Security and NetBSD

See the advisory archive for a complete list.

In some cases a security issue will be discovered in NetBSD-current and then be resolved soon after. These issues are often short lived any do not impact any NetBSD releases. In these cases we don't release patches or advisories specifically for NetBSD-current, but instead recommend that you update to a version containing the fixes. See the advisories above for the fix dates. If a security issue is identified that just impacts NetBSD-current the NetBSD security officer team will send an email to the current-users mailing list detailing the issue and what updates are necessary. We recommend that all users running NetBSD-current subscribe to the current-users mailing list so that they are aware of these issues. Users tracking NetBSD-current should be upgrading their systems often to gain new features as well as resolving known issues.

The NetBSD pkgsrc Security Team and package maintainers keep a list of known security vulnerabilities in packages which are (or have been) included in pkgsrc. The list is available from the NetBSD FTP site at:

Through audit-packages, this list can be downloaded automatically, and a security audit of all packages installed on a system can take place.

There are two components to audit-packages. The first component, download-vulnerability-list, is for downloading the list of vulnerabilities from the NetBSD FTP site. The second component, audit-packages, checks to see if any of your installed packages are vulnerable. If a package is vulnerable, you will see output similar to the following:

Users can set up audit-packages to download the pkg-vulnerabilities file daily, and include a package audit in the daily security script. Details on this are located in the MESSAGE file for pkg_install.

If you believe you have found a security issue for a software package in pkgsrc that is not detected by audit-packages then contact the pkgsrc Security Team.

In April 2007 the functionality provided by the security/audit-packages package was re-written in C and merged into the pkg_install package. This brought a number of improvements in terms of both speed and functionality when compared to the old security/audit-packages package. In January of 2008 the security/audit-packages package was removed from the pkgsrc CVS tree and the required version of the pkg_install package was increased to pkg_install-20071224 so that the functionality that was provided by security/audit-packages was adequately replaced. The migration process should be easy for most users and simply involve removing the old package (i.e. pkg_delete audit-packages) and then updating pkg_install, you must follow this process as pkgtools/pkg_install and security/audit-packages install conflicting files. In addition to this any scripts (e.g. crontab(5) files, security.local etc.) that point to the old binaries (i.e. audit-packages and download-vulnerability-list) must also be updated.

If you cannot migrate to pkg_install-20071224 immediately and need to continue using security/audit-packages to look for package vulnerabilities the pkgsrc Security Team will continue to keep the pkg-vulnerabilities database up to date until at least the pkgsrc-2008Q1 branch has been cut. When support for security/audit-packages is fully removed we will update the old pkg-vulnerabilities database to indicate that it will no longer be updated. At this point you should upgrade to pkg_install>=20071224 in order to receive further updates to the pkg-vulnerabilities database.

For any questions or problems with this process please contact either the pkgsrc Security Team or appropriate NetBSD mailing list (e.g. pkgsrc-users or tech-pkg).