CVS commit: pkgsrc/security/putty

["Ryo ONODERA" <ryoon%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   ryoon
Date:           Thu Jul 25 12:50:06 UTC 2019

Modified Files:
        pkgsrc/security/putty: Makefile distinfo

Log Message:
Update to 0.72

Changelog:
This is a SECURITY UPDATE, fixing vulnerabilities in the obsolete SSH-1
protocol. It also includes many bug fixes over 0.71. We recommend that
everybody update.

Vulnerabilities fixed in this release include:

 - A malicious SSH-1 server could trigger a buffer overrun by sending
   extremely short RSA keys, or certain bad packet length fields.
   Either of these could happen before host key verification, so even
   if you trust the server you *intended* to connect to, you would
   still be at risk.

   (However, the SSH-1 protocol is obsolete, and recent versions of
   PuTTY do not try it by default, so you are only at risk if you work
   with old servers and have explicitly configured SSH-1.)

 - If a malicious process found a way to impersonate Pageant, then it
   could cause an integer overflow in any of the SSH client tools
   (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.

Other security-related bug fixes include:

 - The 'trust sigil' system introduced in PuTTY 0.71 to protect
   against server spoofing attacks had multiple bugs. Trust sigils
   were not turned off after login in the SSH-1 and Rlogin protocols,
   and not turned back on if you used the Restart Session command.
   Both are now fixed.

Other bug fixes include:

 - Kerberos key exchange could crash at the start of an SSH session
   in the presence of a third-party Windows provider such as
   MIT Kerberos for Windows, and could also crash if the server sent
   an ordinary SSH host key as part of the Kerberos exchange.

 - In SSH-2 keyboard-interactive authentication, one of the message
   fields sent by the server (namely the 'instructions' message) was
   accidentally never displayed to the user.

 - When using SSH-2 connection sharing, pasting text into a downstream
   PuTTY window that included a line longer than 16Kb could cause that
   window's connection to be closed.

 - When using PSCP in old-fashioned SCP mode, downloading files
   specified by a wildcard could cause a newline character to be
   appended to the downloaded file names. Also, using the -p option to
   preserve file times failed with a spurious error message.

 - On Windows, the numeric keypad key that should generate '.' or ','
   depending on keyboard layout was always generating '.'.

 - RSA keys generated by PuTTYgen could be 1 bit shorter than
   requested. (Harmless, but a regression in 0.71 compared to 0.70.)


To generate a diff of this commit:
cvs rdiff -u -r1.57 -r1.58 pkgsrc/security/putty/Makefile
cvs rdiff -u -r1.25 -r1.26 pkgsrc/security/putty/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/putty/Makefile
diff -u pkgsrc/security/putty/Makefile:1.57 pkgsrc/security/putty/Makefile:1.58
--- pkgsrc/security/putty/Makefile:1.57 Sun Jul 21 22:25:40 2019
+++ pkgsrc/security/putty/Makefile      Thu Jul 25 12:50:06 2019
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.57 2019/07/21 22:25:40 wiz Exp $
+# $NetBSD: Makefile,v 1.58 2019/07/25 12:50:06 ryoon Exp $
 #
 
-DISTNAME=      putty-0.71
-PKGREVISION=   1
+DISTNAME=      putty-0.72
 CATEGORIES=    security
 MASTER_SITES=  http://the.earth.li/~sgtatham/putty/${PKGVERSION_NOREV}/
 
@@ -37,6 +36,7 @@ CFLAGS+=      -DBSD_PTYS
 
 LDFLAGS.SunOS+=        -lsocket -lnsl
 CFLAGS.SunOS+= -DBSD_COMP
+CFLAGS.NetBSD+=        -DHAVE_FUTIMES
 
 .include "../../x11/gtk3/buildlink3.mk"
 .include "../../mk/dlopen.buildlink3.mk"

Index: pkgsrc/security/putty/distinfo
diff -u pkgsrc/security/putty/distinfo:1.25 pkgsrc/security/putty/distinfo:1.26
--- pkgsrc/security/putty/distinfo:1.25 Mon Apr  1 12:10:43 2019
+++ pkgsrc/security/putty/distinfo      Thu Jul 25 12:50:06 2019
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.25 2019/04/01 12:10:43 ryoon Exp $
+$NetBSD: distinfo,v 1.26 2019/07/25 12:50:06 ryoon Exp $
 
-SHA1 (putty-0.71.tar.gz) = 6bc785c304aff029f28ca1bd71d8654db8f24f1a
-RMD160 (putty-0.71.tar.gz) = 0df8a21b993df7c526952fb375f0630e219da7f5
-SHA512 (putty-0.71.tar.gz) = f8791210bd5925b26d51b13f0558eea15dbac40808051165b236d6436226f5c2b0aa7d69288ed9e2bddc1066455678cfd0af73ef6b715a136c42f3b6f754ac07
-Size (putty-0.71.tar.gz) = 2423752 bytes
+SHA1 (putty-0.72.tar.gz) = 9940e226e5b9f2da9b15109c0deabb168c92d850
+RMD160 (putty-0.72.tar.gz) = 4c3432e935a8ebc31b5c3f4770be542877f51942
+SHA512 (putty-0.72.tar.gz) = a963985e55dcd589c08ef51085808a6364629edd8ce6708ebdf516e0339a41b7f186f91d7d7f26b1fec03d60767f365246e6fa06e9ef042898355c2f90f355dd
+Size (putty-0.72.tar.gz) = 2449516 bytes
 SHA1 (patch-ldisc.c) = 9a12a0b96bdf57ae219651b38d695fa5440da354
 SHA1 (patch-misc.c) = fa1c2db8eb20ceaadb4b57b6aefa57f22d2ae26f
 SHA1 (patch-terminal.c) = 9e57f754bb2071c8c6b6a92ae63772eb10790121