https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c2 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO CC| |meissner@suse.com InfoProvider| |sgelman@rtr.tu-darmstadt.de --- Comment #2 from Marcus Meissner 2013-11-07 17:05:48 UTC --- which is weird, as sudo does not link against libssl.so.1 directly at least and the update should not have changed anything there either... can you run: ldd /usr/bin/sudo rpm -V sudo -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c3 --- Comment #3 from Sylvia Gelman 2013-11-08 09:43:42 UTC --- here ist the output, it is the same with both libopenssl versions: ldd /usr/bin/sudo linux-vdso.so.1 (0x00007fff37dff000) libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f4d493d6000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f4d491b7000) libutil.so.1 => /lib64/libutil.so.1 (0x00007f4d48fb4000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f4d48db0000) libc.so.6 => /lib64/libc.so.6 (0x00007f4d48a0a000) /lib64/ld-linux-x86-64.so.2 (0x00007f4d49830000) rpm -V sudo 5S.T..... c /etc/sudoers -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c5 --- Comment #5 from Sylvia Gelman 2013-11-08 09:51:42 UTC --- Yes, here we are, with sudo bash and sudoers_debug 1 in /etc/ldap.conf I get: sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_cacertfile -> /etc/ssl/certs/cert.pem sudo: ldap_set_option: tls_cacert -> /etc/ssl/certs/cert.pem sudo: ldap_set_option: tls_cacertdir -> /etc/ssl/certs/ sudo: ldap_set_option: ldap_version -> 3 Speicherzugriffsfehler in /var/log/messages: kernel: [ 6935.215815] sudo[8466]: segfault at 0 ip 00007ffde9187f79 sp 00007fff0fc148b0 error 4 in libssl.so.1.0.0[7ffde9140000+60000] it should be: sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_cacertfile -> /etc/ssl/certs/cert.pem sudo: ldap_set_option: tls_cacert -> /etc/ssl/certs/cert.pem sudo: ldap_set_option: tls_cacertdir -> /etc/ssl/certs sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_start_tls_s() ok sudo: ldap_sasl_bind_s() ok sudo: Looking for cn=defaults: cn=defaults -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c7 --- Comment #7 from Sylvia Gelman 2013-11-08 13:21:55 UTC --- ok, never did that before, hope this is what you mean: gdb /usr/bin/sudo Reading symbols from /usr/bin/sudo... warning: the debug information found in "/usr/lib/debug//usr/bin/sudo.debug" does not match "/usr/bin/sudo" (CRC mismatch). (no debugging symbols found)...done. Missing separate debuginfos, use: zypper install sudo-debuginfo-1.8.5p2-2.8.1.x86_64 I can only install sudo-debuginfo-1.8.5p2-2.1.2.x86_64 from the debug repository (gdb) run bash Starting program: /usr/bin/sudo bash warning: the debug information found in "/usr/lib/debug//usr/lib/sudo/sudoers.so.debug" does not match "/usr/lib/sudo/sudoers.so" (CRC mismatch). warning: the debug information found in "/usr/lib/debug/usr/lib/sudo/sudoers.so.debug" does not match "/usr/lib/sudo/sudoers.so" (CRC mismatch). warning: the debug information found in "/usr/lib/debug//lib64/libssl.so.1.0.0.debug" does not match "/lib64/libssl.so.1.0.0" (CRC mismatch). warning: the debug information found in "/usr/lib/debug/lib64/libssl.so.1.0.0.debug" does not match "/lib64/libssl.so.1.0.0" (CRC mismatch). warning: the debug information found in "/usr/lib/debug//lib64/libcrypto.so.1.0.0.debug" does not match "/lib64/libcrypto.so.1.0.0" (CRC mismatch). warning: the debug information found in "/usr/lib/debug/lib64/libcrypto.so.1.0.0.debug" does not match "/lib64/libcrypto.so.1.0.0" (CRC mismatch). Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_cacertfile -> /etc/ssl/certs/cert.pem sudo: ldap_set_option: tls_cacert -> /etc/ssl/certs/cert.pem sudo: ldap_set_option: tls_cacertdir -> /etc/ssl/certs/ sudo: ldap_set_option: ldap_version -> 3 Program received signal SIGSEGV, Segmentation fault. 0x00007fc97ba49f79 in ?? () from /lib64/libssl.so.1.0.0 (gdb) bt #0 0x00007fc97ba49f79 in ?? () from /lib64/libssl.so.1.0.0 #1 0x00007fc97ba4bed9 in SSL_COMP_get_compression_methods () from /lib64/libssl.so.1.0.0 #2 0x00007fc97ba51a09 in SSL_library_init () from /lib64/libssl.so.1.0.0 #3 0x00007fc97c4fb29e in tlso_init () at tls_o.c:161 #4 0x00007fc97c4f930c in ldap_int_tls_start (ld=ld@entry=0x7fc97eaab0c0, conn=0x7fc97eaab400, srv=srv@entry=0x0) at tls2.c:829 #5 0x00007fc97c4f96f5 in ldap_start_tls_s (ld=0x7fc97eaab0c0, serverctrls=0x0, clientctrls=0x0) at tls2.c:941 #6 0x00007fc97c937636 in ?? () from /usr/lib/sudo/sudoers.so #7 0x00007fc97c931877 in ?? () from /usr/lib/sudo/sudoers.so #8 0x00007fc97d96cf6a in main () -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c9 --- Comment #9 from Sylvia Gelman 2013-11-08 14:42:35 UTC --- After installing several more debuginfo packages, I get this: gdb /usr/bin/sudo Reading symbols from /usr/bin/sudo...Reading symbols from /usr/lib/debug/usr/bin/sudo.debug...done. done. (gdb) run bash Starting program: /usr/bin/sudo bash Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_cacertfile -> /etc/ssl/certs/TU-CAcert.pem sudo: ldap_set_option: tls_cacert -> /etc/ssl/certs/TU-CAcert.pem sudo: ldap_set_option: tls_cacertdir -> /etc/ssl/certs/ sudo: ldap_set_option: ldap_version -> 3 Program received signal SIGSEGV, Segmentation fault. 0x00007f6a9cce9f79 in load_builtin_compressions () at ssl_ciph.c:462 462 ssl_ciph.c: No such file or directory. (gdb) bt #0 0x00007f6a9cce9f79 in load_builtin_compressions () at ssl_ciph.c:462 #1 0x00007f6a9ccebed9 in SSL_COMP_get_compression_methods () at ssl_ciph.c:1799 #2 0x00007f6a9ccf1a09 in SSL_library_init () at ssl_algs.c:144 #3 0x00007f6a9d79b29e in tlso_init () at tls_o.c:161 #4 0x00007f6a9d79930c in ldap_int_tls_start (ld=ld@entry=0x7f6aa0bb00c0, conn=0x7f6aa0bb0400, srv=srv@entry=0x0) at tls2.c:829 #5 0x00007f6a9d7996f5 in ldap_start_tls_s (ld=0x7f6aa0bb00c0, serverctrls=serverctrls@entry=0x0, clientctrls=clientctrls@entry=0x0) at tls2.c:941 #6 0x00007f6a9dbd7636 in sudo_ldap_open (nss=0x7f6a9ddfdbc0 ) at ./ldap.c:2232 #7 0x00007f6a9dbd1877 in sudoers_policy_open (version=2648693696, conversation=<optimized out>, plugin_printf=<optimized out>, settings=0x7f6aa0ba4120, user_info=0x7f6aa0ba3760, envp=0x7fffbfdb9740, args=0x0) at ./sudoers.c:205 #8 0x00007f6a9ec0cf6a in policy_open (user_env=0x7fffbfdb9740, user_info=0x7f6aa0ba3760, settings=0x7f6aa0ba4120, plugin=<optimized out>) at /sudo.c:1102 #9 main (argc=2, argv=<optimized out>, envp=0x7fffbfdb9740) at ./sudo.c:221 A workaround is setting the enviroment variable like mentioned here: openSUSE Security Update: openssl: disable compression OPENSSL_NO_DEFAULT_ZLIB=no -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c11 --- Comment #11 from Marcus Meissner 2013-11-08 14:54:11 UTC --- this line: if (ssl_comp_methods != NULL && strncmp( getenv("OPENSSL_NO_DEFAULT_ZLIB"), "no", 2) == 0) and I suspect getenv() here returns 0 ... and the lines above do not trigger :( -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c13 --- Comment #13 from Shawn Chang 2013-11-10 12:30:22 UTC --- (In reply to comment #11)

this line: if (ssl_comp_methods != NULL && strncmp( getenv("OPENSSL_NO_DEFAULT_ZLIB"), "no", 2) == 0)

and I suspect getenv() here returns 0 ... and the lines above do not trigger :(

getenv() here would return 0( NULL) in the most cases, since there's no value for OPENSSL_NO_DEFAULT_ZLIB by default. But I don't know what makes it wrong with sudo? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c15 --- Comment #15 from Sylvia Gelman 2013-11-13 10:11:28 UTC --- Hi, I have installed: openssl-1.0.1e-2.12.1.x86_64 libopenssl1_0_0-32bit-1.0.1e-2.12.1.x86_64 libopenssl-devel-1.0.1e-2.12.1.x86_64 libopenssl1_0_0-1.0.1e-2.12.1.x86_64 libopenssl0_9_8-0.9.8x-1.1.2.i586 sudo-1.8.5p2-2.8.1.x86_64 and we are using sudo-ldap with a configuration in /etc/ldap.conf: sudoers_base ou=sudoers,ou=*,dc=*,dc=*,dc=*,dc=de sudoers_debug 0 What more Informations do you need? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c17 --- Comment #17 from Sylvia Gelman 2013-12-18 14:53:46 UTC --- Sure, but I have only a Opensuse 12.2 to check, can I test the updates also with that version? It says Opensuse_12.3 ... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c19 --- Comment #19 from Bernhard Wiedemann 2013-12-18 17:00:22 CET --- This is an autogenerated message for OBS integration: This bug (849377) was mentioned in https://build.opensuse.org/request/show/211421 Factory / openssl -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c21 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED InfoProvider|sgelman@rtr.tu-darmstadt.de | Resolution| |FIXED --- Comment #21 from Marcus Meissner 2013-12-19 10:39:40 UTC --- Thank you! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|obs:running:2431:moderate |obs:running:2430:moderate -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c22 --- Comment #22 from Swamp Workflow Management 2013-12-25 16:04:23 UTC --- openSUSE-RU-2013:1951-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 849377 CVE References: Sources used: openSUSE 13.1 (src): openssl-1.0.1e-11.5.1 openSUSE 12.3 (src): openssl-1.0.1e-1.17.1 openSUSE 12.2 (src): openssl-1.0.1e-2.16.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849377 https://bugzilla.novell.com/show_bug.cgi?id=849377#c24 --- Comment #24 from Swamp Workflow Management 2014-01-03 21:08:42 UTC --- openSUSE-SU-2014:0018-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 849377,856687 CVE References: CVE-2013-6449 Sources used: openSUSE 12.2 (src): openssl-1.0.1e-2.16.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=849377 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:2430:moderate |obs:running:2430:moderate |obs:running:2431:moderate | -- You are receiving this mail because: You are on the CC list for the bug.