +iBDdynBpa+s= +=aquq +-----END PGP SIGNATURE----- diff --git a/openssl/Pkgfile b/openssl/Pkgfile index 752362f..10c23da 100644 --- a/openssl/Pkgfile +++ b/openssl/Pkgfile @@ -4,13 +4,15 @@ name=openssl version=0.9.8e -release=1 +release=2 source=(http://www.openssl.org/source/$name-$version.tar.gz \ - mksslcert.sh openssl-0.9.8b-parallel-build.patch) + mksslcert.sh openssl-0.9.8b-parallel-build.patch \ + CVE-2007-3108.patch) build() { cd $name-$version - patch -p1 < $SRC/openssl-0.9.8b-parallel-build.patch + patch -p1 -i $SRC/CVE-2007-3108.patch + patch -p1 -i $SRC/openssl-0.9.8b-parallel-build.patch ./config --prefix=/usr --openssldir=/etc/ssl shared make make INSTALL_PREFIX=$PKG MANDIR=/usr/man MANSUFFIX=ssl install

1 0

ntp release update patch
by fikin 14 Aug '07

14 Aug '07

to whom it may concern: contrib/ntp 4.2.4p0 fails is old and fails (due to download link). following patch also adds url-fix which would allow ntp to compile even if it is outdated. fikin fileserver@root:/usr/ports/contrib/ntp (10:05:38) (266): diff -Naur Pkgfile.orig Pkgfile --- Pkgfile.orig 2007-08-14 12:53:19.000000000 +0000 +++ Pkgfile 2007-08-14 12:54:55.000000000 +0000 @@ -6,9 +6,9 @@ # Depends on: openssl name=ntp -version=4.2.4p0 +version=4.2.4p3 release=1 -source=(http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/$name-$version.tar.gz +source=( http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/$name-$version.tar.gz ntpd ntp.conf) fileserver@root:/usr/ports/contrib/ntp (10:05:44) (267):

3 3