java/115558: linux-sun-jdk-1.6.0.02 is incorrectly marked as  
Author Message
ronald-freebsd8





PostPosted: 2007-8-16 2:25:00 Top

java-programmer, java/115558: linux-sun-jdk-1.6.0.02 is incorrectly marked as
>Number: 115558
>Category: java
>Synopsis: linux-sun-jdk-1.6.0.02 is incorrectly marked as vulnerable
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-java
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Aug 15 18:20:00 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator: Ronald Klop
>Release: FreeBSD 6.2-STABLE i386
>Organization:
>Environment:


System: FreeBSD 6.2-STABLE #29: Sat Jul 14 14:44:18 CEST 2007
email***@***.com:/usr/obj/usr/src/sys/GUIDO



>Description:


I don't know if this is a 'java' issue or a 'ports' issue, sorry if the category is wrong.

But, the port linux-sun-jdk-1.6.0.02 is marked as vulnerable by portaudit/vuxml which is incorrect I think.

# portaudit -adF
auditfile.tbz 100% of 43 kB 30 kBps
New database installed.
Database created: Tue Aug 14 01:10:01 CEST 2007
Affected package: linux-sun-jdk-1.6.0.02
Type of problem: jdk -- jar directory traversal .
Reference: <http://www.FreeBSD.org/ports/portaudit/18e5428f-ae7c-11d9-837d-000e0c2e438a.html>


>How-To-Repeat:


install portaudit
try to install linux-sun-jdk-1.6.0; this will not succeed, because portaudit thinks the port is vulnerable



>Fix:


Fix the versions of the vulnerability.


>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
email***@***.com mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-java
To unsubscribe, send any mail to "email***@***.com"
 
ronald-freebsd8





PostPosted: 2007-8-16 5:15:00 Top

java-programmer >> java/115558: linux-sun-jdk-1.6.0.02 is incorrectly marked as The following reply was made to PR ports/115558; it has been noted by GNATS.

From: "Ronald Klop" <email***@***.com>
To: "Greg Lewis" <email***@***.com>
Cc: "FreeBSD gnats submit" <email***@***.com>
Subject: Re: java/115558: linux-sun-jdk-1.6.0.02 is incorrectly marked as vulnerable
Date: Wed, 15 Aug 2007 23:00:24 +0200

On Wed, 15 Aug 2007 22:41:51 +0200, Greg Lewis <email***@***.com>
wrote:

> The problem is, I think its still vulnerable:
>
> laptop> ls /tmp/test
> ls: /tmp/test: No such file or directory
> laptop> pwd
> /tmp/jar_test
> laptop> jar tf bad.jar
> META-INF/
> META-INF/MANIFEST.MF
> java-rmi.cgi
> ../../../../../../../../../../../../../../tmp/test
> laptop> /usr/local/linux-sun-jdk1.6.0/bin/jar xf bad.jar
> laptop> ls /tmp/test
> /tmp/test
> laptop> rm -f /tmp/test
> laptop> /usr/local/jdk1.6.0/bin/jar xf bad.jar
> ignoring entry ../../../../../../../../../../../../../../tmp/test
> laptop> ls /tmp/test
> ls: /tmp/test: No such file or directory
> laptop>
>

Then please close my PR. Thanks for testing this better than I did.

Ronald.

--
Ronald Klop
Amsterdam, The Netherlands
_______________________________________________
email***@***.com mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-java
To unsubscribe, send any mail to "email***@***.com"
 
glewis





PostPosted: 2007-8-16 5:25:00 Top

java-programmer >> java/115558: linux-sun-jdk-1.6.0.02 is incorrectly marked as The following reply was made to PR ports/115558; it has been noted by GNATS.

From: Greg Lewis <email***@***.com>
To: Ronald Klop <email***@***.com>
Cc: FreeBSD gnats submit <email***@***.com>
Subject: Re: java/115558: linux-sun-jdk-1.6.0.02 is incorrectly marked as vulnerable
Date: Wed, 15 Aug 2007 13:41:51 -0700

The problem is, I think its still vulnerable:

laptop> ls /tmp/test
ls: /tmp/test: No such file or directory
laptop> pwd
/tmp/jar_test
laptop> jar tf bad.jar
META-INF/
META-INF/MANIFEST.MF
java-rmi.cgi
../../../../../../../../../../../../../../tmp/test
laptop> /usr/local/linux-sun-jdk1.6.0/bin/jar xf bad.jar
laptop> ls /tmp/test
/tmp/test
laptop> rm -f /tmp/test
laptop> /usr/local/jdk1.6.0/bin/jar xf bad.jar
ignoring entry ../../../../../../../../../../../../../../tmp/test
laptop> ls /tmp/test
ls: /tmp/test: No such file or directory
laptop>

--
Greg Lewis Email : email***@***.com
Eyes Beyond Web : http://www.eyesbeyond.com
Information Technology FreeBSD : email***@***.com
_______________________________________________
email***@***.com mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-java
To unsubscribe, send any mail to "email***@***.com"