[opensuse-security] Re: [suse-security-announce] SUSE Security Summary Report SUSE-SR:2007:012
Hi, Marcus Meissner wrote
____________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
- Kernel Update
We are currently preparing a kernel update for SUSE Linux Enterprise Server 9, Novell Linux Desktop 9, SUSE Linux 10.0 and 10.2 to roll out fixes for current security problems. It is scheduled to be be released in the week of June 11.
now that the SLES9 kernels were just release I read this again an wonder if it's correct that are no updates planned for SuSE 10.1 (meaning SLES10,too) while they are planned for 10.0 and 10.2? cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Thu, Jun 14, 2007 at 04:42:08PM +0200, Frank Steiner wrote:
Hi,
Marcus Meissner wrote
____________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
- Kernel Update
We are currently preparing a kernel update for SUSE Linux Enterprise Server 9, Novell Linux Desktop 9, SUSE Linux 10.0 and 10.2 to roll out fixes for current security problems. It is scheduled to be be released in the week of June 11.
now that the SLES9 kernels were just release I read this again an wonder if it's correct that are no updates planned for SuSE 10.1 (meaning SLES10,too) while they are planned for 10.0 and 10.2?
The next kernel release for SLES 10 will be the SLES10 SP1 release kernel, afterwards we will pick up on the SLES 10 SP1 kernel series for security fixes. 10.1 will be brought to this kernel level too, same as we did with 8.1 and 9.1. Ciao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
Marcus Meissner wrote
The next kernel release for SLES 10 will be the SLES10 SP1 release kernel, afterwards we will pick up on the SLES 10 SP1 kernel series for security fixes.
10.1 will be brought to this kernel level too, same as we did with 8.1 and 9.1.
Ok, thanks! I just wonder when SP1 will finally be released :-) I remember the SLES10 support telling me the service pack would be released "in the very near future", but that was in March ;-) cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Fri, Jun 15, 2007 at 10:28:12AM +0200, Frank Steiner wrote:
Marcus Meissner wrote
The next kernel release for SLES 10 will be the SLES10 SP1 release kernel, afterwards we will pick up on the SLES 10 SP1 kernel series for security fixes.
10.1 will be brought to this kernel level too, same as we did with 8.1 and 9.1.
Ok, thanks! I just wonder when SP1 will finally be released :-) I remember the SLES10 support telling me the service pack would be released "in the very near future", but that was in March ;-)
End of May was the plan from the beginning. :) Ciao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Fri June 15 2007 8:42 am, Marcus Meissner scratched these words onto a coconut shell, hoping for an answer:
On Fri, Jun 15, 2007 at 10:28:12AM +0200, Frank Steiner wrote:
Marcus Meissner wrote
The next kernel release for SLES 10 will be the SLES10 SP1 release kernel, afterwards we will pick up on the SLES 10 SP1 kernel series for security fixes.
10.1 will be brought to this kernel level too, same as we did with 8.1 and 9.1.
Ok, thanks! I just wonder when SP1 will finally be released :-) I remember the SLES10 support telling me the service pack would be released "in the very near future", but that was in March ;-)
End of May was the plan from the beginning. :)
Marcus, are these "road maps" available on the net ? That was we can point folks to them.. and perhaps not have to have pages and pages of complaints about this subject. i.e where is the SPx for SLESx ... Apparently folks don't subscribe to your notices . OR at least they don't seem to remember them. ;-) -- j I've lived in the real world enough, we're all here because we ain't all there. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Fri, Jun 15, 2007 at 09:37:01AM -0400, jfweber@gilweber.com wrote:
On Fri June 15 2007 8:42 am, Marcus Meissner scratched these words onto a coconut shell, hoping for an answer:
On Fri, Jun 15, 2007 at 10:28:12AM +0200, Frank Steiner wrote:
Marcus Meissner wrote
The next kernel release for SLES 10 will be the SLES10 SP1 release kernel, afterwards we will pick up on the SLES 10 SP1 kernel series for security fixes.
10.1 will be brought to this kernel level too, same as we did with 8.1 and 9.1.
Ok, thanks! I just wonder when SP1 will finally be released :-) I remember the SLES10 support telling me the service pack would be released "in the very near future", but that was in March ;-)
End of May was the plan from the beginning. :)
Marcus, are these "road maps" available on the net ? That was we can point folks to them.. and perhaps not have to have pages and pages of complaints about this subject. i.e where is the SPx for SLESx ...
Apparently folks don't subscribe to your notices . OR at least they don't seem to remember them. ;-)
I have no information authority for SLES and Marketing / Product Management would be very unhappy with me if I told you anything more. http://www.novell.com/news/press/novell-outlines-enhancements-in-suse-linux-... is our last official statement I could find in a blink. For our openSUSE community releases the schedule is however very public on www.opensuse.org. Ciao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Fri June 15 2007 10:57 am, Marcus Meissner scratched these words onto a coconut shell, hoping for an answer:
On Fri, Jun 15, 2007 at 09:37:01AM -0400, jfweber@gilweber.com wrote:
On Fri June 15 2007 8:42 am, Marcus Meissner scratched these words onto
a coconut shell, hoping for an answer:
On Fri, Jun 15, 2007 at 10:28:12AM +0200, Frank Steiner wrote:
Marcus Meissner wrote
The next kernel release for SLES 10 will be the SLES10 SP1 release kernel, afterwards we will pick up on the SLES 10 SP1 kernel series for security fixes.
<snipped>
Apparently folks don't subscribe to your notices . OR at least they don't seem to remember them. ;-)
I have no information authority for SLES and Marketing / Product Management would be very unhappy with me if I told you anything more.
http://www.novell.com/news/press/novell-outlines-enhancements-in-suse -linux-enterprise-10-service-pack-1 is our last official statement I could find in a blink.
For our openSUSE community releases the schedule is however very public on www.opensuse.org.
Ciao, Marcus
Gotcha, Thanks luv. ;-) -- j I've lived in the real world enough, we're all here because we ain't all there. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
Marcus Meissner wrote
Ok, thanks! I just wonder when SP1 will finally be released :-) I remember the SLES10 support telling me the service pack would be released "in the very near future", but that was in March ;-)
End of May was the plan from the beginning. :)
Ok, here we go ;-) However, I wonder why yup isn't still offering any of the SP1 updates... Is there a place to ask things like that, instead of here? I'm not aware of a SLES mailinglist, and opening a support request every time for questions like that seems to be overkill... cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Wed, Jun 20, 2007 at 09:30:47AM +0200, Frank Steiner wrote:
Marcus Meissner wrote
Ok, thanks! I just wonder when SP1 will finally be released :-) I remember the SLES10 support telling me the service pack would be released "in the very near future", but that was in March ;-)
End of May was the plan from the beginning. :)
Ok, here we go ;-) However, I wonder why yup isn't still offering any of the SP1 updates... Is there a place to ask things like that, instead of here? I'm not aware of a SLES mailinglist, and opening a support request every time for questions like that seems to be overkill...
The channelnames have changed, and also the update server. Matthias Eckermann has an updated YUP at: http://software.opensuse.org/download/home:/mge1512/SLE_10/noarch which we will also release later for SLE10 via online update. Ciao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
Marcus Meissner wrote
The channelnames have changed, and also the update server.
Ah, ok.
Matthias Eckermann has an updated YUP at: http://software.opensuse.org/download/home:/mge1512/SLE_10/noarch
which we will also release later for SLE10 via online update.
Thanks a log! -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
Frank Steiner wrote
Matthias Eckermann has an updated YUP at: http://software.opensuse.org/download/home:/mge1512/SLE_10/noarch
which we will also release later for SLE10 via online update.
Thanks a log!
Ah, "lot" ;-) Seems that sth. else has changed, too. My authorization dates that work with update.novell.com are rejected by nu.novell.com. Do I need to do some additional registration somwhere? cu, Frank Fetching https://<hidden>@nu.novell.com/repo/$RCE/SLES10-Updates/sles-10-i586/repodata/repomd.xml.asc... FAILED with exit code 22 Failure details: ---------------------------------------------------------------------------- * About to connect() to nu.novell.com port 443 * Trying 63.76.115.16... connected * Connected to nu.novell.com (63.76.115.16) port 443 * successfully set certificate verify locations: * CAfile: /usr/share/curl/curl-ca-bundle.crt CApath: none * SSLv2, Client hello (1): * SSLv3, TLS handshake, Server hello (2): SSLv3, TLS handshake, CERT (11): SSLv3, TLS handshake, Server finished (14): SSLv3, TLS handshake, Client key exchange (16): SSLv3, TLS change cipher, Client hello (1): SSLv3, TLS handshake, Finished (20): SSLv3, TLS change cipher, Client hello (1): SSLv3, TLS handshake, Finished (20): SSL connection using DES-CBC3-SHA * Server certificate: * subject: /C=US/ST=Utah/L=Provo/O=Novell, Inc./OU=Novell, Inc./CN=nu.novell.com * start date: 2007-02-26 16:43:57 GMT * expire date: 2010-02-26 16:43:57 GMT * common name: nu.novell.com (matched) * issuer: /C=US/O=Equifax/OU=Equifax Secure Certificate Authority * SSL certificate verify ok. * Server auth using Basic with user '<hiddem>'
GET /repo/$RCE/SLES10-Updates/sles-10-i586/repodata/repomd.xml.asc HTTP/1.1 Authorization: Basic ZjUyYTNlYTFjMjA3NDg5MjhkMDU5OGIwZjhjNDFkNGU6ZTUxODJlZWEwMmExNGU5MDhjMzE1MGU0ZmE3MGYzZmE= User-Agent: curl/7.15.1 (x86_64-suse-linux) libcurl/7.15.1 OpenSSL/0.9.8a zlib/1.2.3 libidn/0.6.0 Host: nu.novell.com Accept: */* If-Modified-Since: Wed, 20 Jun 2007 07:42:59 GMT
< HTTP/1.1 401 Unauthorized < X-Error-Description: Access to this page is restricted because of access control policies. < Content-Type: text/html; charset=utf-8 < Content-Length: 2917 < Pragma: no-cache < WWW-Authenticate: Digest realm="Express", qop="auth", nonce="cp9cjdf7/euCJOH3wYfk9Q==" * Authentication problem. Ignoring this. < WWW-Authenticate: Basic realm="iChain" < Connection: close * The requested URL returned error: 401 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Closing connection #0 * SSLv3, TLS alert, Client hello (1): curl: (22) The requested URL returned error: 401 ---------------------------------------------------------------------------- -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
On Wed, Jun 20, 2007 at 10:25:02AM +0200, Frank Steiner wrote:
Frank Steiner wrote
Matthias Eckermann has an updated YUP at: http://software.opensuse.org/download/home:/mge1512/SLE_10/noarch
which we will also release later for SLE10 via online update.
Thanks a log!
Ah, "lot" ;-)
Seems that sth. else has changed, too. My authorization dates that work with update.novell.com are rejected by nu.novell.com. Do I need to do some additional registration somwhere?
It should work. Is the deviceid/secret matching a sles10/i586 product? Ciao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
participants (3)
-
Frank Steiner -
jfweber＠gilweber.com -
Marcus Meissner