July 2011 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 706670] New: $LD_LIBRARY_PATH evaluates ':' incorrectly as '.' leading to a vulnerability
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=706670 https://bugzilla.novell.com/show_bug.cgi?id=706670#c0 Summary: $LD_LIBRARY_PATH evaluates ':' incorrectly as '.' leading to a vulnerability Classification: openSUSE Product: openSUSE 11.3 Version: Final Platform: All OS/Version: openSUSE 11.3 Status: NEW Severity: Critical Priority: P5 - None Component: Security AssignedTo: security-team(a)suse.de ReportedBy: external.martin.konold(a)de.bosch.com QAContact: qa(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.17) Gecko/20110420 SUSE/3.6.17-0.2.1 Firefox/3.6.17 A $LD_LIBRARY_PATH which ends with ":" is treated like a '.' in some cases. This leads to a potential exploit. The problem was discovered on OpenSUSE 11.3 (uptodate) and it is verified that it does not happen with SLES10SP4. Further systems can be easily examined upon request. Reproducible: Always Steps to Reproduce: 1. as user nobody copy /lib/libc.so.6 to /tmp 2. as user someuser verify that $LD_LIBRARY_PATH is empty 3. as user someuser execute "export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH 4. as user someuser $LD_LIBRARY_PATH using "printenv LD_LIBRARY_PATH" 5. the result look like someuser@machine:~> printenv LD_LIBRARY_PATH /usr/local/lib/: 6. as user someuser execute "ldd /bin/ls" in $HOME 7. verify that the result will look like someuser@machine:~> ldd /bin/ls linux-vdso.so.1 => (0x00007fffe29ff000) librt.so.1 => /lib64/librt.so.1 (0x00002b464f03d000) libacl.so.1 => /lib64/libacl.so.1 (0x00002b464f146000) libc.so.6 => /lib64/libc.so.6 (0x00002b464f24d000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00002b464f48e000) /lib64/ld-linux-x86-64.so.2 (0x00002b464ef21000) libattr.so.1 => /lib64/libattr.so.1 (0x00002b464f5a7000) 8. This is fine 9. as user someuser change to directory /tmp (cd /tmp) 10. 6. as user someuser execute "ldd /bin/ls" in $HOME 7. verify that the result will on SLES10SP4 look like someuser@machine:tmp> ldd /bin/ls linux-vdso.so.1 => (0x00007fff45dff000) librt.so.1 => /lib64/librt.so.1 (0x00002ac2f283d000) libacl.so.1 => /lib64/libacl.so.1 (0x00002ac2f2946000) libc.so.6 => /lib64/libc.so.6 (0x00002ac2f2a4d000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00002ac2f2c8e000) /lib64/ld-linux-x86-64.so.2 (0x00002ac2f2721000) libattr.so.1 => /lib64/libattr.so.1 (0x00002ac2f2da7000) But on OpenSUSE 11.3 (did not check other versions sofar) it will look like: someuser@machine:tmp> ldd /bin/ls linux-gate.so.1 => (0xb783e000) librt.so.1 => /lib/librt.so.1 (0xb77f3000) libselinux.so.1 => /lib/libselinux.so.1 (0xb77d4000) libcap.so.2 => /lib/libcap.so.2 (0xb77ce000) libacl.so.1 => /lib/libacl.so.1 (0xb77c4000) libc.so.6 (0xb7658000) libpthread.so.0 => /lib/libpthread.so.0 (0xb763d000) /lib/ld-linux.so.2 (0xb7820000) libdl.so.2 => /lib/libdl.so.2 (0xb7638000) libattr.so.1 => /lib/libattr.so.1 (0xb7632000) Actual Results: With OpenSUSE 11.3 a LD_LIBRARY_PATH=/some/trusted/path: leads to cwd to be prepended in the search path for shared libraries. someuser@machine:tmp> ldd /bin/ls linux-gate.so.1 => (0xb783e000) librt.so.1 => /lib/librt.so.1 (0xb77f3000) libselinux.so.1 => /lib/libselinux.so.1 (0xb77d4000) libcap.so.2 => /lib/libcap.so.2 (0xb77ce000) libacl.so.1 => /lib/libacl.so.1 (0xb77c4000) libc.so.6 (0xb7658000) libpthread.so.0 => /lib/libpthread.so.0 (0xb763d000) /lib/ld-linux.so.2 (0xb7820000) libdl.so.2 => /lib/libdl.so.2 (0xb7638000) libattr.so.1 => /lib/libattr.so.1 (0xb7632000) The problem does not exist with SLES10SP4 Expected Results: someuser@machine:tmp> ldd /bin/ls linux-gate.so.1 => (0xb783e000) librt.so.1 => /lib/librt.so.1 (0xb77f3000) libselinux.so.1 => /lib/libselinux.so.1 (0xb77d4000) libcap.so.2 => /lib/libcap.so.2 (0xb77ce000) libacl.so.1 => /lib/libacl.so.1 (0xb77c4000) libc.so.6 => /lib/libc.so.6 (0xb7658000) libpthread.so.0 => /lib/libpthread.so.0 (0xb763d000) /lib/ld-linux.so.2 (0xb7820000) libdl.so.2 => /lib/libdl.so.2 (0xb7638000) libattr.so.1 => /lib/libattr.so.1 (0xb7632000) I think that this change in semantics is security relevant as many installations have stuff like "export LD_LIBRARY_PATH=/some/trusted/path/lib:$LD_LIBRARY_PATH" in the local shell environments by default. If really required provide a test script and test on more SUSE platforms including SLES11. In addition I can trivially provide an exploit. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 10

[Bug 701857] New: No swedish translation of menus
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=701857 https://bugzilla.novell.com/show_bug.cgi?id=701857#c0 Summary: No swedish translation of menus Classification: openSUSE Product: openSUSE 12.1 Version: Milestone 2 Platform: x86-64 OS/Version: SuSE Other Status: NEW Severity: Normal Priority: P5 - None Component: Translations AssignedTo: ke(a)novell.com ReportedBy: ingesvensson(a)orion.vokby.se QAContact: ke(a)novell.com Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 I choose Swedish language and keyboard at installation, but still all menus are in English (not so in Milestone 1) Reproducible: Always Steps to Reproduce: 1.install 2.choose swedish language and keyboard 3.choose KDE Desktop 4. log in 5. Switch to classic style Actual Results: All menus in the "Start menu" are in English Expected Results: The munus should have been in Swedish. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 11

[Bug 704419] New: Use JRE path as jdk-home rather than SDK
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=704419 https://bugzilla.novell.com/show_bug.cgi?id=704419#c0 Summary: Use JRE path as jdk-home rather than SDK Classification: openSUSE Product: openSUSE 12.1 Version: Factory Platform: Other OS/Version: Other Status: ASSIGNED Severity: Critical Priority: P5 - None Component: Java AssignedTo: mvyskocil(a)novell.com ReportedBy: mvyskocil(a)novell.com QAContact: qa(a)suse.de Found By: Community User Blocker: --- The icedtea-web plugin use the following path /usr/lib64/jvm/java-1.6.0-openjdk/jre which expects SDK (-devel) is installed. Change the location to /usr/lib64/jvm/java-1.6.0-openjdk-1.6.0/ owned by JRE (java-1_6_0-openjdk) will fix all problems that one is not able spawn the java vm like https://bugzilla.novell.com/show_bug.cgi?id=702825#c25 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 9

[Bug 573292] New: xrdp - Duplicate Display Number xrdp-0.4.1-39.1.i586.rpm
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

http://bugzilla.novell.com/show_bug.cgi?id=573292 http://bugzilla.novell.com/show_bug.cgi?id=573292#c0 Summary: xrdp - Duplicate Display Number xrdp-0.4.1-39.1.i586.rpm Classification: openSUSE Product: openSUSE 11.1 Version: Final Platform: i586 OS/Version: openSUSE 11.1 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: markmak888(a)msn.com QAContact: qa(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 3.0.04506.30; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; NET CLR 3.5.30729) If we use the libdmx.so / libvnc.so, the Display Number may be duplicate. Refer to soruce code, the display number is (10 + active user). Therefore, the display number will be duplicate. All users cannot ise xrdp logon. Reproducible: Always Steps to Reproduce: User A - :10 User B - :11 User C - :12 User D - :13 After User B to logout, The User E to login, the display will use ":13" (10+3 Active Users). If User A/C/D was not logout, no one can login again. Actual Results: User cannot via xrdp to logon in some cases I used to foolish to solve it. In the "session.c", delete "g_session_count--" statement to solve it. But I need to reboot in daily to avoid high display number. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 677011] New: /suse/bin/floor cannot edit birthday
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=677011 https://bugzilla.novell.com/show_bug.cgi?id=677011#c0 Summary: /suse/bin/floor cannot edit birthday Classification: openSUSE Product: openSUSE 11.4 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: max(a)novell.com ReportedBy: jw(a)novell.com QAContact: qa(a)suse.de CC: bmaryniuk(a)novell.com Found By: --- Blocker: --- I right-click my name, -> 'modify information on user' click one of the triangles of the month, then the day disappears, and can no longer be entered. Changing only the month has no effect. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 1

[Bug 707076] New: polkit-default-privs: change org.freedesktop.accounts.user-administration to auth_admin_keep
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=707076 https://bugzilla.novell.com/show_bug.cgi?id=707076#c0 Summary: polkit-default-privs: change org.freedesktop.accounts.user-administration to auth_admin_keep Classification: openSUSE Product: openSUSE 12.1 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME AssignedTo: lnussel(a)novell.com ReportedBy: vuntz(a)novell.com QAContact: qa(a)suse.de Found By: --- Blocker: --- The user accounts panel in gnome-control-center has a "unlock" button to change settings of other users. This can only work if org.freedesktop.accounts.user-administration is set to auth_admin_keep (instead of auth_admin, the current value). It'd also be nice to be able to have no authentication for org.freedesktop.accounts.change-own-user-data, but that might be blocked by the accountsservice review (bug 676638). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 1

[Bug 706134] New: libakonadiprotocalinternals - Akonadi-runtime dependence problem
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=706134 https://bugzilla.novell.com/show_bug.cgi?id=706134#c0 Summary: libakonadiprotocalinternals - Akonadi-runtime dependence problem Classification: openSUSE Product: openSUSE 11.4 Version: Final Platform: x86-64 OS/Version: openSUSE 11.4 Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: upscope(a)nwi.net QAContact: jsrain(a)novell.com Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (compatible; Konqueror/4.6; Linux) KHTML/4.6.5 (like Gecko) SUSE YaST2 has updates for Akonadi-runtime from 1.5.0-3.3.1 to 1.6.0-93.1 libakonadiprotocolinternals-devel and libakonadiprotoclinternals1 from 1.5.0-3.3.1 to 1.6.0-93.1. These two say they are dependent on Akonadi-runtime 1.5.0. If you follow recommendations and deinstall kaddressbook, etc and change vendor, then it install but there is no contacts available in Kontact. openSUSE 11.4 with latest updats., KDE 4.6.5 release "8" Kontact 4.4.11 Kmail 1.13.7 Contacts 4.4.11 This updates works on openSUSE 12.1 MS2. Reproducible: Always Steps to Reproduce: 1. log into YaST2 as root 2. selct akonadi-runtime to update to 1.6.0 3. then select libakonadiprotocolinternals-devel and libakonadiprotoclinternals1 from 1.5.0-3.3.1 to 1.6.0-93.1 4. look at dependence messages. 5. try recommendations then cancel the updates. Actual Results: Dependences Expected Results: No dependences, should install if really intended for 11.4 See details fj8u:~> rpm -qa |grep akonadi* libakonadiprotocolinternals1-1.5.0-3.3.1.x86_64 akonadi-runtime-debuginfo-1.6.0-93.1.x86_64 libakonadiprotocolinternals1-debuginfo-1.5.3-91.1.x86_64 libakonadi4-4.6.5-8.3.x86_64 libakonadi4-debuginfo-4.6.5-8.3.x86_64 libakonadiprotocolinternals-devel-1.5.0-3.3.1.x86_64 akonadi-runtime-1.5.0-3.3.1.x86_64 Looks like I missed backing out akonadi-runtime-debug Hardware: Intel mother board 8 GB Memory separate partitions on separate disc drives for 11.4 and 12.1 Not sure if this is right category, so feel free to move this. also not sure of Severity If you need more info let me know. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 7

[Bug 675969] New: [11.5] Check NTP support in gnome-control-center
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=675969 https://bugzilla.novell.com/show_bug.cgi?id=675969#c0 Summary: [11.5] Check NTP support in gnome-control-center Classification: openSUSE Product: openSUSE 11.4 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME AssignedTo: bnc-team-gnome(a)forge.provo.novell.com ReportedBy: vuntz(a)novell.com QAContact: qa(a)suse.de Found By: --- Blocker: --- We probably have to fix the new gnome-control-center to understand NTP configuration in openSUSE. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3

[Bug 688071] New: gnome 3 -- Make autologin feature work in users panel
by bugzilla_noreply＠novell.com 21 Jul '11

21 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=688071 https://bugzilla.novell.com/show_bug.cgi?id=688071#c0 Summary: gnome 3 -- Make autologin feature work in users panel Classification: openSUSE Product: openSUSE 11.5 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME AssignedTo: bnc-team-gnome(a)forge.provo.novell.com ReportedBy: vuntz(a)novell.com QAContact: qa(a)suse.de Found By: --- Blocker: --- See summary; it apparently doesn't work because we need integration with sysconfig. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 678754] New: webpin for 11.4 does not recognize 11.4 (needs version bump in code)
by bugzilla_noreply＠novell.com 20 Jul '11

20 Jul '11

https://bugzilla.novell.com/show_bug.cgi?id=678754 https://bugzilla.novell.com/show_bug.cgi?id=678754#c0 Summary: webpin for 11.4 does not recognize 11.4 (needs version bump in code) Classification: openSUSE Product: openSUSE 11.4 Version: Final Platform: x86-64 OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: drankinatty(a)suddenlinkmail.com QAContact: qa(a)suse.de Found By: --- Blocker: --- Guys, Simple one: [19:04 alchemy:/etc/X11/xorg.conf.d] # zypper in webpin Loading repository data... Reading installed packages... Resolving package dependencies... The following NEW package is going to be installed: webpin 1 new package to install. Overall download size: 28.0 KiB. After the operation, additional 72.0 KiB will be used. Continue? [y/n/?] (y): Retrieving package webpin-1.2.2-1.1.noarch (1/1), 28.0 KiB (72.0 KiB unpacked) Retrieving: webpin-1.2.2-1.1.noarch.rpm [done (6.5 KiB/s)] Installing: webpin-1.2.2-1.1 [done] [19:04 alchemy:/etc/X11/xorg.conf.d] # webpin firefox ERROR: invalid or unsupported value for distribution version: "11.4" Valid values are: 11.0, factory, 11.2, 11.1, Factory, 11.3, latest It needs latest changed to 11.4 :) ** Just labeled 'Major' because a major feature of the backage is broken (that's if the indexing is even fixed from 11.3 :) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 9