FreeBSD: VID-E7DCD69D-8EE6-11E6-A590-14DAE9D210B8: FreeBSD -- Multiple portsnap vulnerabilities

Problem Description:

Flaws in portsnap's verification of downloaded tar files

allows additional files to be included without causing the

verification to fail. Portsnap may then use or execute these

files.

Impact:

An attacker who can conduct man in the middle attack on

the network at the time when portsnap is run can cause

portsnap to execute arbitrary commands under the credentials

of the user who runs portsnap, typically root.