From b0e70f9c89800a94b627227bff9757c85433c606 Mon Sep 17 00:00:00 2001 From: Kris Kennaway Date: Mon, 29 Jan 2001 00:22:10 +0000 Subject: Add a security warning about the many local buffer overflows in this software, qualified by the fact that it's setgid games and therefore not dangerous to the system. Many of these buffer overflows aren't classic smashed stacks, but I bet at least one is exploitable :-) --- games/dopewars/Makefile | 6 ++++++ games/dopewars/pkg-install | 9 +++++++++ 2 files changed, 15 insertions(+) create mode 100644 games/dopewars/pkg-install (limited to 'games/dopewars') diff --git a/games/dopewars/Makefile b/games/dopewars/Makefile index 0c651c4b0fef..b102e6f0c36b 100644 --- a/games/dopewars/Makefile +++ b/games/dopewars/Makefile @@ -7,6 +7,7 @@ PORTNAME= dopewars PORTVERSION= 1.4.8 +PORTREVISION= 1 CATEGORIES= games MASTER_SITES= http://bellatrix.pcl.ox.ac.uk/~ben/dopewars/ @@ -15,6 +16,11 @@ MAINTAINER= jim@FreeBSD.org USE_GMAKE= yes GNU_CONFIGURE= yes +pre-fetch: +.if !defined(BATCH) && !defined(PACKAGE_BUILDING) + ${SH} pkg-install +.endif + post-install: @${ECHO} "===> Documentation is installed in ${PREFIX}/share/doc/dopewars" @${ECHO} "===> Run 'dopewars -h' for usage options." diff --git a/games/dopewars/pkg-install b/games/dopewars/pkg-install new file mode 100644 index 000000000000..47b307353295 --- /dev/null +++ b/games/dopewars/pkg-install @@ -0,0 +1,9 @@ +#!/bin/sh + +if [ "$2" = "POST-INSTALL" -o -n "${PACKAGE_BUILDING}" ]; then + exit 0 +fi + +/usr/bin/dialog --yesno "SECURITY NOTE: This software contains known locally-exploitable buffer overflows. However since the binaries in question are setgid to the games group, the impact of this vulnerability is believed to be limited to the ability for local users to overwrite score files, saved games, and certain other game data for this and other installed game packages. The wider system security is not believed to be compromised by this problem. Do you wish to install the software anyway?" 12 70 || /usr/bin/false + + -- cgit v1.2.3