If you’re new to FreeBSD and PC-BSD, you might not yet be aware of all their package manager’s many commands. Nobody expects you to, at least not initially.
Pkg is that package manager and one of the its many commands I think you should get to know asap is the audit command. It’s used to audit installed packages against known vulnerabilities. I could be wrong, but I don’t think your favorite Linux distribution’s package manager has an equivalent command.
The command is very simple. Just pass the -F flag to pkg audit and it will output installed packages with outstanding vulnerabilities. By running pkg audit -F on a fresh installation of PC-BSD 10.1 KDE, for example, it reported the following vulnerable packages.
Fetching vuln.xml.bz2: 100% 458 KB 469.5k/s 00:01 dbus-1.8.8 is vulnerable: dbus -- incomplete fix for CVE-2014-3636 part A CVE: CVE-2014-7824 WWW: http://portaudit.FreeBSD.org/c1930f45-6982-11e4-80e1-bcaec565249c.html kde-runtime-4.14.2 is vulnerable: kwebkitpart, kde-runtime -- insufficient input validation CVE: CVE-2014-8600 WWW: http://portaudit.FreeBSD.org/890b6b22-70fa-11e4-91ae-5453ed2e2b49.html kde-workspace-4.11.13 is vulnerable: kde-workspace -- privilege escalation CVE: CVE-2014-8651 WWW: http://portaudit.FreeBSD.org/dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49.html libssh-0.6.1_1 is vulnerable: libssh -- PRNG state reuse on forking servers CVE: CVE-2014-0017 WWW: http://portaudit.FreeBSD.org/f8c88d50-5fb3-11e4-81bd-5453ed2e2b49.html wget-1.15_2 is vulnerable: wget -- path traversal vulnerability in recursive FTP mode CVE: CVE-2014-4877 WWW: http://portaudit.FreeBSD.org/ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e.html 5 problem(s) in the installed packages found.
For each vulnerable package, it points you to a Web resources for more information. Visiting the link for libssh-0.6.1_1 vulnerability, gave the following information:
Aris Adamantiadis reported the following to us:
I have found a vulnerability in stunnel (fork mode) and libssh server (if implemented with fork) that is similar to problems found in postgresql . When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn’t reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.
stunnel uses libssl, which also seeds the PRNG with the output of time(NULL), which means that vulnerability has to be exploited under a second. I have exploit code that can reproduce the issue on OpenBSD 5.4 (thanks to random PIDs) but I think it may be exploitable on other unix systems as well.
The following CVEs have been assigned:
CVE-2014-0016 stunnel PRNG vulnerability
CVE-2014-0017 libssh PRNG vulnerability
Mitigations implemented into openssl-0.9.8j (2009) makes the vulnerability not exploitable in stock openssl. The signing code for ECDSA and DSA explicitly seeds the pool with the digest to sign.
Even if your technical understanding of the vulnerability is nothing to rave about, at least you’re informed. The same command run on a new installation of PC-BSD 10.1.1 Cinnamon returned this output:
chromium-39.0.2171.95_3 is vulnerable: chromium -- multiple vulnerabilities CVE: CVE-2015-1205 CVE: CVE-2014-7948 CVE: CVE-2014-7947 CVE: CVE-2014-7946 CVE: CVE-2014-7945 CVE: CVE-2014-7944 CVE: CVE-2014-7943 CVE: CVE-2014-7942 CVE: CVE-2014-7941 CVE: CVE-2014-7940 CVE: CVE-2014-7939 CVE: CVE-2014-7938 CVE: CVE-2014-7937 CVE: CVE-2014-7936 CVE: CVE-2014-7935 CVE: CVE-2014-7934 CVE: CVE-2014-7933 CVE: CVE-2014-7932 CVE: CVE-2014-7931 CVE: CVE-2014-7930 CVE: CVE-2014-7929 CVE: CVE-2014-7928 CVE: CVE-2014-7927 CVE: CVE-2014-7926 CVE: CVE-2014-7925 CVE: CVE-2014-7924 CVE: CVE-2014-7923 WWW: http://vuxml.FreeBSD.org/freebsd/e30e0c99-a1b7-11e4-b85c-00262d5ed8ee.html chromium-39.0.2171.95_3 is vulnerable: chromium -- multiple vulnerabilities CVE: CVE-2015-1212 CVE: CVE-2015-1211 CVE: CVE-2015-1210 CVE: CVE-2015-1209 WWW: http://vuxml.FreeBSD.org/freebsd/a6eb239f-adbe-11e4-9fce-080027593b9a.html linux-c6-openssl-1.0.1e_2 is vulnerable: OpenSSL -- multiple vulnerabilities CVE: CVE-2015-0206 CVE: CVE-2015-0205 CVE: CVE-2015-0204 CVE: CVE-2014-8275 CVE: CVE-2014-3572 CVE: CVE-2014-3571 CVE: CVE-2014-3570 CVE: CVE-2014-3569 WWW: http://vuxml.FreeBSD.org/freebsd/4e536c14-9791-11e4-977d-d050992ecde8.html 2 problem(s) in the installed packages found.
Again, you’re given links for each vulnerability. If you run a FreeBSD Cloud server, that is one command you want to be running often. For the record, I ran it on my FreeBSD 10.1 DigitalOcean server and it reported zero vulnerable packages. I can rest easy, until the next audit.