January 2002 - openSUSE Security Announce

SuSE Security Announcement: rsync (SuSE-SA:2002:004)
by Sebastian Krahmer 25 Jan '02

25 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: rsync Announcement-ID: SuSE-SA:2002:004 Date: Fri Jan 25 17:00:00 CET 2002 Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: remote command executionn Severity (1-10): 7 SuSE default package: no Other affected systems: All systems with vulnerable rsync. Content of this advisory: 1) security vulnerability resolved: rsync negative array indexing problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The rsync program allows users and administrators to synchronize files and whole directory structures on different machines. It is common practise to allow remote users to mirror ftp servers via anonymous rsync access. There exist several signedness bugs within the rsync program which allow remote attackers to write 0-bytes to almost arbitrary stack-locations, therefore being able to control the programflow and obtaining a shell remotely. These bugs have been fixed. It is recommended (also stated in the rsync documentation) to use the "use chroot" option in rsyncd's configuration file (/etc/rsyncd.conf) to limit the impact of a possible attack. Since this workaround does not completely solve the security problem, we recommend to update the package as described below. We want to express our gratitude to Andrew Tridgell and Martin Pool, the rsync authors and maintainers, for their excellent cooperation in this matter. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. To be sure that the update takes effect, kill any existing instances of the rsync-program. In case you run rsync via the inetd superserver, you do not need to restart any of your services. Inetd will automatically use the new binary. If you used run your rsync-service with the "rsync --daemon" command, restart your rsync with "rync --daemon" again, this time using the new binary. i386 Intel Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/rsync-2.4.6-288.i386.rpm ce6d9226a8a9a5644ece29926c1f51d7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/rsync-2.4.6-288.src.rpm 0e354408f232b25fe0089b97073009a3 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/rsync-2.4.6-289.i386.rpm 1ff42b8149e21644d23fe71c40a3ec5a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/rsync-2.4.6-289.src.rpm 83407b4dfad94d21af60ba3e8025e6cd SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/rsync-2.4.6-288.i386.rpm 26533f97af4474b450ad43a171c5571f source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/rsync-2.4.6-288.src.rpm dcd1345446871320962e91d979ddb25b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/rsync-2.3.2-124.i386.rpm f16f81e5a0a11ba951b6f923cbae2abd source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/rsync-2.3.2-124.src.rpm cd36ce735b4ca91f92fc2f3c7603037f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/rsync-2.3.2-123.i386.rpm c9330c9123757f89ed94382874122c82 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/rsync-2.3.2-123.src.rpm d97478d6fe9f2419b8700c52be4d888a Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/rsync-2.4.6-135.sparc.rpm 669f52233aed0766dd72788741691558 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/rsync-2.4.6-135.src.rpm 85ddaa9518d19f6341a68ce254668f0b SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/rsync-2.4.6-135.sparc.rpm d68ebcdba8caa16360e225fc9d28dc54 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/rsync-2.4.6-135.src.rpm b9f1f43d0248b763aef46bd610233285 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/rsync-2.3.2-5.sparc.rpm 50b9cefa5f4bf86fc1e20184c15fb542 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/rsync-2.3.2-5.src.rpm ffbc3ff43c339cbbe12317bb98587df3 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/rsync-2.4.6-123.alpha.rpm 3b602bd23179a7b6ce162d2d377394af source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/rsync-2.4.6-123.src.rpm 65f9d53cb48b8456466a27d9cde04339 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/rsync-2.3.2-30.alpha.rpm 2056422feb3b2b53285413ca746f2f4e source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/rsync-2.3.2-30.src.rpm 88c3a630df0e3073a8be55b0008371a0 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/rsync-2.3.2-31.alpha.rpm 18ea59b5c4d4641b62cef9c11f535ae8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/rsync-2.3.2-31.src.rpm 091659d90d3e079c0f8d4518c2c42f9f Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/rsync-2.4.6-150.ppc.rpm f5576fca06f5d22b1410aaba399e0791 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/rsync-2.4.6-150.src.rpm 1baeeffafe1c7dd75189cbfe704bddf0 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/rsync-2.4.6-151.ppc.rpm 04102efb5a83b5190fe6b02146ec522b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/rsync-2.4.6-151.src.rpm 4a21e9f5b36f6767436c6ea92f5d17e7 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/rsync-2.3.2-133.ppc.rpm 897e0010ccf09c85a8c8797dc77394e1 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/rsync-2.3.2-133.src.rpm 7ff150ba5f39ab527aa67308154273e2 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/rsync-2.3.2-133.ppc.rpm 65ac31f12bacb9284fd2286aec7beab0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/rsync-2.3.2-133.src.rpm 4b43552a939f080a3e93fe65a88bd139 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - pine The popular mail client "pine" was found vulnerable to an attack where shell metacharacters inside an URL could be used to execute arbitrary commands if pine passes the URL to an external viewer on the commandline. The pine packages on SuSE products are not vulnerable to this weakness because they contain a patch that works around this problem since it is not new. - xchat We are working on updates for the xchat packages in the SuSE Linux 7.0 and 7.1 distributions that are vulnerable to an encoding bug while receiving and decoding ctcp datagrams. This bug can lead an xchat IRC client to execute IRC protocol specific commands to an IRC server such as channel mode changes. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M 9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =ojbD - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPFF+6ney5gA9JdPZAQEjBwf7B2B8w1lFpiL8bgy3ttUzNRTFIRnre7yq QLcn8XdhF1iSvtDpgiajVsutYrRbEeVImcAWmXeLOIZMY/qwc4uLBwxrF2ng0Uph QhAebyewpFtMmIQrb/7AAOcudpgbHWsSRJYacbqYutQvJJ73vuFh+HOjErFoFx8p ZqtVC5IvOuE+HomaS/WBPjBdvIDrHSUaJq+fFFTYKozAEg/PpM++vePI5xauaEoP t6Wvazswwe1Qlx2rV2NvE/4TLFyxL2fHEQTtEIdSsa6za7WXmC2QqIhv4Y5zdckA 8CpPFJ0M/nTzmEf40i67myIGtOVgjb5MWaOv2ybya9ORPIHScdZxSQ== =8z44 -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

SuSE Security Announcement: at (SuSE-SA:2002:003)
by Roman Drahtmueller 16 Jan '02

16 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: at Announcement-ID: SuSE-SA:2002:003 Date: Wednesday, Jan 16th 2001 16:00 MET Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: local privilege escalation Severity (1-10): 5 SuSE default package: yes Other affected systems: most Linux systems with the at package installed Content of this advisory: 1) security vulnerability resolved: at problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The 'at' command reads commands from standard input for execution at a later time specified on the command line. If such an execution time is given in a carefully drafted (but wrong) format, the at command may crash as a result of a surplus call to free(). The cause of the crash is a heap corruption that is exploitable under certain circumstances since the /usr/bin/at command is installed setuid root. A temporary workaround against the bug is to disable the at command for non-root users by removing the setuid-bit from the /usr/bin/at command. As a permanent solution it is recommended to install the update packages as listed for download below. In addition to the fixed heap corruption, file handling security has been improved by adding the O_EXCL (exclusive) option to an open(2) system call inside the at(1) code. We thank zen-parse for reporting this vulnerability. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. i386 Intel Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/ap1/at-3.1.8-459.i386.rpm db3d2bd38f81667dcece38d1c4a86725 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/at-3.1.8-459.src.rpm 82701057fc8ea3217800b0ab1e2e544b SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/ap1/at-3.1.8-458.i386.rpm 91b759e6a8d433273c5567ed26735690 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/at-3.1.8-458.src.rpm 3df6d6d708d4ef90515f6f1fbbdea5bf SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/at-3.1.8-458.i386.rpm 73eb22d5c958c17e264fd31ec339b763 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/at-3.1.8-458.src.rpm 1303a1328f31313a62f5645f7cb476ef SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/at-3.1.8-459.i386.rpm 3179e64f87371d7864d1956ceb9bd020 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/at-3.1.8-459.src.rpm 67efafe83908ac53fc54acac9a0f056b SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/at-3.1.8-458.i386.rpm aaffed7c302b9ec42885087296c6f0a1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/at-3.1.8-458.src.rpm 374cf4374fbe1e66ab2e685aa0449034 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/ap1/at-3.1.8-356.sparc.rpm ec76d45245ef917e22f5f1a863a89988 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/at-3.1.8-356.src.rpm 40de9490a06bd294ad6a7f90e682c0cd SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/at-3.1.8-356.sparc.rpm 27f575762c0b1643008968a167324347 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/at-3.1.8-356.src.rpm 66546dc729e071039595a13d01feacfb SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/at-3.1.8-357.sparc.rpm 98007292769f55e4239b6922157bfa13 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/at-3.1.8-357.src.rpm 2d20cdbb10680282596677aac3106f30 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/a1/at-3.1.8-360.alpha.rpm df71ebf25a2252637ee1421d08779b8d source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/at-3.1.8-360.src.rpm b8b3a4f80e0d19e0211131ca58c1e0fe SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/at-3.1.8-361.alpha.rpm 0bc21b9ddc12746a17592fa74473bbf6 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/at-3.1.8-361.src.rpm 4d93aa10b426224936e3de357540ea49 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/at-3.1.8-361.alpha.rpm aeb76c2eb37f7e442c49c7ba3c5e44a5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/at-3.1.8-361.src.rpm 6d783c34eb0b855a96736e58d67bc053 PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/ap1/at-3.1.8-363.ppc.rpm 111bd6e813ef33265035b21d19776b49 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/at-3.1.8-363.src.rpm fa2ee9aca5b73009b1d9c90731265a19 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/a1/at-3.1.8-362.ppc.rpm 868a1662f751823432d3d881edd371cd source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/at-3.1.8-362.src.rpm d759233bfc2ce230e1c46d2ec0f15a73 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/at-3.1.8-362.ppc.rpm 7b12fe4b5f31434eb7cf3c0caae75811 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/at-3.1.8-362.src.rpm 4c6e2724bb76e08be66831ed85c60f85 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/at-3.1.8-362.ppc.rpm 7ebc9a1fde97f5ac8226b9e17621a40b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/at-3.1.8-362.src.rpm fa3c5e08703eb54b4f493de56ec837bb ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Linux Distributions and Workarounds: - clanlib dotslash(a)snosoft.com reported an environment variable copying buffer overflow in the clanlib package. If a program that is linked against the clanlib shared library is installed setuid or setgid, this error may lead to elevated privileges. In the case of SuSE Linux distributions, this is only the case for the methane package: It comes installed with a setgid bit to group "game", which is used to store highscores in group- writeable files. This setgid bit will be cleared in future releases of the SuSE Linux distribution. For already installed "methane" packages, we recommend to remove the setgid bit with the command chmod -s /usr/X11R6/bin/methane The methane package is not installed on SuSE systems by default, nor is the defective library "clanlib". - thttpd The thttpd daemon contained several off-by-one overflows. Due to internal organization of the variables affected by these overflows, they seem not exploitable. However, these bugs have been fixed. Please update to the newest thttpd packages. - pine The popular mail client "pine" was found vulnerable to an attack where shell metacharacters inside an URL could be used to execute arbitrary commands if pine passes the URL to an external viewer on the commandline. The pine packages on SuSE products are not vulnerable to this weakness because they contain a patch that works around this problem since it is not new. - xchat We are working on updates for the xchat packages in the SuSE Linux 7.0 and 7.1 distributions that are vulnerable to an encoding bug while receiving and decoding ctcp datagrams. This bug can lead an xchat IRC client to execute IRC protocol specific commands to an IRC server such as channel mode changes. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M 9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =ojbD - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPEWe7Hey5gA9JdPZAQGPCwf/QrDn2sd0oKT6gehLPdCxZqH7qluObAUV Kzkb0dLx47O6LeiX/TEo7ssx30Y2boLyGG6X1Hy/jlHk9+Lx864AW/9EHX+kXmJg iiRMfNoWTswZU4gqZWyemW/pRYVN7U62LhKbe/m7GVy3JpxPCDZZQi4oGLIN114K p50J86r2GoGEKeQfQi+cShndfohuaS1KA0U1H5O2gODrEsuGcXUfNyYq8MraS1qF knWzC+5FZZMAyoJ5Jr4AhYttrtuRoyRfS6z0gJkqeC0s+dUhNEEV/auGckuo2k4T A4F39QxnxlB220iItOedJPhj+dSgfe8IrJx2t4z2uNoXuqkIaSCnlA== =GPsQ -----END PGP SIGNATURE-----

1 0

SuSE Security Announcement: sudo (SuSE-SA:2002:002)
by Sebastian Krahmer 14 Jan '02

14 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: sudo Announcement-ID: SuSE-SA:2002:002 Date: Mon Jan 14 13:00:00 CET 2002 Affected SuSE versions: 7.0, 7.1, 7.2, 7.3 Vulnerability Type: local privilege escalation Severity (1-10): 5 SuSE default package: yes Other affected systems: all recent sudo installations Content of this advisory: 1) security vulnerability resolved: Sendmail invocation as root. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The SuSE Security Team discovered a bug in the sudo program which is installed setuid to root. Attackers may trick "sudo" to log failed sudo invocations executing the sendmail program with root-privileges and not completely cleaned environment. Depending on the installed mail-package this may enable attackers to execute code as root. This is the case for at least the postfix mailer. Other mailers may be exploited in a similar way. This bug has been fixed by having "sudo" invoke the sendmail command with user-privileges instead. Please update your sudo package regardless of the mail-packages you are using. As a temporary workaround you may remove the s-bit from sudo with the "chmod -s `which sudo`" command, which will disable the sudo functionality. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. i386 Intel Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/ap1/sudo-1.6.3p7-71.i386.rpm b98f00f761274530bfad3486253bed53 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/sudo-1.6.3p7-71.src.rpm d046509163e1fc6d4143a8db1c2283d2 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/ap1/sudo-1.6.3p6-86.i386.rpm ee01b7b2ba2e73376eb3c358ccb5b768 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/sudo-1.6.3p6-86.src.rpm e8cbaa81d9a806169f0c235ed6bc5d6a SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/sudo-1.6.3p6-85.i386.rpm 7ba4ae9fb72348e0d1909c9ea79be5e0 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/sudo-1.6.3p6-85.src.rpm a10b4ecae46aaff271f59c7dd726d8d0 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/sudo-1.6.3p6-85.i386.rpm 345a8e541b66d5016b939560a525d47c source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/sudo-1.6.3p6-85.src.rpm 58afdb9b1e6c9e19440ee4047fff1105 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/ap1/sudo-1.6.3p7-26.sparc.rpm 94139dd96c9be67d4e41d38abee95434 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/sudo-1.6.3p7-26.src.rpm b5f16c705cdcf85754037296b8847b20 SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/ap1/sudo-1.6.3p6-32.sparc.rpm 915313678145418569c54332760f989a source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/sudo-1.6.3p6-32.src.rpm 2fd809a5f53992aa23c732d9466e274a SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/sudo-1.6.3p6-33.sparc.rpm 0c1dce308b37b31ea943369ba23e3dab source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/sudo-1.6.3p6-33.src.rpm da4786d3e8798e6c31d4eea338e9cd93 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/ap1/sudo-1.6.3p6-36.alpha.rpm eb020b7e212e0d9cb85578a1b49e3529 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/sudo-1.6.3p6-36.src.rpm fb2652e480282dfecbbb7e6db8ec7bec SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/ap1/sudo-1.6.3p6-37.alpha.rpm 35b6ea7ebac976d8b65f9f09b574e107 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/sudo-1.6.3p6-37.src.rpm 0ac6c3001d727f3774a57cc76eb7d4c1 Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/ap1/sudo-1.6.3p7-51.ppc.rpm 3ff70447a81e3f4c88b44af2445d4f6d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/sudo-1.6.3p7-51.src.rpm f71b62019ea2f49e0202f74033f07496 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/ap1/sudo-1.6.3p6-42.ppc.rpm 3bef306a5a8b782fdda0bdd77758b290 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/sudo-1.6.3p6-42.src.rpm d9475c12754ae3c87cac72484dc90bbc SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/sudo-1.6.3p6-41.ppc.rpm 54d98aa831bab75529731d0789f01cbd source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/sudo-1.6.3p6-41.src.rpm c61d3c629eefaf0eb041a630414d6580 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - stunnel A format string error in the stunnel ssl wrapper was reported on bugtraq in December 2001. SuSE Linux 7.2 and 7.3 as well as SLES7 contain the stunnel package in Version 3.14, which should be vulnerable to the format string bug according to the reports on bugtraq. However, the responsible portion of code does not expose the format string problem with calls to fdprintf(). Therefore, SuSE stunnel packages are not vulnerable to the security problem. - thttpd The thttpd daemon contained several off-by-one overflows. Due to internal organization of the variables affected by these overflows, they seem not exploitable. However, these bugs have been fixed. Please update to the newest thttpd packages. - pine The popular mail client "pine" was found vulnerable to an attack where shell metacharacters inside an URL could be used to execute arbitrary commands if pine passes the URL to an external viewer on the commandline. The pine packages on SuSE products are not vulnerable to this weakness because they contain a patch that works around this problem since it is not new. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M 9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =ojbD - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPELOTney5gA9JdPZAQGJmQf7BQ9oIgRO4jteio9B+ym1xuc+zX20i4I/ OudFcsbx7F+cjNS4mTXAUtH3E+lipL9TAOQRywGejHMOUNrkwiO4SxtEK7X06my9 vVlQL/D+5mGPXxjxM1pNyQPAmt8goZpLbJwhQmZ1Sz96WCsWgrQ3f4IWvdjkxEDE wXlOGQ5V3iWsNk9+K/9G9SGFOy1Pr4ropj0QlK8pLV3+O4TfXkhU0m+R6aLiqeE5 PLrvmBTk2tEwDR4wUvlMuCw9PxYu+p3gDDertZlN0k/JT4Qjb/kzKD/HIeWYUfnY 2iCC1Wntdd0dd6COPlUUPNT91O9zAa4v7PVTxBniaijUF9TA0UUEIQ== =tIhZ -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

SuSE Security Announcement: mutt (SuSE-SA:2002:001)
by Roman Drahtmueller 07 Jan '02

07 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: mutt Announcement-ID: SuSE-SA:2002:001 Date: Monday, Jan 7th 2001 20:30 MET Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: local privilege escalation Severity (1-10): 6 SuSE default package: yes Other affected systems: systems with the mutt mailer installed Content of this advisory: 1) security vulnerability resolved: mutt problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information mutt, a popular mail client for Linux-like systems, is vulnerable to a buffer overflow that is remotely exploitable. We have added patches to the versions of mutt as shipped with the affected distributions to fix the problem. We recommend to install the update package for your product and to restart all running instances of mutt. We thank Joost Pol for reporting the problem to the makers of mutt. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. NOTE: The SuSE Linux 7.0 distribution was shipped with two packages that contain the mutt mail program: "mutt" and "muttssl". For legal reasons, the muttssl package is available from the German ftp server ftp.suse.de. You can find out which version of the mutt package you are using with the following command: rpm -qf /usr/bin/mutt You only need to download and install the update package for the package that is installed on your system. i386 Intel Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/mutt-1.3.22.1i-105.i386.rpm 65dd9854d16c9e3178aaff935486ab8a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/mutt-1.3.22.1i-105.src.rpm 6efacb822144a49de85bb417f677dba6 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/mutt-1.3.16i-71.i386.rpm 012e18c5cd2122218b396ae3600fa875 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/mutt-1.3.16i-71.src.rpm 5755b3e620a49bcb93893c524ecceb1b SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/mutt-1.3.12i-51.i386.rpm 40df9d8f98dcebc7057849a246f16e21 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mutt-1.3.12i-51.src.rpm c689f09724acc63065a66e291dedc85b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/mutt-1.2.5i-38.i386.rpm 1e7d85e9f499ebf4b3fe749d8669de9e ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/muttssl-1.2.5i-14.i386.rpm a61d53a1e65299b558c799654e57203f source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mutt-1.2.5i-38.src.rpm 543834be481fc61d8390a72cd42feeb0 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/muttssl-1.2.5i-14.src.rpm e67f148dee40a385136bc31240d51be6 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/mutt-1.0.1i-30.i386.rpm 53bae9b840be86683d670b784ec28c8c source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/mutt-1.0.1i-30.src.rpm c9ebd840ac72c5a3cfe9f45444f9a5e9 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/mutt-1.3.22.1i-27.sparc.rpm 946ba6c36bd8c46d1ab494f54b288dc6 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/mutt-1.3.22.1i-27.src.rpm 9009e2d4e4f32d437422b8e8ed12ef55 SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/mutt-1.3.12i-6.sparc.rpm 50f4f657a6a8bba819a34b2a05a9ea17 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/mutt-1.3.12i-6.src.rpm e7d3565e2063d76909c1a44e347f71de SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/mutt-1.2.5i-6.sparc.rpm fe06ca8880f38ea3064764614515f283 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/muttssl-1.2.5i-8.sparc.rpm 3bdec5870cdddb5be68a8da3ff093de8 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/mutt-1.2.5i-6.src.rpm e3492d0390a7271def3955030a5451a0 source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/muttssl-1.2.5i-8.src.rpm 3946004fc966f4135f47ff419bc2d1d6 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/mutt-1.3.12i-5.alpha.rpm 0cf2bd45bf05aded0468cad34774cac6 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mutt-1.3.12i-5.src.rpm 7b04b3b10bb07c1d05ecd2322fd92be9 The AXP Alpha mutt packages for older distributions than 7.1 are currently being built and will appear at the usual location shortly. PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/mutt-1.3.22.1i-63.ppc.rpm 023ad9fde88518a3c07e183712305fd7 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/mutt-1.3.22.1i-63.src.rpm ed935acf49c36bcb290f4db37c7ae800 The PPC packages for SuSE Linux 7.1 are currently being built and will appear at the usual location shortly. SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/mutt-1.2.5i-12.ppc.rpm 476ed5e796692adda068a49ed2baf95e ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/muttssl-1.2.5i-11.ppc.rpm f4cb8011468d3e476fd7e24f733aec70 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mutt-1.2.5i-12.src.rpm 550d058119f86c54a04d7506dbc1e878 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/muttssl-1.2.5i-11.src.rpm caa60a063952cb54582bf7a0885d5d81 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/mutt-1.0.1i-30.ppc.rpm 2ae9d12e448f9f519441c74aeeb64d4d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/mutt-1.0.1i-30.src.rpm e2ae04f334216cbcd82f906a3a2bb83f ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - SuSE Security receive reports about successful exploitation of the problems in the secure shell package (ssh-1.2.27) on SuSE systems. Please read the secure shell security announcement from February 2001, available at http://www.suse.de/de/support/security/adv004_ssh.txt . More additional information can be found in the openssh announcement at http://www.suse.de/de/support/security/2001_045_openssh_txt.txt . ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CpkBogQ57vSBEQQAk/GN+ftr7+DBlSoixDDpfRnUk+jApGEt8hCnrnjV nPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45t4E0fKyLVzDerCRFB1swz/mNDxT26DLy sdBV5fwNHTPhxa67goAZVrehQPqJEckkIpYriOaYcKpF3n5fQIZMEfMaHEElQhcX ML8AoJVXDkJYh7vI8EUB8ZURNLZMEECNA/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6T epRdLZhaylwVF/iu7uIn62ZUL4//NTOCDY7V63qg4iba/fUbOsWtEnGaiE7mQuAl sSWvRspwRA9/g9rdVf3/JdLJrLmKBTheyG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQn Jn2euqylHRubEQP/aL53NZK0kBdvrKgff6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+ mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiYI2lTRYT4uMdHuwVC3b4DqAKmoy375FER wHkrMVyKBJslv8QtbAWw5A1CAUseaHo+91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1 U0UgUGFja2FnZSBTaWduaW5nIEtleSA8YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUC Oe70gQUJA8JnAAQLCgMEAxUDAgMWAgECF4AACgkQqE7a6JyACspfLACffAYA+NM8 NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0xY7WbKoXs1+72b2AiEYEEBECAAYFAjpw XlIACgkQnkDjEAAKq6TczgCgi+ddhWb7+FWcfeE6WwPZccqAHowAnjjtRyGwHLQH r5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk /xGJJREt7V12iSafaRzGuH8xWvIz1bb+VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6i JXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq2pudfwljp52lYVM53jgPYEz0q/v3091n lZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU+lDQT2EC6VKaxeWK8pNt6UFDwICRDQxK nlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKNbWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852 Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelx ufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7U VCiSfb9CV38dmeHdPCEEjDUWquFYEnvj3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qT Jzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBEVE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN 89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiU XpRoFCdglMznbcAyCk9C2wqb2j/D1Z2BeSBaGCSFkR6pRLebnE17LWcu72Iy+r0z +JecbPiyDpDZj4apn7IC81aNFGi7fNITsHODbwwjiwADBgf/YPvVdzkc8OC7ztac EWCanwylKvxCdKzTDA+DfES6WUYShyiVJvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/p dGy1aKtJZrAnFEsofpmOj8VoqyyFgp/yAGQBp12+mXek7SCZRhuqalDfEMRiWEJ6 J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxxQqNQXL6Z3NSxS61p+5n6BseiDUI39xxk KTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwbsklszZt6xbU+R0SjFqTvjPWx6eHfqbmN C9WMDdTjGrXDDKXFp2aYlokfN6It9vsbVlGNlOwHt/JjGoPMxW6Xqj0FLA7/Vewg CdXW64hMBBgRAgAMBQI57vSSBQkDwmcAAAoJEKhO2uicgArKSyIAmwUHf/vtKQfc mVg4asR7U6XQl0bAAJ4pO22B5U8UH6IYl2LBCXFqw5+5fA== =rVRn - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPDn2jHey5gA9JdPZAQHEUgf+Pxt00zDCMrVl1U4E9JwUUzuvhOAVIROd r90BInckzQa4yxD0k+BixBV3sNRK932QP0Yn3fPsNPRF6XfQNYdOLIybCrOESgY4 8SzwTSnIFjKptbFCWF8Ye/xB+FSd8Ffk/M7t6BtlYOS+7VPMB67nof/FiUyo3ceB ypdNfmmXvtde0bvQCypjNVfQ/V2omVir4E9vT+zNWrUs4RbvTAxnrgMIdlpzOmV0 AnETYIgiW8TLedJy6cJzHCPuGyH2RvQEDv16xbGxgFqHKwT2ZuSweCQ+kSCnFDus mpNPvRs1bLsspoPCHl8TZ05uppVfb4qN7hxIT9psdPU8/ABEPB+r+w== =4rJj -----END PGP SIGNATURE-----

1 0