Server Software Update Notification: 07-10-2007

• CPX 1.5.4 update for v3 and v2 (basic Dovecot compatibility)
• Software firewall release for v3
• Dovecot CPX compatibility update for v3, and v2
• PHP 5.2.3 release for v3 and Signature
• PHP 4.x recursive extensions update for v3, and v2
• ClamAV 0.90.3 release for v3 and v2
• ShopSite installation fixed for v3
• MySQL 3.23.59 release for v2
• SquirrelMail 1.4.10a release for v3 and v2
• Ports Collection fixed for v2
• Control Panel updates for Signature

FreeBSD MPS/VPS v3:

Software Firewall

A proprietary and customized software firewall will be introduced to the system. Preconfigured firewall levels (0 through 3) can be configured using the set_fwlevel command-line utility. To set a firewall level, connect to your server through SSH and execute the following from the command prompt:

# set_fwlevel num

where "num" is the desired firewall level. The ipf (IPFilter) software package is also available to configure the firewall, but this utility is complex and it is strongly suggested that only those familiar with firewall rulesets use this utility. For more information about set_fwlevel, connect to your server through SSH and execute the following from the command prompt:

# man set_fwlevel

Note: At this time, the software firewall does not support the IPv6 protocol. Support for IPv6 will be introduced with a server software update planned for the immediate future.

Refer to future email announcement for details and documentation.

CPX

The CPX: Control Panel server management Web interface will be updated with the following improvements:

- Basic email support for the Dovecot email server.
- Improved and updated Japanese language interface elements.

No action needed; refer to future email announcement for details and documentation.

Note: While basic email functionality such as reading, composing, and forwarding email is now supported with the Dovecot email server, email configuration features such as ClamAV and SpamAssassin are not supported at this time. Accordingly, it is not suggested to use CPX with Dovecot to manage email settings or accounts until support for these is introduced with a planned update in the near future.

Dovecot

The vinstall for the Dovecot email server will be updated to address compatibility issues with CPX Webmail. This update affects the vinstall only. No action needed.

PHP 4.x

The vinstall for the PHP: Hypertext Preprocessor scripting language for version 4.x will be updated to recursively select extensions based on their dependencies. The pspell extension will also be added to the list of available extensions. This update affects the vinstall only. No action needed.

PHP 5.x

The vinstall for the PHP: Hypertext Preprocessor scripting language for version 5.x will be updated to install version 5.2.3. This version brings the software to the most current 5.x version and addresses several security issues (CVE-2007-2872, CVE-2007-2756, and CVE-2007-1900), discussed here:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900

More information about version 5.2.3 can be found at these pages:

• http://us2.php.net/releases/5_2_3.php
• http://www.php.net/ChangeLog-5.php#5.2.3

The vinstall will also be updated to recursively select extensions based on their dependencies. The pspell extension will be added to the list of available extensions. Incremental versions of PHP will now have their own corresponding set of extensions. Also, the GD extension will be recompiled to address issues introduced with recent updates.

To install PHP or upgrade existing installations to the new 5.x version, connect to your server through SSH and execute the following command from the prompt:

# vinstall php5

ClamAV

The vinstall for ClamAV, a GPL virus scanner, will be updated to install version 0.90.3. This version brings the utility to the most current stable release and addresses security issues with libclamav. More information about these and other updates in version 0.90.3 can be found here:

http://sourceforge.net/project/shownotes.php?release_id=512356&group_id=86638

No action needed.

Procmail

The vinstall and vuninstall to set the Procmail email processing utility as the local delivery agent (LDA) will be updated to address errors and configuration problems. This update affects the vinstall and vuninstall only. No action needed.

Webmin

The vinstall for the Webmin Web-based interface for system administration for UNIX will be updated to configure the utility to use the /www/ path.

If you wish to install Webmin or configure existing installations, make a backup of any special configuration, uninstall the utility, then connect to your server through SSH and execute the following from the command prompt:

# vinstall webmin

ShopSite

The ShopSite shopping cart installation will be updated to address issues with missing modules. This update affects new installations only. No action needed.

Python

The vinstall for the Python programming language will be updated to install version 2.4.4. This version addresses a buffer overrun security issue (CVE-2006-4980) discussed here:

• http://www.FreeBSD.org/ports/portaudit/fe83eb5b-55e1-11db-a5ae-00508d6a62df.html
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4980

To update existing installations, make a backup of any special configurations, uninstall the application, then connect to the server through SSH and executing the following from the command prompt:

# vinstall python

Samba

The vinstall for the Samba SMB/CIFS software suite for file and print services will be updated to install version 3.0.25a,1. This version addresses issues with group membership, domain user passwords, and object pickers. More information about version 3.0.25a,1 can be found here:

http://www.samba.org/samba/history/samba-3.0.25a.html

To install Samba 3 or upgrade to the new version, make a backup of any special configurations, uninstall the application, then connect to your server through SSH and execute the following command from the prompt:

# vinstall samba3

SquirrelMail

The vinstall for the SquirrelMail standards-based webmail package will be updated to check for needed extensions for PHP 4.x. This update affects the vinstall only. No action needed.

phpMyAdmin

The vinstall for the phpMyAdmin database administration tool will be updated to check for needed extensions for PHP 4.x. This update affects the vinstall only. No action needed.

Portupgrade

The Index-6.db file used by the Portupgrade FreeBSD ports/packages administration and management tool suite will be updated to reflect current packages and dependencies. Some package and port timestamps will also be updated. No action needed.

UnRAR

The unRAR archive utility, part of RAR: Roshal ARchive data compression software, will be updated to version 3.70,4. This version brings updates the utility. More information about version 3.70,4 can be found here:

http://www.freshports.org/commit.php?category=archivers&port=unrar ...

No action needed.

Math::BigInt

The Math::BigInt Perl module will be updated to version 1.86. This version brings the module to the most current version. More information about version 1.86 can be found here:

http://search.cpan.org/src/TELS/Math-BigInt-1.86/CHANGES

No action needed.

Compress::Zlib

The Compress::Zlib Perl module will be updated to version 2.004. This version brings the module to the most current version and addresses issues with memGzip. More information about version 2.004 can be found here:

http://search.cpan.org/src/PMQS/Compress-Zlib-2.004/Changes

No action needed.

X11

The libXres resource library for the X11 X Windows System will be updated to version 1.0.3_1. This version brings the library to the most current FreeBSD version and addresses issues with packages. More information about version 1.0.3_1 can be found here:

http://www.freshports.org/commit.php?category=x11&port=libXres ...

The libX11 and xproto libraries will also be updated to versions 1.1.1_2,1 and 7.0.10, respectively. These versions update the libraries.

You can find more information about libX11 version 1.1.1_2,1 here:
http://www.freshports.org/commit.php?category=x11&port=libX11 ...

You can find more information about xproto version 7.0.10 here:

http://www.freshports.org/commit.php?category=x11&port=xproto ...

No action needed.

OSSP mm

The OSSP mm memory abstraction library version 1.4.2 will be added to the system. More information about OSSP mm can be found here:

http://www.ossp.org/pkg/lib/mm/

No action needed.

FreeBSD MPS/VPS v2

CPX

The CPX: Control Panel server management Web interface will be updated with the following improvements:

- Basic email support for the Dovecot email server.
- Improved and updated Japanese language interface elements.

No action needed; refer to future email announcement for details and documentation.

Note: While basic email functionality such as reading, composing, and forwarding email is now supported with the Dovecot email server, email configuration features such as ClamAV and SpamAssassin are not supported at this time. Accordingly, it is not suggested to use CPX with Dovecot to manage email settings or accounts until support for these is introduced with a planned update in the near future.

Dovecot

The vinstall for the Dovecot email server will be updated to address compatibility issues with CPX Webmail. This update affects the vinstall only. No action needed.

The vuninstall for Dovecot will be updated to better detect existing Dovecot installations. This update affects the vuninstall only. No action needed.

PHP 4.x

The vinstall for the PHP: Hypertext Preprocessor scripting language for version 4.x will be updated to recursively select extensions based on their dependencies. The pspell extension will also be added to the list of available extensions. This update affects the vinstall only. No action needed.

ClamAV

The vinstall for ClamAV, a GPL virus scanner, will be updated to install version 0.90.3. This version brings the utility to the most current stable release and addresses security issues with libclamav. More information about these and other updates in version 0.90.3 can be found here:

http://sourceforge.net/project/shownotes.php?release_id=512356&group_id=86638

If you are using the current default installation no action is needed. If you are using a legacy version of ClamAV and you want to take advantage of this update, or wish to install ClamAV, connect to your server through SSH and execute the following command from the prompt:

# vinstall clamav

Note: With legacy version upgrades, if you wish to keep your current ClamAV configuration, you may use the above vinstall to upgrade the program and answer "no" when prompted "Would you like to configure your ClamAV installation? [yes]:" to keep your current configuration.

MySQL 3.x

The vinstall for the MySQL database management system version 3.x will be updated to install version 3.23.59. This version brings the MySQL 3.x vinstall to the most current version of MySQL 3.x and addresses several security issues (CVE-2004-0837, CVE-2004-0381, and CVE-2004-0835), discussed here:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0837
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0381
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0835

More information about changes in MySQL 3.23.59 can be found here:

http://dev.mysql.com/doc/refman/4.1/en/news-3-23-59.html

To install MySQL or upgrade existing installations, make a backup of all databases, shutdown MySQL, uninstall the current version, then connect to your server through SSH and execute the following from the command prompt:

# vinstall mysql3

SquirrelMail

The vinstall for the SquirrelMail Webmail package will be updated to install version 1.4.10a. This version addresses security issues (CVE-2007-1262) discussed here:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-20071262

More information about version 1.4.10a can be found here:

http://sourceforge.net/project/shownotes.php?release_id=507362&group_id=311

To install SquirrelMail or update existing installations, make a backup of your current configuration, uninstall the application, then connect to your server through SSH and execute the following from the command prompt:

# vinstall squirrelmail

Python

The vinstall for the Python programming language will be updated to install version 2.4.4. This version addresses a buffer overrun security issue (CVE-2006-4980) discussed here:

• http://www.FreeBSD.org/ports/portaudit/fe83eb5b-55e1-11db-a5ae-00508d6a62df.html
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4980

To update existing installations, make a backup of any special configurations, uninstall the application, then connect to the server through SSH and executing the following from the command prompt:

# vinstall python

Samba

The vinstall for the Samba SMB/CIFS software suite for file and print services will be updated to install version 3.0.25a. This version addresses issues with group membership, domain user passwords, and object pickers. More information about version 3.0.25a can be found here:

http://www.samba.org/samba/history/samba-3.0.25a.html

To install Samba 3 or upgrade to the new version, make a backup of any special configurations, uninstall the application, then connect to your server through SSH and execute the following command from the prompt:

# vinstall samba3

FreeBSD Ports Collection

The /etc/make.conf configuration file for the FreeBSD Ports Collection will be updated to add configuration information needed by many ports installations. No action needed.

Procmail

The vinstall and vuninstall to set the Procmail email processing utility as the local delivery agent (LDA) will be updated to address errors and configuration problems. This update affects the vinstall and vuninstall only. No action needed.

Signature

Control Panel

The Control Panel will be updated to address several issues, including the following:

• Fixed bug, so that the text for "Junk" and "Quarantine" folders in Move Messages' dropdown folder are brand-able.
• Fixed sorting bug in webmail folder listing. Now the order of the folders change when a user tries to sort them.
• Fixed bug so that the text for Junk folders can be in Japanese. Previously, the folder would only display in English.
• Fixed path of My Mail -> option. Proper breadcrumbing now appears when looking at the My Mail > Option window.
• Fixed a case where a string was hardcoded--rendering parts of the control panel in English instead of Japanese.

PHP 5.x

Upgrade php5 to 5.2.3

This release contains several security enhancements and fixes, and addresses two regressions from previous 5.2(x) releases.

Security Enhancements and Fixes in PHP 5.2.3:

• Fixed an integer overflow inside chunk_split() (by Gerhard Wagner, CVE-2007-2872)
• Fixed possible infinite loop in imagecreatefrompng. (by Xavier Roche, CVE-2007-2756)
• Fixed ext/filter Email Validation Vulnerability (MOPB-45 by Stefan Esser, CVE-2007-1900)
• Fixed bug #41492 (open_basedir/safe_mode bypass inside realpath()) (by bugs.php.net@chsc.dk)
• Improved fix for CVE-2007-1887 to work with non-bundled sqlite2 lib.
• Added mysql_set_charset() to allow runtime altering of connection encoding.

The key improvements of PHP 5.2.3 include:

• Improved compilation of heredocs and interpolated strings.
• Optimized out a couple of per-request syscalls.
• Optimized digest generation in md5() and sha1() functions.
• Over 40 bug fixes.

For more information about version 5.2.3 go to:

http://www.php.net/releases/5_2_3.php

No action needed.

ClamAV

Clam AV update frequency has been changed. No action needed.

Note: This notification could include technical inaccuracies or typographical errors. Changes can be made to the information herein; these changes will be distributed in new notifications. AlpineWeb might make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time.