If you’re new to FreeBSD and PC-BSD, you might not yet be aware of all their package manager’s many commands. Nobody expects you to, at least not initially.

Pkg is that package manager and one of the its many commands I think you should get to know asap is the audit command. It’s used to audit installed packages against known vulnerabilities. I could be wrong, but I don’t think your favorite Linux distribution’s package manager has an equivalent command.

The command is very simple. Just pass the -F flag to pkg audit and it will output installed packages with outstanding vulnerabilities. By running pkg audit -F on a fresh installation of PC-BSD 10.1 KDE, for example, it reported the following vulnerable packages.

Fetching vuln.xml.bz2: 100%  458 KB 469.5k/s    00:01    
dbus-1.8.8 is vulnerable:
dbus -- incomplete fix for CVE-2014-3636 part A
CVE: CVE-2014-7824
WWW: http://portaudit.FreeBSD.org/c1930f45-6982-11e4-80e1-bcaec565249c.html

kde-runtime-4.14.2 is vulnerable:
kwebkitpart, kde-runtime -- insufficient input validation
CVE: CVE-2014-8600
WWW: http://portaudit.FreeBSD.org/890b6b22-70fa-11e4-91ae-5453ed2e2b49.html

kde-workspace-4.11.13 is vulnerable:
kde-workspace -- privilege escalation
CVE: CVE-2014-8651
WWW: http://portaudit.FreeBSD.org/dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49.html

libssh-0.6.1_1 is vulnerable:
libssh -- PRNG state reuse on forking servers
CVE: CVE-2014-0017
WWW: http://portaudit.FreeBSD.org/f8c88d50-5fb3-11e4-81bd-5453ed2e2b49.html

wget-1.15_2 is vulnerable:
wget -- path traversal vulnerability in recursive FTP mode
CVE: CVE-2014-4877
WWW: http://portaudit.FreeBSD.org/ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e.html

5 problem(s) in the installed packages found.

For each vulnerable package, it points you to a Web resources for more information. Visiting the link for libssh-0.6.1_1 vulnerability, gave the following information:

Aris Adamantiadis reported the following to us:

I have found a vulnerability in stunnel (fork mode) and libssh server (if implemented with fork) that is similar to problems found in postgresql [1]. When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn’t reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.

stunnel uses libssl, which also seeds the PRNG with the output of time(NULL), which means that vulnerability has to be exploited under a second. I have exploit code that can reproduce the issue on OpenBSD 5.4 (thanks to random PIDs) but I think it may be exploitable on other unix systems as well.

The following CVEs have been assigned:

CVE-2014-0016 stunnel PRNG vulnerability
CVE-2014-0017 libssh PRNG vulnerability

Mitigations implemented into openssl-0.9.8j (2009) makes the vulnerability not exploitable in stock openssl. The signing code for ECDSA and DSA explicitly seeds the pool with the digest to sign.

Even if your technical understanding of the vulnerability is nothing to rave about, at least you’re informed. The same command run on a new installation of PC-BSD 10.1.1 Cinnamon returned this output:

chromium-39.0.2171.95_3 is vulnerable:
chromium -- multiple vulnerabilities
CVE: CVE-2015-1205
CVE: CVE-2014-7948
CVE: CVE-2014-7947
CVE: CVE-2014-7946
CVE: CVE-2014-7945
CVE: CVE-2014-7944
CVE: CVE-2014-7943
CVE: CVE-2014-7942
CVE: CVE-2014-7941
CVE: CVE-2014-7940
CVE: CVE-2014-7939
CVE: CVE-2014-7938
CVE: CVE-2014-7937
CVE: CVE-2014-7936
CVE: CVE-2014-7935
CVE: CVE-2014-7934
CVE: CVE-2014-7933
CVE: CVE-2014-7932
CVE: CVE-2014-7931
CVE: CVE-2014-7930
CVE: CVE-2014-7929
CVE: CVE-2014-7928
CVE: CVE-2014-7927
CVE: CVE-2014-7926
CVE: CVE-2014-7925
CVE: CVE-2014-7924
CVE: CVE-2014-7923
WWW: http://vuxml.FreeBSD.org/freebsd/e30e0c99-a1b7-11e4-b85c-00262d5ed8ee.html

chromium-39.0.2171.95_3 is vulnerable:
chromium -- multiple vulnerabilities
CVE: CVE-2015-1212
CVE: CVE-2015-1211
CVE: CVE-2015-1210
CVE: CVE-2015-1209
WWW: http://vuxml.FreeBSD.org/freebsd/a6eb239f-adbe-11e4-9fce-080027593b9a.html

linux-c6-openssl-1.0.1e_2 is vulnerable:
OpenSSL -- multiple vulnerabilities
CVE: CVE-2015-0206
CVE: CVE-2015-0205
CVE: CVE-2015-0204
CVE: CVE-2014-8275
CVE: CVE-2014-3572
CVE: CVE-2014-3571
CVE: CVE-2014-3570
CVE: CVE-2014-3569
WWW: http://vuxml.FreeBSD.org/freebsd/4e536c14-9791-11e4-977d-d050992ecde8.html

2 problem(s) in the installed packages found.

Again, you’re given links for each vulnerability. If you run a FreeBSD Cloud server, that is one command you want to be running often. For the record, I ran it on my FreeBSD 10.1 DigitalOcean server and it reported zero vulnerable packages. I can rest easy, until the next audit.