January 2007 - openSUSE Security Announce

SUSE Security Announcement: bind remote denial of service (SUSE-SA:2007:014)
by Marcus Meissner 30 Jan '07

30 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: bind Announcement ID: SUSE-SA:2007:014 Date: Tue, 30 Jan 2007 11:00:00 +0000 Affected Products: SUSE LINUX 9.3 SUSE LINUX 10.0 SUSE LINUX 10.1 openSUSE 10.2 UnitedLinux 1.0 SuSE Linux Enterprise Server 8 SuSE Linux Openexchange Server 4 SuSE Linux Standard Server 8 SuSE Linux School Server SUSE LINUX Retail Solution 8 SUSE SLES 9 Novell Linux Desktop 9 Open Enterprise Server Novell Linux POS 9 SUSE SLED 10 SUSE SLES 10 Vulnerability Type: remote denial of service Severity (1-10): 5 SUSE Default Package: no Cross-References: CVE-2007-0493, CVE-2007-0494 Content of This Advisory: 1) Security Vulnerability Resolved: remote denial of service problem in BIND Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion Two security problems were fixed in the ISC BIND nameserver version 9.3.4, which are addressed by this advisory: CVE-2007-0493: If recursion is enabled, a remote attacker can dereference a freed fetch context causing the daemon to abort / crash. CVE-2007-0494: By sending specific DNS query responses with multiple RRSETS attackers could cause BIND to exit abnormally. Updates for SUSE Linux Enterprise Server were released on Friday 26th of January, updates for SUSE Linux and openSUSE were released on Monday 29th of January. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of bind after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-9.3.2-56.1.i586.rpm 1cbff49e03831710c990961534db5ec1 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-libs-9.3.2-56.1.i586.… bd6462a783b85946e8e3397fdd972e48 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-utils-9.3.2-56.1.i586… ff37774a0bf31c329e834b4ffa3275ed SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/bind-9.3.2-17.15.i586.rpm 5748e1f4000a2f778f0598b97ee3f41f ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/bind-libs-9.3.2-17.15.i586… e88a84c84c7d23e2e5fd4184e040ea36 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/bind-utils-9.3.2-17.15.i58… 91758b51c5dce9ea1e6c807d0b5a5ec0 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/bind-9.3.2-56.1.i586.… 75b21dd87a6c02af3c129cdac1c914f0 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/bind-libs-9.3.2-56.1.… e2d482990c6336041ecda4263130cbff ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/bind-utils-9.3.2-56.1… b0646b7097fd3221491f2afbe3f9ebbe SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/bind-9.3.2-56.1.i586.r… 9f784583c4944a67f4a952220caefc23 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/bind-libs-9.3.2-56.1.i… e42f646c068f947c1d50a62bae1e21e4 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/bind-utils-9.3.2-56.1.… 244eb1e7ab236e4f5fb289569385c41d Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/bind-9.3.2-56.1.ppc.rpm 196da83c1ee0bc0b836590ed4fec2d25 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/bind-libs-9.3.2-56.1.ppc.rpm 1f86c42742226e9a5bb7600fec5583ec ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/bind-utils-9.3.2-56.1.ppc.r… 57697a572ef517d8906c6bf4e9d0a7a3 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/bind-9.3.2-17.15.ppc.rpm dba983ba548a847f1024246ff4bb3388 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/bind-libs-9.3.2-17.15.ppc.r… c15f6131a5484abdb03662e271d58eba ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/bind-utils-9.3.2-17.15.ppc.… bb0ea32c59dcfa9a544b96d6e39ac83e SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/bind-9.3.2-56.1.ppc.rpm 4c75aad7305260b263671fa1b5d3f90f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/bind-libs-9.3.2-56.1.p… 73c8917a37f96f9748394407d7f31706 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/bind-utils-9.3.2-56.1.… 534c2ff4a0a31d5fab474d720b290339 x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/bind-9.3.2-56.1.x86_64.r… ba6e1e48cee8fc94e047b0ffa927e405 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/bind-libs-32bit-9.3.2-56… ee297428f209bcb73f51599045b06d97 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/bind-libs-9.3.2-56.1.x86… c04b66a303fc420a2682895716798758 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/bind-utils-9.3.2-56.1.x8… 2cf0460d5566d12b7cf82a30646d97e0 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/bind-9.3.2-17.15.x86_64.… 5b06fe8290edc659fd4e08b972ad8042 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/bind-libs-32bit-9.3.2-17… 520983bb39f0ebf484054f5c848eb8ec ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/bind-libs-9.3.2-17.15.x8… e0606262be2447a97700c31a259732b8 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/bind-utils-9.3.2-17.15.x… a3bb7fa67d39b821739d3993a0591729 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/bind-9.3.2-56.1.x86… 04f58a6c8dc234adb99a93e379e0e932 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/bind-libs-32bit-9.3… 1e4506d5cb2f72c8fa0e037a36f44fbf ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/bind-libs-9.3.2-56.… ea0e2ad36c5031b57b8edb0a5d0f61d1 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/bind-utils-9.3.2-56… dc13d333deeb7a0f9980ffee7df26dae SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/bind-9.3.2-56.1.x86_… 5f684d89127ec370d6482f387f9fe53b ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/bind-libs-32bit-9.3-… eafc69be579bf262055faf7784d76552 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/bind-libs-9.3.2-56.1… 68dbc644298e95f321909f38edc1bc99 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/bind-utils-9.3.2-56.… 55f114b7938d9e822ffd4a37106f23d9 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/bind-9.3.2-56.1.src.rpm fa26ab535120777311837ffbcf2fb8b7 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/bind-9.3.2-17.15.src.rpm 4047b6af5646920c8cffdb3c1891b090 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/bind-9.3.2-56.1.src.rpm e0a354000d30e1cd4c8d05cabf7bfff1 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/bind-9.3.2-56.1.src.rpm 207a60f5455dcfc3c494ac00f9ec49fe Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: UnitedLinux 1.0 http://support.novell.com/techcenter/psdb/1906b69f138f410028362737dc020b6c.… SuSE Linux Openexchange Server 4 http://support.novell.com/techcenter/psdb/1906b69f138f410028362737dc020b6c.… SuSE Linux Enterprise Server 8 http://support.novell.com/techcenter/psdb/1906b69f138f410028362737dc020b6c.… SuSE Linux Standard Server 8 http://support.novell.com/techcenter/psdb/1906b69f138f410028362737dc020b6c.… SuSE Linux School Server http://support.novell.com/techcenter/psdb/1906b69f138f410028362737dc020b6c.… SUSE LINUX Retail Solution 8 http://support.novell.com/techcenter/psdb/1906b69f138f410028362737dc020b6c.… Open Enterprise Server http://support.novell.com/techcenter/psdb/ebd0655e8b4230a45daa0865dc0cd57a.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/ebd0655e8b4230a45daa0865dc0cd57a.… Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/ebd0655e8b4230a45daa0865dc0cd57a.… SUSE SLES 10 http://support.novell.com/techcenter/psdb/ebd0655e8b4230a45daa0865dc0cd57a.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/ebd0655e8b4230a45daa0865dc0cd57a.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/ebd0655e8b4230a45daa0865dc0cd57a.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRb8W2Hey5gA9JdPZAQKIIQf/WZxPvxDkH3tRx8ZWiiZzcZ9i3cNcuCV1 EAAAtS+D4cg/7C/qZd7/fv5SlNXXn9K7Vmy80Mh15WnU2Q2dylnuoAVJvZgeac9Y 9IoYhjSQhZ7BQsWpVybconTQuM/GgtaEMGnfwDyHsAVgERcszMc+KbsJEO204O2X NiL+hzetUtp6aiGaoJig3EDlxIJU8Rn5WkljWsn6iY200sVYda2OwTUNlfqJ2++4 RZ3RcRBo/+kSvjh8EQBk0ILx99KG6hT/1M08UicDQDcgfNW/9YVCBe+tSjmVg4JI Y5BYQE9DJj1ilQ9yG7x/xxmuADZt5LDtEZRQHP96U6TTa3/tmz0ugg== =lJ9r -----END PGP SIGNATURE-----

1 0

SUSE Security Summary Report SUSE-SR:2007:002
by Marcus Meissner 26 Jan '07

26 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2007:002 Date: Fri, 26 Jan 2007 17:00:00 +0000 Cross-References: CVE-2007-0010, CVE-2007-0157, CVE-2006-5750 Content of this advisory: 1) Solved Security Vulnerabilities: - neon crash in URI parser - gtk2 image handling crash - smb4k local security problems - amarok magnatune store problems - JBoss4 security problem 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - neon crash in URI parser Incorrect array index handling with non-ASCII characters was fixed in the URI parser of neon. This is tracked by the Mitre CVE ID CVE-2007-0157, updates were released for openSUSE 10.2. - gtk2 image handling crash A bug in the GTK+ library gdk-pixbuf could crash applications such as Evolution when trying to display certain images. This is tracked by the Mitre CVE ID CVE-2007-0010 and updates were released for all SUSE Linux based products. Additionally a bug was fixed in the printer dialog that prevented the correct display of all connected printers. - smb4k local security problems Smb4k 0.7.5 had several security bugs fixed that could be exploited locally to get access to confidential data, overwrite file contents, and to overflow process memory. Updates for openSUSE 10.2 were released. - Amarok magnatune store problems Amarok was updated to collect various crash fixes for the magnatune.com album browser in album. It also corrects shell quoting issues in amarok's ruby handlers, which might be used to inject shell code. This problem only affects openSUSE 10.2. - JBoss4 security problem Updates for JBOSS 4 to fix a privilege escalation problem have been released. This issue is tracked by Mitre CVE ID CVE-2006-5750 and updates were released for SUSE Linux 9.3, SUSE Linux 10.1, and Novell Linux POS 9. ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds None listed today. ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRboef3ey5gA9JdPZAQJyxwf/W2Xz8HBDRUCvimmDd1tcHR385MWpyBq0 TorlTI7ikVooprLW7IF+mNujxskOHUuQy6fSaMrr9EcFMlUcIvjcoFoM4Sr2b2jn L5jdae27dXwbS78AyPT8TqT9Xj/j8QxjhPrnvb8l8W/BBStLXjYBIwIiN8sYyRAs rEda/SUcTGG9xGChTCPRkJiL4Tp9sAyQ1901lhli6hyG1uNz0qmgu0DCYg61U/Ae HSU2uu/dRr5I6wMz4PKOm2Kw0v2ZLAqwZ11fkgEn67yAxCXSvPpTLoyg0aLHme+I aQVZEowir6A/4LBkkW09iwpO69Uf80jOGajbtgkje3uVt350lelYpQ== =lpep -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: xine (SUSE-SA:2007:013)
by Thomas Biege 23 Jan '07

23 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: xine-ui,xine-lib,xine-extra,xine-devel Announcement ID: SUSE-SA:2007:013 Date: Tue, 23 Jan 2007 08:00:00 +0000 Affected Products: SUSE LINUX 9.3 SUSE LINUX 10.0 SUSE LINUX 10.1 openSUSE 10.2 SUSE SLED 10 SLE SDK 10 Vulnerability Type: remote code execution Severity (1-10): 4 SUSE Default Package: no Cross-References: CVE-2007-0017 Content of This Advisory: 1) Security Vulnerability Resolved: format string bug Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. Since SUSE Linux version 10.1 format string bugs are not exploitable anymore. (CVE-2007-0017) 2) Solution or Work-Around No temporary work-around known. 3) Special Instructions and Notes none 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/xine-devel-1.1.2-40.1.i586… 2cacbb4f4e177362149518481480165a ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/xine-extra-1.1.2-40.1.i586… 73cbdd8d443596547875804bd8e2ca8f ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/xine-lib-1.1.2-40.1.i586.r… 2114f7c6a4c8351adab588c173419778 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/xine-ui-0.99.4-84.1.i586.r… 5d4dd945a812ba0b17619c267ec8f2b5 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/xine-extra-1.1.1-24.17.i58… 3eb1465401e5e1c6f36d8e2d7ca3e114 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/xine-lib-1.1.1-24.17.i586.… e2fbf53b629e835dbc2558e87fabf926 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/xine-ui-0.99.4-32.14.i586.… d710db4b4d20f7ea4485d16845cb4be2 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xine-extra-1.1.0-0.1.… 06753ebd3608223077c95c01f8bc3122 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xine-lib-1.1.0-0.1.i5… 60ab4fd7c193d687d9484e5691aa3f01 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xine-ui-0.99.4-84.1.i… 4bc3f28d7e600fbb78c65f6b0dcfc436 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/xine-lib-1.0-10.14.i58… c944ed72f913771f0c2300883573e111 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/xine-ui-1.0-10.14.i586… cee2a8a9669b429dde4e465e83aae70f Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/xine-lib-1.1.2-40.1.ppc.rpm a1fcfa82deed685446a213439639a579 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/xine-ui-0.99.4-84.1.ppc.rpm bc2dcf2266dbb56b1a0291209aad2dd7 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/xine-extra-1.1.1-24.17.ppc.… c337440571123263478dd2a64059a4e8 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/xine-lib-1.1.1-24.17.ppc.rpm 3cf476901522d7b5abd5bf3cb18484a9 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/xine-ui-0.99.4-32.14.ppc.rpm a9e762bad246963a7564c1f36a5f0392 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/xine-extra-1.1.0-0.1.p… 930dc314de3ab49a8655e6cdb89ff50d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/xine-lib-1.1.0-0.1.ppc… ddd255708abfb433a3497d790491be55 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/xine-ui-0.99.4-84.1.pp… 827125d558472b685f0f1843d0eb3850 x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xine-devel-1.1.2-40.1.x8… 1dac6b23d257670ca7182f018c12a69b ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xine-extra-1.1.2-40.1.x8… 11dae8e2ecb5a78eb6b1cd39713f6322 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xine-lib-1.1.2-40.1.x86_… 519480f44a28d4e3cab37aceca7e7c13 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xine-lib-32bit-1.1.2-40.… 3b5db06dab41a4ff2a53d22b3f6f6238 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xine-ui-0.99.4-84.1.x86_… b1a06bf5fd93c905bf5008859c88690d ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xine-ui-32bit-0.99.4-84.… aa85b56d559aca4960693bad80a451bd SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/xine-extra-1.1.1-24.17.x… 72f6cfc29f428a5d7dc40fbcb285cfe6 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/xine-lib-1.1.1-24.17.x86… 34382ef5b0ec94524678bdf842a21ecb ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/xine-lib-32bit-1.1.1-24.… 316fd37892ef25073cf9d6ae11fb510b ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/xine-ui-0.99.4-32.14.x86… ee0a3ce52f3bf431ced82dbd0148890c SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xine-extra-1.1.0-0.… 83094481db18fb55447a19b86db281ff ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xine-lib-1.1.0-0.1.… 0e1b36454127be6815d1f52325ee1a70 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xine-lib-32bit-1.1.… 45829c44efd83afaefe570d81f8a7568 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xine-ui-0.99.4-84.1… bfe5d54a07d28cb9fef528c0257d4db7 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/xine-lib-1.0-10.14.x… e829f9cbd5e02a0498f03a2180b57963 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/xine-lib-32bit-9.3-0… 064665c8b3ac38f71634734c101f1602 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/xine-ui-1.0-10.14.x8… 8e7011003db37a1799bbd531ae957a28 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/xine-lib-1.1.2-40.1.src.rpm f92b96c21a6e45ede2faa81c9efade83 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/xine-ui-0.99.4-84.1.src.rpm ed0382a57f117bcf04236ca660092afe SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/xine-lib-1.1.1-24.17.src.rpm 1d347a598b2e8dfc5eaa4f7b9c951242 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/xine-lib-1.1.0-0.1.nos… d1d2036b46056a00b3c5a0cee5371ad8 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/xine-lib-1.0-10.14.nosr… 02ae3f6c9a88ec0aabcce701bba20542 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SLE SDK 10 http://support.novell.com/techcenter/psdb/3850f4cb30959892275d84ebf0b1dfc6.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/3850f4cb30959892275d84ebf0b1dfc6.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBRbXeIHey5gA9JdPZAQE/Cwf/dJjzI/ul41/MbqNp6Hgqb5KnXVswqYpJ wgwSIw5j0uSi6UdmN0wVUKeXQCEcV12txlPS1OWFPH15NrJQZdWQSHd18ngngF2s gscJXsHz5ZBu0pY8xXP7ZbjIbQNjsZscLlgCaMI0dTc51Ra2xZ3ax3dCcxkGwt+s rdJ8EdglT/62qJ9frne1BPcRBRGEa25Uab3yDZzFrQ+yY+4PtEweyrN1MMEvWyZN R7E97n4MJHOS8YqxfCgI4dXRI8koNcmUdq+gqCzvtYl1lNFeDoZqvLy+DiOBeATu Uv9I4pTqL3Az7LssQ4FrCUhXEGimEkq6UGiY0r1e+Auwc444VsLt2w== =WEyH -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: squid (SUSE-SA:2007:012)
by Thomas Biege 23 Jan '07

23 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: squid Announcement ID: SUSE-SA:2007:012 Date: Tue, 23 Jan 2007 09:00:00 +0000 Affected Products: SUSE LINUX 9.3 SUSE LINUX 10.0 SUSE LINUX 10.1 openSUSE 10.2 UnitedLinux 1.0 SuSE Linux Enterprise Server 8 SuSE Linux Openexchange Server 4 SuSE Linux Standard Server 8 SuSE Linux School Server SUSE LINUX Retail Solution 8 SUSE SLES 9 Open Enterprise Server Novell Linux POS 9 SUSE SLED 10 SUSE SLES 10 Vulnerability Type: remote denial of service Severity (1-10): 4 SUSE Default Package: no Cross-References: CVE-2007-0247 CVE-2007-0248 Content of This Advisory: 1) Security Vulnerability Resolved: remote denial of service Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update fixes a remotely exploitable denial-of-service bug in squid that can be triggered by using special ftp:// URLs. (CVE-2007-0247) Additionally the 10.2 package needed a fix for another DoS bug (CVE-2007-0248) and for max_user_ip handling in ntlm_auth. 2) Solution or Work-Around No temporary work-around known. 3) Special Instructions and Notes Restart squid. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/squid-2.6.STABLE6-0.4.i586… c1a38e8dc8301158fe717a9115e60001 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/squid-2.5.STABLE12-18.6.i5… b390a43cd014988f3444fc8a3f89af7d SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/squid-2.5.STABLE10-5.… 171ae4d1ae9941da3641391f0cbb020e SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/squid-2.5.STABLE9-4.9.… 5abca23e37cee2bf20085951b8a59953 Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/squid-2.6.STABLE6-0.4.ppc.r… ffb0c8fe4086a913fede3cba0f1b473c SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/squid-2.5.STABLE12-18.6.ppc… bec76f3f1c4a445801117f696d438925 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/squid-2.5.STABLE10-5.5… 87fc216ed79eee0d5eecf2ba24d4adfe x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/squid-2.6.STABLE6-0.4.x8… 6b37f676418485c52d262cc8f17347f0 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/squid-2.5.STABLE12-18.6.… ddc9aaba2e99eeb2d8215acf799b8ecb SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/squid-2.5.STABLE10-… 100ed655a1fbdcf4a8ed1bd98598e2bb SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/squid-2.5.STABLE9-4.… 599d0bb6f1cd872816eb371abf24a44e Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/squid-2.6.STABLE6-0.4.src.r… 8467df81f96919f3a1c6d55905581735 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/squid-2.5.STABLE12-18.6.src… 5da1a897fdb953cb3f9801d0eda1899b SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/squid-2.5.STABLE10-5.5… 794090e751edceb8355c4706a28c2aa5 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/squid-2.5.STABLE9-4.9.s… 6c6c1a9a0e0db47a3336d51551a859e9 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: UnitedLinux 1.0 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SuSE Linux Openexchange Server 4 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… Open Enterprise Server http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SuSE Linux Enterprise Server 8 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SuSE Linux Standard Server 8 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SuSE Linux School Server http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SUSE LINUX Retail Solution 8 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SUSE SLES 10 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/e4f5424c0eb495e52b8739b57f62405b.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBRbXeGXey5gA9JdPZAQF4KQf/Uv6f3/PvozWMTBgmmnN5Y1psWejy4auu wDCyJvPGTFAonE5MRc/a5ycqs78dWvLRCORkFMEVI+AE/14U8DNuzOXM18vwUs87 WWK+1n1VWJSaodigM/mtJGEjXZnZMTM+tK4T3CDIqwg8UAuu58wPeZEE5Rzi0Wmq 3dSufnfevTuG246ldpHuoU5fTxXlqYSdofcYPmwy7njAiniRS9FQjQitb/NxB1ec IiQcE0uaj17ClGgC5/JD+fa6HFHBcp3Jpg2OytGf/PEHUUOemL39menteC0HrC2q byrVpTEZkp2lJYIp5CrWNsNabCiMk0e6sZsGKVHfGoEOdw8Da4yZVA== =XMNg -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: Acrobat Reader 7.0.9 (SUSE-SA:2007:011)
by Marcus Meissner 22 Jan '07

22 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: acroread Announcement ID: SUSE-SA:2007:011 Date: Mon, 22 Jan 2007 18:00:00 +0000 Affected Products: SUSE LINUX 9.3 SUSE LINUX 10.0 SUSE LINUX 10.1 openSUSE 10.2 Novell Linux Desktop 9 SUSE SLED 10 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE Default Package: yes Cross-References: CVE-2006-5857, CVE-2007-0044, CVE-2007-0045 CVE-2007-0046, CVE-2007-0047, CVE-2007-0048 Content of This Advisory: 1) Security Vulnerability Resolved: acroread 7.0.9 security update Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The Adobe Acrobat Reader has been updated to version 7.0.9. This update also includes following security fixes: CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution. CVE-2007-0044: Universal Cross Site Request Forgery (CSRF) problems were fixed in the Acrobat Reader plugin which could be exploited by remote attackers to conduct CSRF attacks using any site that is providing PDFs. CVE-2007-0045: Cross site scripting problems in the Acrobat Reader plugin were fixed, which could be exploited by remote attackers to conduct XSS attacks against any site that is providing PDFs. CVE-2007-0046: A double free problem in the Acrobat Reader plugin was fixed which could be used by remote attackers to potentially execute arbitrary code. Note that all platforms using Adobe Reader currently have counter measures against such attack where it will just cause a controlled abort(). CVE-2007-0047 and CVE-2007-0048 affect only Microsoft Windows and Internet Explorer. Please note that the Acrobat Reader on SUSE Linux Enterprise Server 9 is affected too, but can not be updated currently due to GTK+ 2.4 requirements. We are trying to find a solution. Acrobat Reader on SUSE Linux Enterprise Server 8 and SUSE Linux Desktop 1 is no longer supported and should be deinstalled. 2) Solution or Work-Around As a workaround, you can use the free PDF readers, kpdf, xpdf, evince, and others. Please install the updated packages. 3) Special Instructions and Notes Please close and restart all running instances of acroread after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/acroread-7.0.9-2.1.i586.rpm c37b991bf98afafafe7cef049b19c432 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/acroread-7.0.9-1.2.i586.rpm 1c2d6f4028f856b208c7a63a1a085ae2 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/acroread-7.0.9-2.1.i5… 065c5b67a4194558d70f23671f0800db SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/acroread-7.0.9-2.1.i58… da0c72bc6379fa546f581d5b73eab620 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/acroread-7.0.9-2.1.nosrc.rpm c29bf975f673b532189ced3754693ed0 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/acroread-7.0.9-1.2.nosrc.rpm 6cbe0b868a4bfffa536311e933f402a2 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/acroread-7.0.9-2.1.nos… 668ca101366dc4e66cb4670de282b6be SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/acroread-7.0.9-2.1.src.… 3e8a7e56bad5c5cba050f7c69c40d5fa Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/e4aa9329743e7c8bb35f09a113da0938.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/af82ce465dd28a7a87602e1069a0e963.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRbTnJney5gA9JdPZAQKXNwf/UqjI3D3Zt2wmak58fzGk03P5TgBtNa+0 nmQM51K7ddhMWEIHSBva709TLCiUlin/QHJNV3JlRpR0+4q6vnRqh6HfFM7G27W8 HpoTvZP8u91Xa/YqSc9Hbl5/FtN8UVOUYKeSxGm4zdDSg6M3oOI5kLLDWzBE77yl GKSF1qkDK0Pp2m0sykbk2XZhlqFf8Klkb78suxusSYKeUEdvN/TtajvGgDWvNy1f OW11qpQ3cgyVjym3g5o0xbMWeeDk9/K+DbXJk3V4J/n2I6pws7aJWIFprvFPs91b YxI5QiGMqFoSZZWfnnjHs8YFDpAjiQDcKyDZFPIyqNVJ66Jcre7O0g== =e6EC -----END PGP SIGNATURE-----

1 0

SUSE Security Summary Report SUSE-SR:2007:001
by Marcus Meissner 19 Jan '07

19 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2007:001 Date: Fri, 19 Jan 2007 17:00:00 +0000 Cross-References: CVE-2006-5601, CVE-2006-5867, CVE-2006-5974 Content of this advisory: 1) Solved Security Vulnerabilities: - xsupplicant potential code execution - ulogd potential buffer overflows - dazuko 2) Pending Vulnerabilities, Solutions, and Work-Arounds: - Acrobat Reader security problems - fetchmail security problems 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - xsupplicant potential code execution xsupplicant has been upgraded to version 1.2.8, which includes bugfixes and one security fix: CVE-2006-5601: A post-authentication stack overflow in the EAP handling could be used by already authenticated attacker to overflow a stack buffer and so potentially execute code. This affected all SUSE Linux versions. - ulogd potential buffer overflows The ulogd logging daemon was updated to fix a potential buffer overflow due to improper string length calculations. SUSE Linux 9.3 up to 10.1 and openSUSE 10.2 were affected and fixed. - dazuko The anti-virus helper module Dazuko was updated to version 2.3.2, which fixes several memory leaks and stability issues. This affects SUSE Linux 9.3 up to 10.1, openSUSE 10.2 and SUSE Linux Enterprise Server 9. ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds - Acrobat Reader security problems Various Cross Site Scripting issues and potential code execution issues were found in the Acrobat Reader Plugin. We are preparing updates to update Acrobat Reader to version 7.0.9 currently. - fetchmail security problems The POP3/IMAP client fetchmail had two security issues fixed: - Incorrect SSL handling could allow a man in the middle attack against fetchmail or could expose passwords and similar when too trivial encryption would be selected. (CVE-2006-5867) - A fetchmail daemon might crash when using direct MDA delivery. (CVE-2006-5974) We are preparing updates for these problems. ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRbDqW3ey5gA9JdPZAQJVzAf/fW4YshTAGGp4r7khv2C6CHqHbPvsyXtL NT+eSeipYtsauaBNi02myxITlxTWabj/p9fwncj537jskgH8S2LBn7yJC3P+tH7G Mq5m5r7o0acNoXiIjHU6BGrKL/+xxmf9iFev1Noc+1McaVcextk1sRLDJmH/nJeR mRlAuScBTykF1HXOwG6LE2Xp3iqh2GOyIgiWXYSlqGBol6xougNXzBcnl5ZMzC3d rEU2utmPsJ5DtzQ2YAJ4Dh/UrrIeBmNpCrl9jPmeml5S3wSXtChzRyveIdBA7urv oz38KmJOJSq0CtRYEGVjkv0Hkd50hX8wIKkYv1VBSfN6Xx4dWL4AUQ== =K0UX -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: IBMJava (SUSE-SA:2007:010)
by Marcus Meissner 18 Jan '07

18 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: IBMJava2 Announcement ID: SUSE-SA:2007:010 Date: Thu, 18 Jan 2007 14:00:00 +0000 Affected Products: UnitedLinux 1.0 SuSE Linux Enterprise Server 8 SuSE Linux Openexchange Server 4 SuSE Linux Standard Server 8 SuSE Linux School Server SUSE LINUX Retail Solution 8 SUSE SLES 9 Open Enterprise Server Novell Linux POS 9 SLE SDK 10 SUSE SLES 10 Vulnerability Type: remote code execution Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2006-4339, CVE-2006-4790, CVE-2006-6731 CVE-2006-6736, CVE-2006-6737, CVE-2006-6745 Content of This Advisory: 1) Security Vulnerability Resolved: IBMJava security update Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion Various security problems and bugs have been fixed in the IBMJava JRE and SDK. The IBM Java packages were updated to: - IBM Java 1.4.2 to Service Refresh 7. - IBM JAVA 1.3.10 to Service Refresh 10. It contains several security fixes also fixed in SUN Java including: - CVE-2006-4339: fix for the RSA exponent padding attack. - CVE-2006-6736,CVE-2006-6737: 2 unspecified vulnerabilities that allow untrusted applets to access data in other applets. - CVE-2006-6745: Multiple unspecified vulnerabilities that allow applets to gain privileges related to serialization bugs in the JRE. - CVE-2006-6731: Multiple buffer overflows in java image handling routines that allow attackers to potentially read/write/execute local files. A full overview is at: http://www-128.ibm.com/developerworks/java/jdk/alerts/ The update also contains important timezone updates: - US daylight saving time update starting 2007. - Western Australia daylight savings time introduction in December 2006. - A general update to current timezone data-set. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of programs using IBMJava after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: UnitedLinux 1.0 http://support.novell.com/techcenter/psdb/95188799cf297558f0fc915c9d248d1a.… SuSE Linux Openexchange Server 4 http://support.novell.com/techcenter/psdb/95188799cf297558f0fc915c9d248d1a.… SuSE Linux Enterprise Server 8 http://support.novell.com/techcenter/psdb/95188799cf297558f0fc915c9d248d1a.… SuSE Linux Standard Server 8 http://support.novell.com/techcenter/psdb/95188799cf297558f0fc915c9d248d1a.… SuSE Linux School Server http://support.novell.com/techcenter/psdb/95188799cf297558f0fc915c9d248d1a.… SUSE LINUX Retail Solution 8 http://support.novell.com/techcenter/psdb/95188799cf297558f0fc915c9d248d1a.… SUSE SLES 10 http://support.novell.com/techcenter/psdb/8924ac6b994acb949a8ad3572aba51d6.… SLE SDK 10 http://support.novell.com/techcenter/psdb/8924ac6b994acb949a8ad3572aba51d6.… Open Enterprise Server http://support.novell.com/techcenter/psdb/f5b3f5adf5613e923c01c813a0923b58.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/f5b3f5adf5613e923c01c813a0923b58.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/f5b3f5adf5613e923c01c813a0923b58.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRa9/a3ey5gA9JdPZAQIi6Qf/awujp1F2g0notUUnd3WfDrIqBGUxXUtq gDok+2CYSifzuOtrs82xQFOwZptZPqolM8NAk2G7HnU6hFPQUGFkVd8+o4FafIU5 Td3bwnp0gwoo+KZ9VzDOyDXu4vA0NhkXZi06UW5sGS8G1A4gjvgxiOIZw9cB0WIq kdSxl0/WFBugsdvC6phUbW7wm1pwyMDH/rAjBV34pZHwsHy2+MOd1CtO/QveMBz5 f2ruRcJLPmstbgElhtX3HWiEyudySdrzcT/TtRst4cjt0MU1FFGTRbc74uNfo58w nXzKyyE37rOXRBiLchGMbRxdzHEzdjK1S4DOXzAtwOsVJc0746gHxQ== =Mfve -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: Opera 9.10 (SUSE-SA:2007:009)
by Marcus Meissner 15 Jan '07

15 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: opera Announcement ID: SUSE-SA:2007:009 Date: Mon, 15 Jan 2007 12:00:00 +0000 Affected Products: openSUSE 10.2 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 Vulnerability Type: remote code execution Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2007-0126, CVE-2007-0127 Content of This Advisory: 1) Security Vulnerability Resolved: opera 9.10 security upgrade Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update brings the Opera Web browser to version 9.10, including fixes for the following 2 security problems: - CVE-2007-0126: Opera processes a JPEG DHT marker incorrectly, which can potentially lead to remote code execution. - CVE-2007-0127: Opera is affected by a typecasting bug in its Javascripts SVG implementation which could potentially be used to execute code. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of opera after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/opera-9.10-3.1.i586.rpm 0073b199830166f6e5876df7afb78fe3 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/opera-9.10-3.2.i586.rpm f8aa70fc1e220c4902cf53fb09c783ea SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/opera-9.10-3.1.i586.r… 18dcdee420cf06b21ba1df149e515b5f SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/opera-9.10-3.1.i586.rpm 0e5982a2186829e102ea588cc7767290 Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/opera-9.10-3.1.ppc.rpm b51206de37c350e3e115f0474f1fc702 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/opera-9.10-3.2.ppc.rpm 549e166af828bb09fb3da0e9c42dc59a x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/opera-9.10-3.1.x86_64.rpm e3ed96a415d0555d0252459b30a13d5a SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/opera-9.10-3.2.x86_64.rpm 31483fe818800573f1bb091634dc766b SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/opera-9.10-3.1.x86_… 18807e3efac4378d41b8f192d9c00664 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/opera-9.10-3.1.x86_6… 7a466290a76bfe590ab893a750fb8b06 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/opera-9.10-3.1.nosrc.rpm 2f4f8db70564d2127c251f07bf5ba80d SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/opera-9.10-3.2.nosrc.rpm 37632dcb251a8768f1bad050927ebaf2 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/opera-9.10-3.1.nosrc.r… 3f6ac26cf49a69edc132448b0afee98a SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/opera-9.10-3.1.nosrc.rpm 4f735d324312896e4b3803a683b30e40 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRat6cHey5gA9JdPZAQIYZQf+Jm5tZLgBKicTia4U5zrbb0X112gFgg13 Tk6J6BE9LbDxXkj/Zs8AodKlfHz1o+XLj9r6rXTrwYBtMq0o5adgEUjm9BiyUePd XaI70BJHJa++wAFl1xJUdxS3+weWbZlTKFkOJGu9bBn7wz65E36UF8xb2gnstPuL 9Xv7ivm8UUdtU0BQYYahCB6Yt7bxRVaU1Z8fZLp9BSXn0sE6x9lMAGFVflpQigFJ 4qURG1V2K+7e5uQj+EgaOJHKwup+i+2anGRpg1jSxKQ84AhHXxjDdomwgedoR4+8 N/LjUTl2s3HcHv7yCWSr2WADZyRXDstQNm4jP+4XrKx9iZ+EtKx+uw== =+n4G -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: XFree86/Xorg (SUSE-SA:2007:008)
by Marcus Meissner 12 Jan '07

12 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: XFree86-server,xorg-x11-server,xloader Announcement ID: SUSE-SA:2007:008 Date: Fri, 12 Jan 2007 17:00:00 +0000 Affected Products: Novell Linux Desktop 9 Novell Linux POS 9 Open Enterprise Server openSUSE 10.2 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 SuSE Linux Openexchange Server 4 SUSE LINUX Retail Solution 8 SuSE Linux School Server SuSE Linux Standard Server 8 SUSE SLED 10 SUSE SLES 10 SUSE SLES 9 UnitedLinux 1.0 Vulnerability Type: local privilege escalation Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2006-6101, CVE-2006-6102, CVE-2006-6103 Content of This Advisory: 1) Security Vulnerability Resolved: X integer overflows Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - fetchmail security problems - Opera 9.10 security update - Acrobat Reader XSS issues 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update fixes three memory corruptions within the X server which could be used by local attackers with access to this display to crash the X server and potentially execute code. CVE-2006-6101: Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures. CVE-2006-6102: Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures. CVE-2006-6103: Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of X11 after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/xorg-x11-server-7.2-30.4.i… 58a6c5df853248cf8b288c3b42418ed4 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/xorg-x11-server-6.9.0-50.3… 73150d439b17768c2a634b3a6d2bc9e0 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xorg-x11-server-6.8.2… de6c0a54f56c216296ff9a7b3a3dc571 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/xorg-x11-server-6.8.2-… cb05dbcf305d096cfea12acc7d250483 Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/xorg-x11-server-7.2-30.4.pp… af51406c70d92459c507718946883156 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/xorg-x11-server-6.9.0-50.30… c93f29c703d5a9ab6c05f6348df42d3b SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/xorg-x11-server-6.8.2-… 122c81ed707559eb873a511ec7a381a1 x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/xorg-x11-server-7.2-30.4… 2096f490f773d96e5a11cf9e715bdd74 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/xorg-x11-server-6.9.0-50… 68ac3ff1bfa31483f016c62d72e934a3 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xorg-x11-server-6.8… 37cfc2641f53d9a70c8e437b58e2823f SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/xorg-x11-server-6.8.… 864dc49e5a969a737efefc7c2a1fa3d6 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/xorg-x11-server-7.2-30.4.sr… 7539d15ac32aa71a3dbbe23dd39854aa Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: Open Enterprise Server http://support.novell.com/techcenter/psdb/3806664392b7217bd698fe6e5213851c.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/3806664392b7217bd698fe6e5213851c.… Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/3806664392b7217bd698fe6e5213851c.… SuSE Linux Desktop 1.0 http://support.novell.com/techcenter/psdb/3806664392b7217bd698fe6e5213851c.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/3806664392b7217bd698fe6e5213851c.… UnitedLinux 1.0 http://support.novell.com/techcenter/psdb/765b98b723b218b9c8a8e02d4064621a.… SuSE Linux Openexchange Server 4 http://support.novell.com/techcenter/psdb/765b98b723b218b9c8a8e02d4064621a.… SuSE Linux Enterprise Server 8 http://support.novell.com/techcenter/psdb/765b98b723b218b9c8a8e02d4064621a.… SuSE Linux Standard Server 8 http://support.novell.com/techcenter/psdb/765b98b723b218b9c8a8e02d4064621a.… SuSE Linux School Server http://support.novell.com/techcenter/psdb/765b98b723b218b9c8a8e02d4064621a.… SUSE LINUX Retail Solution 8 http://support.novell.com/techcenter/psdb/765b98b723b218b9c8a8e02d4064621a.… SUSE SLES 10 http://support.novell.com/techcenter/psdb/8d278592fd99987cae177d85827bdf26.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/8d278592fd99987cae177d85827bdf26.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - fetchmail security problems The POP3/IMAP client fetchmail had two security issues fixed: - Incorrect SSL handling could allow a man in the middle attack against fetchmail or could expose passwords and similar when too trivial encryption would be selected. (CVE-2006-5867) - A fetchmail daemon might crash when using direct MDA delivery. (CVE-2006-5974) We are preparing updates for these problems. - Opera 9.10 security update The Opera webbrowser was released in version 9.10 and only after some days it was known that it also fixes security problems. We are preparing Opera updates to version 9.10. - Acrobat Reader XSS issues Various Cross Site Scripting issues and potential code execution issues were found in the Acrobat Reader Plugin. We are preparing updates to update Acrobat Reader to version 7.0.9 currently. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRaeo6Hey5gA9JdPZAQKNegf9HbL1qElObUuEjcqlzKwQqFDkx9piMguq iBh0aQ9iYFmPaJ3fC1bciVo3JC22tWjaQBmy4Podt2GM97S+7ZHJfdZ4L7hxICTu U89Dc7olf95ks175s/GVFklH1i2CH7N2iksRVDKoaVpiz5nrhhzUm6AzXilCWEq4 8DjUcjoINUBVG6vsiO3KZ4mTVy83PYruVhevCKx/BDgwAw8l1W47WkML57+BvhZC qISWxBEzRtlFJaHWzNLT0L+ul9LjHk2xtJA8VX2YbgvLmR5YgVjBjbfhVtjzhHK1 t1vuRbyXDZtOwXQ70Zgn5NRz4Ma/xrqo95vXCOi2nKKf85gddfVeUw== =Dq6m -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: cacti cmd injection (SUSE-SA:2007:007)
by Marcus Meissner 12 Jan '07

12 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: cacti Announcement ID: SUSE-SA:2007:007 Date: Fri, 12 Jan 2007 15:00:00 +0000 Affected Products: openSUSE 10.2 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 Vulnerability Type: remote code execution Severity (1-10): 5 SUSE Default Package: yes Cross-References: CVE-2006-6799 Content of This Advisory: 1) Security Vulnerability Resolved: cacti command injection Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion A command injection in cmd.php in cacti was fixed, which might have allowed remote attackers to inject commands and so execute code. This issue is tracked by the Mitre CVE ID CVE-2006-6799. 2) Solution or Work-Around Please update to the fixed packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. Platform Independent: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/noarch/cacti-0.8.6h-36.2.noarch… 07c272d8361d3df0a7e6cc2e60bc5f91 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/noarch/cacti-0.8.6h-15.2.noarch… f39396766d9bd4d2525c5816ba4c54fd SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/noarch/cacti-0.8.6f-2.2.no… 9660cc595d97155362fd4643db8d6f14 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/noarch/cacti-0.8.6e-2.5.noa… d2c682194c800678bf0dca0e151d0cd7 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/cacti-0.8.6h-36.2.src.rpm 22c0c674b291f8e9219a2f91e22e0184 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/cacti-0.8.6h-15.2.src.rpm ecc66a6884ed00e68a59624b39402f5d SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/cacti-0.8.6f-2.2.src.r… 1d6572d2b1abf56db238b5e122ef7831 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/cacti-0.8.6e-2.5.src.rpm 91f2eb334c653b29f6f970b715ea61df ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRaeW+Xey5gA9JdPZAQI5AAf/eRhefegfT2zAtDSKoVweQagKipxVpols WwcpMEq60py3lYRbfBIbwbwdI9/voln+Q+G0JDdCGBmVfDAhJSa3flZGDOzj5u83 W9KDBo+aZsfJ/9U37hxNHChh9Qx5eP6lBRTmyo3LrJrO72b034Y0rxv9PbctP6D9 y1rITKcu6cQ/7Vw9vmCajMlAMJeqRglR/reF4rt9IQxY8g9DyZKeW8CG1uHMatc5 Mpy6yJOZUaDYvM6R5Nw5AXR4BobKZfyzk1iSlfMOM6GlyOaC4rjzDsESe4406bNu D+c2LNwaIIlqxfKvCWr0K2eS97jiu3k4bPCJJ/f949a/poFAiZHVtA== =pQgU -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: mozilla (SUSE-SA:2007:006)
by Marcus Meissner 12 Jan '07

12 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: mozilla Announcement ID: SUSE-SA:2007:006 Date: Fri, 12 Jan 2007 13:00:00 +0000 Affected Products: Novell Linux Desktop 9 Novell Linux POS 9 Open Enterprise Server SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE SLES 9 Vulnerability Type: remote denial of service Severity (1-10): 6 SUSE Default Package: no Cross-References: CVE-2006-6497, CVE-2006-6498, CVE-2006-6499 CVE-2006-6500, CVE-2006-6501, CVE-2006-6502 CVE-2006-6503, CVE-2006-6504, CVE-2006-6505 CVE-2006-6506, CVE-2006-6507 Content of This Advisory: 1) Security Vulnerability Resolved: various mozilla/seamonkey suite security problems Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion A number of security issues have been fixed in the Mozilla browser suite, which could be used by remote attackers to gain privileges, access to confidential information or cause denial of service attacks. Since the Mozilla Suite 1.7 branch is no longer maintained this update most of our older products to use the Mozilla Seamonkey Suite version 1.0.7. Security issues we fixed (compared from last seamonkey update round only) are listed below. More Details regarding the problems can be found on this page: http://www.mozilla.org/projects/security/known-vulnerabilities.html The updated packages includes fixes for the following security problems: CVE-2006-6497/MFSA-2006-68: Crashes with evidence of memory corruption were fixed in the layout engine. CVE-2006-6498/MFSA-2006-68: Crashes with evidence of memory corruption were fixed in the javascript engine. CVE-2006-6499/MFSA-2006-68: Crashes regarding floating point usage were fixed. Linux is not affected. CVE-2006-6501/MFSA-2006-70: A privilege escalation using a watch point was fixed. CVE-2006-6502/MFSA-2006-71: A LiveConnect crash finalizing JS objects was fixed. CVE-2006-6503/MFSA-2006-72: A XSS problem caused by setting img.src to javascript: URI was fixed. CVE-2006-6504/MFSA-2006-73: A Mozilla SVG Processing Remote Code Execution was fixed. CVE-2006-6505/MFSA-2006-74: Some Mail header processing heap overflows were fixed. CVE-2006-6506/MFSA-2006-75: The RSS Feed-preview referrer leak was fixed. CVE-2006-6507/MFSA-2006-76: A XSS problem using outer window's Function object was fixed. Problems with these packages we could not fix yet: - On SUSE Linux Desktop 1.0 the upgrade was not possible yet due to library inter-dependencies problems between Mozilla and GTK+. We recommend deinstalling mozilla on this product. - The SUSE Linux Enterprise Server 8 update has shown regressions in flash and java plugin handling which we are investigating. - On SUSE Linux 10.0 epiphany stops working for still unknown reasons. We are investigating this and recommend using mozilla or MozillaFirefox directly instead. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of mozilla or seamonkey after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-1.0.7-0.1.i586.r… 691bd7a6105e6f3b400b1bfd02c7ffa4 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-calendar-1.0.7-0… 0fea4d7bc71c91d3f94b5bc97d254c30 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-dom-inspector-1.… eceb85212935d502085aa018044c97d8 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-irc-1.0.7-0.1.i5… 4356126f6103052702b4756a3f2cd3d3 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-mail-1.0.7-0.1.i… e540d5c771f876329538869bdfc8e774 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-spellchecker-1.0… 6e0d898204995310a7fe96f13853e9fc ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/seamonkey-venkman-1.0.7-0.… b4a7fd442c5978b1f28d3e21c994a9bd SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/beagle-0.0.13.3-9.10.… e733f6ac215ef300e4e83b85eedb254b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/blam-1.8.2-7.4.i586.r… 8e7abfedb813376b695115c7caa09077 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/devhelp-0.10-6.1.i586… 2fe75e720667ad437f83b1b8c11606ba ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/epiphany-1.8.0-3.1.i5… df92c79d27ecf653875e737b974b6812 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/epiphany-doc-1.8.0-3.… 0bf3ef7649c0b9033635f51d0ae66acc ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/epiphany-extensions-1… 9845b9d2181e55f107e264c5cc191e11 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/liferea-1.0-19.1.i586… 1cd171a482a8a1f13c9d73542589a79e ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-1.8_seamonkey… cfc891f616d49ec435c8f0389b976d54 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-calendar-1.8_… 895026932bf0256f7365d1ad8280e162 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-devel-1.8_sea… 5336b79760646a54a993549b10debfaf ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-dom-inspector… 2e8ec85326ae2560ac9cc15497c35d00 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-irc-1.8_seamo… 5a20cd21dd6bc3669a1e33361de53a53 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-mail-1.8_seam… f988e7c897989e7324a6c017736ef57f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-spellchecker-… 4bc1d88408f3e0b2bad372fa07ce7201 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/mozilla-venkman-1.8_s… e9cbf5c734d3c70f491d79490a20310c SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/beagle-0.0.8-3.7.i586.… 0e7a1b299096d375311435328c3997a6 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/blam-1.6.1-9.4.i586.rpm 957d285ff06fb55cfeb1de3cec7209ae ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/devhelp-0.10-35.1.i586… 1aa65804a1270b60fc772a206ab3d5a6 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/epiphany-1.6.0-6.3.i58… 9bccb9dafe859004164fbc6c7804d04b ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/epiphany-doc-1.6.0-6.3… 89501dfa754cf96cd1cf37c13785d608 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/epiphany-extensions-1.… 57fde43d64c8a3351c2cd9634baee55f ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/galeon-2.0.0-28.1.i586… ae8176d7d3494727f3d5c0f06cb7c077 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-1.8_seamonkey_… 990b479cab2811454c9fcc4cec2a0131 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-calendar-1.8_s… 5718139893acb38955196693309c866e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-devel-1.8_seam… 8d1c58c7fb1f063f7e73ca9ecb6dec13 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-dom-inspector-… b397d1ffc1a2656000bf5563a15ee354 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-irc-1.8_seamon… 53c00bd80891aa53cee9dde05fbb27f1 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-mail-1.8_seamo… 495d9e356bf0a986c08d90c53c7805fd ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-spellchecker-1… 17c74d61a654aa7083994a9f9ca7d035 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mozilla-venkman-1.8_se… 2aeff8778be93bfe272d99c66671e78f Power PC Platform: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-1.0.7-0.1.ppc.rpm 8160b6918aa587d916b538086c389fcc ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-calendar-1.0.7-0.… 63148011fb308f3675e46c22adccd914 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-dom-inspector-1.0… 061903ab82cfaa6a46873e1ebbbda9e6 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-irc-1.0.7-0.1.ppc… 6ca2d653168d7fcca0143576b9e325d9 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-mail-1.0.7-0.1.pp… 9df10fe0995f46532e2e024dd13aa3fa ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-spellchecker-1.0.… 9112df7f324382cfbfe2ad520f7ec18c ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/seamonkey-venkman-1.0.7-0.1… 386dda81b7e91d9a97a89da2ec72931e SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/beagle-0.0.13.3-9.10.p… 94cbfaabbe32ce4e8543331b0e211933 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/blam-1.8.2-7.4.ppc.rpm bb9cfd5c0964dae6bdfb5f0bbb3a9220 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/devhelp-0.10-6.1.ppc.r… 169fb5a254276fac2d33e21d4e5fc074 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/epiphany-1.8.0-3.1.ppc… f4d5402979033ab63e3c28dc4301de8d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/epiphany-doc-1.8.0-3.1… 368be097a91fc56a7093bd5283c45274 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/epiphany-extensions-1.… 8e5649cd7f33dd2f3eb682019d9e6c9f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/liferea-1.0-19.1.ppc.r… a456e4e03b151c3b74b45e17afe4b45c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-1.8_seamonkey_… e9a8b25e84c86ed1a6f4ca1870a5a80c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-calendar-1.8_s… d9495a726ad5f26e3bf9f72685ba0a20 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-devel-1.8_seam… e8423d17e7d3ab2c4b414e388202807a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-dom-inspector-… 01293213124d473733ab4f28a3b7e76c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-irc-1.8_seamon… b807072846d59157d5bdb7cd77e0fa8a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-mail-1.8_seamo… 4f7b7f89a0b38bfb8c68a8fa2b5c8d1b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-spellchecker-1… 9433f71970cb8ed4cdcc0d9c4e99ee8d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/mozilla-venkman-1.8_se… b9ae9999cf3d911fce07005379d1c7e2 x86-64 Platform: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-1.0.7-0.1.x86_… 1fa7f3f74e08d3e00f854f18fa307cbc ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-calendar-1.0.7… 754706dd2258a5c82f0064e8625d600d ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-dom-inspector-… 3031264a90c2fe4a22d194d201b24fbc ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-irc-1.0.7-0.1.… d10bfc48aa0a7c51dbac4cbf3440486f ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-mail-1.0.7-0.1… 25eb261c46317af23c77fda4e136188d ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-spellchecker-1… 1d7483a0b18dd19e29d9e21b03b37dc5 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/seamonkey-venkman-1.0.7-… c08dbce9626f91b2f3c14e928aac6491 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/beagle-0.0.13.3-9.1… e600623e759336556a4be1f2a987cda8 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/blam-1.8.2-7.4.x86_… d7e7b62ad5088b152807a2069217fca7 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/devhelp-0.10-6.1.x8… 01802f141f774601475486b2ac644111 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/epiphany-1.8.0-3.1.… 9121623c27dd5bbdb05cbecf3e52b611 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/epiphany-doc-1.8.0-… 4e509e792eab1dfed197d18e3bb16724 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/epiphany-extensions… 50e2e436a6e465f2d6e1887511f09380 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/liferea-1.0-19.1.x8… b70bc4c1cd197d75d43dffe7443d445d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-1.8_seamonk… d6741db2d323cc114290ce861e88565f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-calendar-1.… d86e6a32b762af18198ef459887abfec ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-devel-1.8_s… b863e5ff89252b9aa467a77c166792a3 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-dom-inspect… e48adaed5f275ac7441f9788bc94e50d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-irc-1.8_sea… 2b755a27b1020db97ff3ee3f78008572 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-mail-1.8_se… d465da6f8fb7b5b31e2aa502b28a4203 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-spellchecke… c1c918deb3ac00ece7493e69612dbe90 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/mozilla-venkman-1.8… 179cc90ce6833f6ec5fc09faf368f03d SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/beagle-0.0.8-3.7.x86… 6a7e3da1c8b99d77978f60be5d708c1c ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/blam-1.6.1-9.4.x86_6… 827d70dbe55edb1b0442335f76aa7a06 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/devhelp-0.10-35.1.x8… 103efd565bfb50fb8247fb926666c50e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/epiphany-1.6.0-6.3.x… 327d71eacdf8c067cbfbd4eecde00517 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/epiphany-doc-1.6.0-6… 8978d235b2e1d3f1d0e1d590445f69ae ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/epiphany-extensions-… 16459e0004cf97ca397f1071fcc494c1 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/galeon-2.0.0-28.1.x8… 3125276df0456ff87a8648c13f000971 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-1.8_seamonke… e5e49a8f5b1c4b5df75296f2cbe79738 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-32bit-9.3-7.… 531aac2cde8e0c3a00df57670bbcd877 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-calendar-1.8… 3e3fe004ecb9967d4659d34f71fc179d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-devel-1.8_se… 53a09dc52ea7f00a051d94f0c1b5396d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-dom-inspecto… 2093c833325dc4a51bf943077ef75d23 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-irc-1.8_seam… c280a797a277445f92942dc29da9724e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-mail-1.8_sea… f63c5575c0413ae258f5919ac7b7d1ad ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-spellchecker… f8763e4d083d6c590f863713dc2753d7 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mozilla-venkman-1.8_… c0085d1167554a15f5ed899afca245c3 Sources: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/seamonkey-1.0.7-0.1.src.rpm 1ae24878aac47b6a85eaee457896b2d8 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/beagle-0.0.13.3-9.10.s… 41ba75d370bfb3d43066fcc8eae44aad ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/blam-1.8.2-7.4.src.rpm 845e24b32a1e202b9283c6b62fcfba46 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/devhelp-0.10-6.1.src.r… 58332e241f66168ca90f86ef8825a8b5 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/epiphany-1.8.0-3.1.src… 3ef701bba73faa82b330be60b324d5af ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/epiphany-extensions-1.… edcf8f83a99a8bdd583f601806a0e5fb ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/liferea-1.0-19.1.src.r… e1df6bf13764c2644e51ec0099acb2a5 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/mozilla-1.8_seamonkey_… 0d8ff5e18a378c40ab329466039c4673 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/beagle-0.0.8-3.7.src.rpm 198e2742a00ef781837f0c4d695bba97 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/blam-1.6.1-9.4.src.rpm 26bbda402bcd800c3377ea03052984f2 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/devhelp-0.10-35.1.src.r… 6b8fc1af805b3672cc9dbd2b8be6205e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/epiphany-1.6.0-6.3.src.… dd0fb0962af4accfae631a35d35d70ca ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/epiphany-extensions-1.6… 5dff3834434d550d271a004d3e0315f6 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/galeon-2.0.0-28.1.src.r… fad96a1dc7da8a786fd953dffc673068 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/mozilla-1.8_seamonkey_1… d3bf5b983708d7e796a0280812a1a325 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: Open Enterprise Server http://support.novell.com/techcenter/psdb/23c2f7e232f2a20be862d4cbaf1e30e5.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/23c2f7e232f2a20be862d4cbaf1e30e5.… Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/7abef1462ebc9ce70a2931e6f4f8e38b.… http://support.novell.com/techcenter/psdb/23c2f7e232f2a20be862d4cbaf1e30e5.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/23c2f7e232f2a20be862d4cbaf1e30e5.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRad483ey5gA9JdPZAQIOIgf/cYAaB6m9Dhs4uNb06ToAqNbERaGnVSC2 3w8UuxnPW5lj7/SIy6qjD+lY7Lm19e1FGQlsCOlXx/pUH9M4vHGW3dcrfRyxET+l wodYMYOqB1ki7zUatwKlQtZjRRn1yaPsPbP1bcKmzrJ6cUkZAIzUXME7jvQr2DP8 QHllT+7HPWl98F168MxDaWTRcTw+4ZbxnOYguF3rUmdXr7ND4FqQ1XvQbaoXCrWz hHJ8h7RT4L0rFZ5y8l/7Xz0dvMsY9Lxtbnrprepn7S7aJwnlt5Wtj38APLb3d1A1 H59EuLK4ZAjyTOmxODfcAAj0W3C+gNjjwI3pFOuYRtzZM0R/NgN7FA== =Y4zG -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: w3m (SUSE-SA:2007:005)
by Marcus Meissner 10 Jan '07

10 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: w3m Announcement ID: SUSE-SA:2007:005 Date: Wed, 10 Jan 2007 13:00:00 +0000 Affected Products: Novell Linux Desktop 9 Novell Linux POS 9 Open Enterprise Server openSUSE 10.2 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 SuSE Linux Openexchange Server 4 SUSE LINUX Retail Solution 8 SuSE Linux School Server SuSE Linux Standard Server 8 SUSE SLED 10 SUSE SLES 10 SUSE SLES 9 UnitedLinux 1.0 Vulnerability Type: remote denial of service, remote code execution Severity (1-10): 5 SUSE Default Package: yes Cross-References: CVE-2006-6772 Content of This Advisory: 1) Security Vulnerability Resolved: format string problem in w3m Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion A format string problem in w3m -dump / -backend mode could be used by a malicious server to crash w3m or execute code. In SUSE Linux 10.1, openSUSE 10.2 and SUSE Linux Enterprise Server and Desktop 10 this problem was not exploitable to execute code due to use of the FORTIFY SOURCE extensions. This problem is tracked by the Mitre CVE ID CVE-2006-6772. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/w3m-0.5.1-41.2.i586.rpm 3525018108eef9575b49f83fff5d2ccc SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/w3m-0.5.1-19.5.i586.rpm 30b208f9f0b2bab7f307992f5b9ba37a SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/w3m-0.5.1-6.2.i586.rpm 2fe8c1e60e42d455f3a7893d746fed5b SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/w3m-0.5.1-4.2.i586.rpm e4d9b3249af7c1e30e952fed5f0ca715 Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/w3m-0.5.1-41.2.ppc.rpm 0af57d2db4baee945906778928ba224c SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/w3m-0.5.1-19.5.ppc.rpm 8b82c09173486db5bd3e86e608eb8f03 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/w3m-0.5.1-6.2.ppc.rpm cdacb01e8ff67ae2b6a9e8b50aca2ded x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/w3m-0.5.1-41.2.x86_64.rpm e15ebe53773a96389d9c6f881c0b78fe SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/w3m-0.5.1-19.5.x86_64.rpm 58f2eef278dd4d44353b7667cee9052e SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/w3m-0.5.1-6.2.x86_6… 7a55737fd8c21182155fc072a94effe6 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/w3m-0.5.1-4.2.x86_64… e58ec0574d37df6c380ddfefc6ca8f2e Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/w3m-0.5.1-41.2.src.rpm 0586de642d025ad7cb90b322d13b6070 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/w3m-0.5.1-19.5.src.rpm 2b58129ee87210b76a4ed07fe98e9f4e SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/w3m-0.5.1-6.2.src.rpm 120ba25b2123467e4c7df451452c36a8 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/w3m-0.5.1-4.2.src.rpm e6fccb4480b5d8e7445ad83fb1e6b43b Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: UnitedLinux 1.0 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SuSE Linux Openexchange Server 4 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… Open Enterprise Server http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SuSE Linux Enterprise Server 8 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SuSE Linux Standard Server 8 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SuSE Linux School Server http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SUSE LINUX Retail Solution 8 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SuSE Linux Desktop 1.0 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SUSE SLES 10 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/68d7a138079c9fa4fa2b1defabd0c5ab.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRaUBLHey5gA9JdPZAQLIKgf/UiSYyJ3zcFaWEeC1Svj0V95S9ocJLbfl 5aH3JfAIL4bLcNlrQd/pq2uQmQUlJM7IFqbQzanPRF6TFhDPbXzqxRN8f1ox3l4u D4JsNtgXYMQzbEicFM5CHy1NHcmnTQtJQMUdZ9TQ1gC7mJ+jqdwb9qMXHWKlCCJ8 QByEkyFgIfc+hYq6fC17cvLxPb22WZBLD7nxE9CzykL9pZBjfjJfu9W4SNnkqjvu Qrj62XJQS2xMLYOpn52tECtFUCDfn+rgpPE6oURJfxGn22I9Lxqkv0ONYFg+gMzo tJFyv0wqzOrQlsvVV8/Qc7uVAsXXIOJFYUr3pqdUttrywOsCL7M/cA== =cZqT -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: krb5 security problems (SUSE-SA:2007:004)
by Marcus Meissner 10 Jan '07

10 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: krb5 Announcement ID: SUSE-SA:2007:004 Date: Wed, 10 Jan 2007 12:00:00 +0000 Affected Products: openSUSE 10.2 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE SLED 10 SUSE SLES 10 Vulnerability Type: remote denial of service Severity (1-10): 6 SUSE Default Package: yes Cross-References: CVE-2006-6143, CVE-2006-6144 Content of This Advisory: 1) Security Vulnerability Resolved: krb5 security problems Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion Various bugs in the Kerberos5 libraries and tools were fixed which could be used by remote attackers to crash and potentially execute code in kadmind. - CVE-2006-6144 / MITKRB5-SA-2006-002: the RPC library could call an uninitialized function pointer, which created a security vulnerability for kadmind. - CVE-2006-6143 / MITKRB5-SA-2006-003: the GSS-API mechglue layer could fail to initialize some output pointers, causing callers to attempt to free uninitialized pointers. This caused a security vulnerability in kadmind. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/krb5-1.5.1-23.2.i586.rpm 4ca25054bbab5904788c59770244f7db ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/krb5-server-1.5.1-23.2.i58… 1255b216e9ccd859dd48d408ff3c47fe SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/krb5-1.4.3-19.7.i586.rpm bb069e7b8a87d1b37d295845d42f01b7 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/krb5-server-1.4.3-19.7.i58… 216fbc03ebf686e4fb0e97ea9af37663 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/krb5-1.4.1-5.3.i586.r… b64ae4d898a21a45215f910d79e25846 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/krb5-server-1.4.1-5.3… 41cfd49f686df98c58e952ac35f884f4 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/krb5-1.4-16.7.i586.rpm 8217967cf7b1cbe2f110b62d6587f1ed ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/krb5-server-1.4-16.7.i… e53acbadff99aef651c0bffe9b635cc4 Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/krb5-1.5.1-23.2.ppc.rpm 926d4584a5b99b3e2c4b6e2d7c82f207 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/krb5-server-1.5.1-23.2.ppc.… 147cbf384e74834f8bd3ae85b6558801 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/krb5-1.4.3-19.7.ppc.rpm 0f64972c3effc2e8b8d6c60e6cc83ee2 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/krb5-server-1.4.3-19.7.ppc.… b05b1f047f45cb3dae619803c35b2064 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/krb5-1.4.1-5.3.ppc.rpm 8b848a4cdb5eeca47145665009ee6999 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/krb5-server-1.4.1-5.3.… 788cea6376b8d0d4fbb7ae6841b1121e x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/krb5-1.5.1-23.2.x86_64.r… 5048fe45c961d2a101c359beee6dfd90 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/krb5-32bit-1.5.1-23.2.x8… aab68447731fe22bbf3e7133411658eb ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/krb5-server-1.5.1-23.2.x… 76d07392dbfa6ce64afb748724ffc383 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/krb5-1.4.3-19.7.x86_64.r… 4f28bc902dd81ba3154c8ab502dd6be6 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/krb5-32bit-1.4.3-19.7.x8… e8cb3fd1f9040c3c162e84f76e490578 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/krb5-server-1.4.3-19.7.x… b9f3d11d3ee957b0f228c5276a84005b SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/krb5-1.4.1-5.3.x86_… dedeffa46109d7339ec71122122589db ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/krb5-32bit-1.4.1-5.… 4bce2876d9c1b883207e03dc34513eb2 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/krb5-server-1.4.1-5… 1ef250e5e23a298349f28b2423e3a8f2 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/krb5-1.4-16.7.x86_64… 82e4c415098edcaca10ab626cb304bed ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/krb5-32bit-9.3-7.2.x… e2cdaaf22c5ecf51274c6d87731cbd7f ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/krb5-server-1.4-16.7… 861fb648231993f96b6c9bb789c6fba2 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/krb5-1.5.1-23.2.src.rpm 49e80a10bedad6caf6584c91262bacb4 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/krb5-1.4.3-19.7.src.rpm 8a116157fed412cb74c84157391a25e1 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/krb5-1.4.1-5.3.src.rpm de6594481cd93860c81a66befa90179e SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/krb5-1.4-16.7.src.rpm 8e24ef8f705e1c00fe5f2158198e0ed1 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SUSE SLES 10 http://support.novell.com/techcenter/psdb/719d380dfd2862678d739af24aefaf29.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/719d380dfd2862678d739af24aefaf29.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRaTEgXey5gA9JdPZAQLmbgf5AR8j5HAjCqpVC4LV+pwS1tjoRXldPKIB tKlrvVBauEXp3ZXWwYahcxQNt0B5F7kGFydrK+m7/5iKzRKArHMwsUmZZiIUt+W1 NVgopipAhw9PudHRfBeZ7gLXMFbW0o0R34/omyXfVkdW54r7khYEaDzau9wkOTMJ FY+b0J0aMUfjVSvcY5hf0R2OrsXd8YyTsAC1lBCbepxUp6i3tTW8/v2FVywDzdhm PjuBsVbQTUOs95dL87YN9S6HqCfw1+nRLpn/we0E355qM7zCWYNoP30k9e0+eih3 bOmMgczRnv6vM+7LCJntqocZeJRBa/HsUjrIzdARyvfGCbqPkDdvaw== =Zwh5 -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: Sun Java security update (SUSE-SA:2007:003)
by Marcus Meissner 09 Jan '07

09 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: Sun Java Announcement ID: SUSE-SA:2007:003 Date: Tue, 09 Jan 2007 12:00:00 +0000 Affected Products: Novell Linux Desktop 9 Novell Linux POS 9 Open Enterprise Server openSUSE 10.2 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 SuSE Linux Openexchange Server 4 SUSE LINUX Retail Solution 8 SuSE Linux School Server SuSE Linux Standard Server 8 SUSE SLED 10 SUSE SLES 10 SUSE SLES 9 UnitedLinux 1.0 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE Default Package: yes Cross-References: CVE-2006-6731, CVE-2006-6736, CVE-2006-6737 CVE-2006-6745 Content of This Advisory: 1) Security Vulnerability Resolved: Sun Java various security problems Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The SUN Java packages have been upgraded to fix security problems. SUN Java was upgraded on all affected distributions: - The Java 1.3 version to 1.3.1_19 for SUSE Linux Enterprise Server 8. - The Java 1.4 version (also known as Java 2) to 1.4.2_13 for SUSE Linux Enterprise Desktop 1, SUSE Linux Enterprise Server 9, SUSE Linux 9.3, 10.0, 10.1 and openSUSE 10.2. - The Java 1.5 version (also known as Java 5) to 1.5.0_10 for SUSE Linux 9.3, 10.0, 10.1 and openSUSE 10.2. While Sun does not publish the vulnerabilities fixed for this specific update, it published the bugs fixed previously, text snippets verbatim from the Mitre CVE DB: CVE-2006-6731:Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. CVE-2006-6736: Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 6 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allows attackers to attackers to use untrusted applets to "access data in other applets," aka "The second issue." CVE-2006-6737: Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 5 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_10 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allows attackers to use untrusted applets to "access data in other applets," aka "The first issue." CVE-2006-6745: Multiple unspecified vulnerabilities in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, and Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges, related to serialization in JRE. 2) Solution or Work-Around A potential workaround would be to disable Java Applets in all browsers. In general we recommend installing the updated packages. 3) Special Instructions and Notes Please close and restart all running instances of Java using programs (web browsers) after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_4_2-sun-1.4.2_updat… 81c565319263d8c7c58e9e01d13f704a ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_4_2-sun-alsa-1.4.2_… 3d80e29e86da461750d4f81aebf468ff ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_4_2-sun-devel-1.4.2… 9167d98e8dc65249a9d07060f6a74765 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_4_2-sun-jdbc-1.4.2_… 0abe0b6df38b505babea046b29ec984f ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_4_2-sun-plugin-1.4.… d0adc2abc1aaa827c50f3d537bf81278 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_5_0-sun-1.5.0_updat… 491bc2c41e4d45ea7ed8bb49d994cbe8 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_5_0-sun-alsa-1.5.0_… 2e463e24dc019506bdfb56ae74d28397 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_5_0-sun-devel-1.5.0… d5839f4872e763210d8070edaa5b3b18 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_5_0-sun-jdbc-1.5.0_… 2371d8ae5ddc400193bb691f6952ec63 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/java-1_5_0-sun-plugin-1.5.… d33b4bc3c465d34c268a387946ea8ce5 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-1.4.2.13-0.… ab731afee0d28a896d684fa5216290a8 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-alsa-1.4.2.… dbe701794214d79ae5bd5e85dc892e64 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-demo-1.4.2.… 5aac3f025f2f4a026fd29dd9fa3bb3f2 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-devel-1.4.2… 43e6cf1a0c090b45a4a409bcdbd8f736 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-jdbc-1.4.2.… 71e2ad7281293cd9618935496d61b5d3 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-plugin-1.4.… c86d75d765c23e4d58de79d8bc1089df ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_4_2-sun-src-1.4.2.1… cd2debb1e6c4e9d11856db3fe519841a ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-1.5.0_10-0.… 9b7e3eaa1d0c55d58eda3f7aa97e9441 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-alsa-1.5.0_… 5f5f12ad1670e4a35ad250c5feb2e9be ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-demo-1.5.0_… 84b962fe0178668e4aa8d5f9bb969bbc ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-devel-1.5.0… f4e699c71718c3901a9897a33b20df0d ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-jdbc-1.5.0_… 23e0cfc6b4539e61e3843c7349f1bcae ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-plugin-1.5.… c7b41e40785eed1fbeafabcc80061e5d ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/java-1_5_0-sun-src-1.5.0_1… d3126e7ccaac8eb959b3a63bee316280 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-1.4.2.… 01c42908922ef09a7db9e94b80c4f36a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-alsa-1… 6db1f2255fb32dc5a205907c7515bcd8 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-demo-1… 76c296ed9a0c10c5d5d70141badbaf4f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-devel-… e8201238c0d522f9ae2d877d6115c89d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-jdbc-1… 6ce914b04c9f64db3be56ac79fee8b2b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-plugin… 39735a1837bccd86d2f6aaaa13d5e7a9 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/java-1_4_2-sun-src-1.… 770a5e25c80be675c5d9079a055763f2 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-1.4.2.1… a12bc6b3eef904121096c57b9fec0578 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-alsa-1.… 479caeebe4f56179a11851e29625c78c ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-demo-1.… 5847d503752a299655bfe1c713c84f8b ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-devel-1… 1c42d0d68ec84f54980e110cb1d7851b ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-jdbc-1.… d8a089d92655d8f0c0f99facbb00b6f2 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-plugin-… dcf3226d5eb96725725445703a32f1d3 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-src-1.4… 0e39ae7c8ed7be6db647c104f202ef41 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-1.5.0_1… ede1d5b840059e0ef4397ce9934217fd ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-alsa-1.… 0e8aba2703badd0b0023ea7a1c413ee7 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-demo-1.… feaa9180c7deaf538fa303ef6991b0e7 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-devel-1… 2c783a72645b218f7b39219f263a1119 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-jdbc-1.… 350e2e6cbc13ce0551363e03219c71f7 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-plugin-… d34d9b8728be32b459429c2e4f5ebb02 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_5_0-sun-src-1.5… 129fff7e8359cc26f7eec6b7a4da2274 x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/java-1_5_0-sun-1.5.0_upd… d95af4791d768248d85a879a9af1c60c ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/java-1_5_0-sun-alsa-1.5.… fdfe5e8925ec1ec2fa02ac4b7011c104 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/java-1_5_0-sun-devel-1.5… 189972c8c315424a77044f8582256a59 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/java-1_5_0-sun-jdbc-1.5.… ce9d5527a989388b2102985820ac85f1 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/java-1_5_0-sun-1.5.0_10-… d4d5307be992866ee9728e4a2d95c3b2 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/java-1_5_0-sun-alsa-1.5.… fa667f16d6be5893e345402f457bc1e5 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/java-1_5_0-sun-demo-1.5.… 79371a930adb81aac20f0bd0388b03b6 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/java-1_5_0-sun-devel-1.5… 7f724100d575096819838bbfe052655a ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/java-1_5_0-sun-jdbc-1.5.… eefe320b0695b0cce838fa1ae8aa4d93 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/java-1_5_0-sun-src-1.5.0… 434855da573f6ae2bd710c81bf9ab286 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/java-1_5_0-sun-1.5.0… 3a7c5e1782128e542218d59fab18069f ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/java-1_5_0-sun-alsa-… 5ea0a7eeba2975dccfe7b3e18b62b524 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/java-1_5_0-sun-demo-… ed7906d110161e840c546bbb9687763a ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/java-1_5_0-sun-devel… 551dbc446ff7af9335f92b7018b3d9d2 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/java-1_5_0-sun-jdbc-… 25b6a19d1381f432b3dbbf00e3cedc38 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/java-1_4_2-sun-1.4.2_update… 3a00b836232f6bdea0746947d81d9a4f ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/java-1_5_0-sun-1.5.0_update… 4ce00bd1661fe5a47a9d05a9132a0107 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/java-1_4_2-sun-1.4.2.13-0.2… 07e52f5f67c800ef1c6d19e40d14bd8f ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/java-1_5_0-sun-1.5.0_10-0.1… 414acf97c129f721ce1c8c24c186b2d5 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/java-1_4_2-sun-1.4.2.1… 2cb5a8d1603b10eb60706c7faad08ae5 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/java-1_4_2-sun-1.4.2.13… e51fc5224e0323f0e7509cea80523c3c ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/java-1_5_0-sun-1.5.0_10… 329dd9dc0181b1c8d299de35f28f8815 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SUSE SLES 10 http://support.novell.com/techcenter/psdb/587b3ae0b3dd71be5cad19cd1b67c3b4.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/587b3ae0b3dd71be5cad19cd1b67c3b4.… UnitedLinux 1.0 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SuSE Linux Openexchange Server 4 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… Open Enterprise Server http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… Novell Linux POS 9 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SuSE Linux Enterprise Server 8 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SuSE Linux Standard Server 8 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SuSE Linux School Server http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SUSE LINUX Retail Solution 8 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SuSE Linux Desktop 1.0 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… SUSE SLES 9 http://support.novell.com/techcenter/psdb/b61d3cf1f87c35751e465d9d7a361d47.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRaNyGney5gA9JdPZAQL2yAf+IDF+9zmbxcS+KCWUbi9HxssUFXIq6xDy u59Q+yW21rv4Jg6/V/bySPkx8QIL2KPdvRP9lBiErBq9syAfQ5iB07MO7JIVy5z8 5Xi9rV9Fybjo/Y2g71bDGCZDOVFk5TBUnlRJX6NNI00OF12TKSxQFMMxAPl/ugKz YwqaCndM8rYXl/tK+3J0DhANVa/Yh4+ap/onnTch+SiPKBN1t+zybFRhv0Si1Eew GZB/KFx3Q/Yz+ynEncIzE8Osv6/T1SwvLD0G1UuB/UfQ7eHH4ds6u89ID8RLL8i9 FDkuU6aaLpKinQK/l23jO1b0mRr827MxQnE07in4Kp8duG/JgPRpAA== =rX8t -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: mono-web ASP.net sourcecode disclosure (SUSE-SA:2007:002)
by Marcus Meissner 04 Jan '07

04 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: mono-web Announcement ID: SUSE-SA:2007:002 Date: Thu, 04 Jan 2007 18:00:00 +0000 Affected Products: openSUSE 10.2 SLE SDK 10 SUSE LINUX 10.1 SUSE SLED 10 SUSE SLES 10 Vulnerability Type: remote source code disclosure Severity (1-10): 4 SUSE Default Package: no Cross-References: CVE-2006-6104 Content of This Advisory: 1) Security Vulnerability Resolved: ASP.net source code disclosure Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion A security problem was found and fixed in the Mono / C# web server implementation. By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server. This issue is tracked by the Mitre CVE ID CVE-2006-6104 and only affects SUSE Linux 10.1, openSUSE 10.2 and SUSE Linux Enterprise 10. Older products are not affected. The updated packages for this problem were released on December 29th 2006. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bytefx-data-mysql-1.1.18.1… 7871ea91da68edfcd0b33e1a65f89414 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/ibm-data-db2-1.1.18.1-12.2… 4dea03120df7e27db52f24e3453218d3 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-core-1.1.18.1-12.2.i5… 7129007767134eee66ab5f48789fa6b8 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-data-1.1.18.1-12.2.i5… 4aaffb7e159d5e9d0807dcbaa57f9e97 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-data-firebird-1.1.18.… 764d536b04339d426cda40faca9e738f ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-data-oracle-1.1.18.1-… a575de3f3340abb11283aaea3d6ccda4 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-data-postgresql-1.1.1… 22667d583ed22211edb7608de92b6979 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-data-sqlite-1.1.18.1-… 1d4a805666f53d39c2150894ff72312e ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-data-sybase-1.1.18.1-… c7ae739f8bb04eb013daee44967e3589 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-devel-1.1.18.1-12.2.i… 94b8c2fa29d1684d1d93368fc289131d ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-extras-1.1.18.1-12.2.… 6c9392ee56d2b8aa357c52d6f49b46a4 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-jscript-1.1.18.1-12.2… 5ce60c49f5109ef6a869c0c3d1b5facd ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-locale-extras-1.1.18.… b5723ee0fae44b0de7ee7f4e98625ca5 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-nunit-1.1.18.1-12.2.i… 5668807cb61dbdd3a46da9f0154a13dc ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-web-1.1.18.1-12.2.i58… 2f3c091bafb9c174205b9917a1c948e0 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/mono-winforms-1.1.18.1-12.… 3f6b3be8eb8ed73d8a0b8348fdfcf4fc SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/bytefx-data-mysql-1.1.13.8… 7e411b0255e4b8364e1fa2e261d177bb ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/ibm-data-db2-1.1.13.8-2.15… 59c0e03583c5d59157b35c33a68ff610 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-basic-1.1.13.8-2.15.i… eb2b47003b0232d63dcf60a54371da59 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-core-1.1.13.8-2.15.i5… e115c6e2da3c2b1ccfd7177752237239 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-data-1.1.13.8-2.15.i5… 42e8bbae01de311597b5166837ac06e1 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-data-firebird-1.1.13.… c3ebfde89466f76d1018afbbc2a1410e ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-data-oracle-1.1.13.8-… f6ba40eb9f4529405f21a2c5d0b39a01 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-data-postgresql-1.1.1… 1018446b35dfd46b2404c12711b4e866 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-data-sqlite-1.1.13.8-… 7b864e4a21da1d12c171e168597249cb ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-data-sybase-1.1.13.8-… 86ef906b744853c4b26a266cfc7460f7 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-devel-1.1.13.8-2.15.i… 37ece2cc4d73f6b55ef0b4cc6e42f006 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-extras-1.1.13.8-2.15.… c4c64d22660f77da3809a6c6d4375500 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-jscript-1.1.13.8-2.15… 291ccf1005505b87f59c4ab3e2acb6a5 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-locale-extras-1.1.13.… 0d76aa220a6772796f64a058b010d90b ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-nunit-1.1.13.8-2.15.i… 4a90129294c6cd3cae2e5bd3b46e22c4 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-web-1.1.13.8-2.15.i58… 8037c8dbfe7d5d72b918035553751d70 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/mono-winforms-1.1.13.8-2.1… b0333ba342c5f31e9c7d154f160faa8e Platform Independent: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/noarch/mono-basic-1.1.18-9.1.no… 563582c657915b15b4081b6f36ee37cf Power PC Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/bytefx-data-mysql-1.1.18.1-… 7ab0a3e1908b2ce41ce6991392c56b5a ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/ibm-data-db2-1.1.18.1-12.2.… 533e9f3a2a97fe56749f3409bbd1e577 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-core-1.1.18.1-12.2.ppc… 7388cf8363ef7b6d4d2ce495276c9b3d ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-data-1.1.18.1-12.2.ppc… 70833baf535bce3b2192c705266c20ea ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-data-firebird-1.1.18.1… 51dca3ae3f5d0276ad1a67702870adf0 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-data-oracle-1.1.18.1-1… 12a03dd8b94fb0d2cfd25266fd4d6021 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-data-postgresql-1.1.18… 5fca596e3bb72c03dfe8ed697a79217f ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-data-sqlite-1.1.18.1-1… 78fc0723c0f9be7db965583a24125b27 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-data-sybase-1.1.18.1-1… 065affeebf284637dc17663cf647505c ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-devel-1.1.18.1-12.2.pp… fa9b85abb2a4d7f7b8434dfaaa88e629 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-extras-1.1.18.1-12.2.p… b6062113f1c076e53b7bb714855e4f67 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-jscript-1.1.18.1-12.2.… 4bd211e6f9fb5f23c681179a96641b86 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-locale-extras-1.1.18.1… e65f00cc0a931ee23ea35cbfb0dbd567 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-nunit-1.1.18.1-12.2.pp… 6cba2323367c90475a9aaf3059dba127 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-web-1.1.18.1-12.2.ppc.… 88760a5f5b8a47209239ffbc3c06251d ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/mono-winforms-1.1.18.1-12.2… f2abba637b11bbf630a6796e74cc4b76 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/bytefx-data-mysql-1.1.13.8-… df2f559a7c5971466d4e2e56610cc474 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/ibm-data-db2-1.1.13.8-2.15.… e25fbded3d1d80e1558b6d41dd967518 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-basic-1.1.13.8-2.15.pp… 4171575ffdd03b5711b4ead378849456 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-core-1.1.13.8-2.15.ppc… bc13a69c38e1d5cf583b31dfd6913b47 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-data-1.1.13.8-2.15.ppc… 3554bf92b4f2febcadb50f4b29f23acc ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-data-firebird-1.1.13.8… 7f1f5caae871c29169f1c76b5b7dd718 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-data-oracle-1.1.13.8-2… fe1a9b37ce0079e9c65830607403aaac ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-data-postgresql-1.1.13… a1aaa83c1c9d151bb79eed446ea5c7a1 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-data-sqlite-1.1.13.8-2… 682dfb340b1cfd4fc5518e62e76a5ee8 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-data-sybase-1.1.13.8-2… 37574a7a9be6736bd4f703e23ef2a1d3 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-devel-1.1.13.8-2.15.pp… 3e9314db61dc553c95582be0b5da22a4 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-extras-1.1.13.8-2.15.p… 334b918e3281772f5bae84fde6b829a9 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-jscript-1.1.13.8-2.15.… 83af7ef9f3fe0218b3d16ed662d9bcd4 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-locale-extras-1.1.13.8… 766583abd69fcf242e3ff1f6c562ea5e ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-nunit-1.1.13.8-2.15.pp… a0a6c098484a9bb70f0242844188f52d ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-web-1.1.13.8-2.15.ppc.… f98c8ccce8bb938fb325d779d7b971c6 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/mono-winforms-1.1.13.8-2.15… 5d49531a71b940ca4958485e9fee72f1 x86-64 Platform: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/bytefx-data-mysql-1.1.18… 23591c785aaef10d3b422eebebbb1499 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/ibm-data-db2-1.1.18.1-12… f090dfa3c21f4071ac7312bfa0c76512 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-core-1.1.18.1-12.2.… 9af61b7d487a6025107dfabf76b1d307 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-core-32bit-1.1.18.1… d8b8ff18dfe16e6b8a4e7eea39b46fdc ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-data-1.1.18.1-12.2.… 46d10714bd4534d578564b521cc4e5ee ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-data-firebird-1.1.1… 3352eb7cae2644d12b2761d4280f6a31 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-data-oracle-1.1.18.… 8dcb7cd3e271a1a0bcbe843269ee8b52 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-data-postgresql-1.1… be734ae165180a801f35d26811a5a5c4 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-data-sqlite-1.1.18.… d958bf9cdae6c32bb1e1c36df74fc9fb ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-data-sybase-1.1.18.… c9429b316e6eecb6ddc2682d01e170dc ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-devel-1.1.18.1-12.2… 67567fd44fc1b7f3589ad48f31dd87ad ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-extras-1.1.18.1-12.… 3b95cb4747ac42848e2daf543622770c ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-jscript-1.1.18.1-12… 97fbb5843ff11f35edc5c54338d0ceb9 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-locale-extras-1.1.1… 46d10243690c90812ced6b1a9d5aa041 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-nunit-1.1.18.1-12.2… 0cfe47db6079f91b99f6fea86696d019 ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-web-1.1.18.1-12.2.x… 34e0a3027a6db5adb8a10560467a651e ftp://ftp.suse.com/pub/suse/update/10.2/rpm/x86_64/mono-winforms-1.1.18.1-1… 6fbe5c405768ae26f9c00b9e6a353352 SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/bytefx-data-mysql-1.1.13… 2019045021a97b167ea99ac0c046b101 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/ibm-data-db2-1.1.13.8-2.… 4889570b65d8eed1283146d1adbef2c5 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-basic-1.1.13.8-2.15… 3b3337acb365adeb2cdd167dc8ab11c3 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-core-1.1.13.8-2.15.… 54d0899c5591c4b546a4328aa023e455 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-core-32bit-1.1.13.8… d61a5d6b3ad1418ae8828c632c38753f ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-data-1.1.13.8-2.15.… 043514968a409980de9c26bb326bcf61 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-data-firebird-1.1.1… 79d4a0e1a3ee4ead9c32f2f2a994a3dd ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-data-oracle-1.1.13.… b094e7fc68ac93c8cea50dd8c9c9f8fa ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-data-postgresql-1.1… 57eca0584754764c9676f64a99318eda ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-data-sqlite-1.1.13.… 2a3bf582c8bf3b3f0e3b659b5a69fa8f ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-data-sybase-1.1.13.… e7df071bb25de0dadd8d91d1266e813b ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-devel-1.1.13.8-2.15… ccb9cf8b02a3684bc523b1c8deafa132 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-extras-1.1.13.8-2.1… e002218ccb079ab3b98c10c6a98e6632 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-jscript-1.1.13.8-2.… b8d6933ae2cd19aae0333385c6df7179 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-locale-extras-1.1.1… 7d0b549bd3ff3e55363dce19060797e1 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-nunit-1.1.13.8-2.15… f904919d8bb75ca477a580dc5483209d ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-web-1.1.13.8-2.15.x… 4c3d083e708e17e0747e98d605cf2445 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/mono-winforms-1.1.13.8-2… acfe0ccbdf408e2800b2410b7f7f38b6 Sources: openSUSE 10.2: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/mono-basic-1.1.18-9.1.src.r… 4d7e3741dccd7caa42bdc630dfe258fa ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/mono-core-1.1.18.1-12.2.src… 4165d9c7bfe3e9fe270a881a152d280a SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/mono-core-1.1.13.8-2.15.src… 24e736054c58c12f64133037a8cf2f10 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SUSE SLES 10 http://support.novell.com/techcenter/psdb/42c27df99955c5253c97cbbfb7b56d6f.… SLE SDK 10 http://support.novell.com/techcenter/psdb/42c27df99955c5253c97cbbfb7b56d6f.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/42c27df99955c5253c97cbbfb7b56d6f.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRZ0vLney5gA9JdPZAQK4Ugf/TSAR4VpHlgt7SYbQb4GEyqtR0O2pKU7D Eas6SE0Yirppo5hRf94r+hEs5dwXom/i3XW3IaFnahHR6tSuyUhevUErxYrAGKwp +e5+Pg9WpTKXODi/WXM+PDd97L5Bb1qpvJW42quJ6HvSJZfstI7YOwrnZw9gqXRO H68SbXV1Py2RUqphMhHBPKtu6DD9MKST+n7O8YV7guOBe8rQ3caw/tGJiq71gTwg HQVmun1rWfeuYuR9e1NeAJrXmFfzaFNQ6qfTXrDxGAGlj1MYa2tJEVrL92Mw26JD 34EvtQr+4c3Qg2PEJSHDDJ84O+4eXQJBw4xwDimt+G3h30D22egm/Q== =I+GN -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: OpenOffice_org WMF buffer overflows (SUSE-SA:2007:001)
by Marcus Meissner 04 Jan '07

04 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: OpenOffice_org Announcement ID: SUSE-SA:2007:001 Date: Thu, 04 Jan 2007 15:00:00 +0000 Affected Products: Novell Linux Desktop 9 SLE SDK 10 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SuSE Linux Desktop 1.0 SUSE SLED 10 Vulnerability Type: code execution Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2006-5870 Content of This Advisory: 1) Security Vulnerability Resolved: buffer overflows in WMF and Enhanced WMF handling Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion Security problems were fixed in the WMF and Enhanced WMF handling in OpenOffice_org These could potentially be used to execute code or crash OpenOffice when a user could be convinced to open specially crafted document (for instance a document sent by E-mail). This issue is tracked by the Mitre CVE ID CVE-2006-5870. openSUSE 10.2 is not affected by this problem, it already contains the fixed OpenOffice_org 2.1 version. Additionally the OpenOffice_org 2.0 version in SLED 10 was fitted with hooks to add OfficeXML support with a later update. Due to the very large size of this update and mirror lag it might take some hours or days until the updates are available on our mirrors. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Restart OpenOffice after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-2.0.2-27.15… fd03f46c3cb8bef62d6bc717183204e7 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-gnome-2.0.2… 36bd92eac9d3fd998998625d5f812858 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-kde-2.0.2-2… 54dc58b25ed418070f58288c1950d157 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-mono-2.0.2-… 0f89c73067b0a0bc7a387d59c5b0a83f ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-officebean-… fd487bb53472096452ae5fd9717c2743 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-2.0.0-… 7aa52e528b59faca90bf67fa6831724a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-af-2.0… 5252fe526c9c9f68e4ebc16218bfc2f0 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-ar-2.0… d491884acce7564aec4ea79601df15fa ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-be-BY-… 1ec60c221b4a62068ff15c89688c6f3e ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-bg-2.0… 9e985ceceee03a6ec5ac4914226d9d3a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-ca-2.0… 6b477a12871e48ffc5d867e4010ebd5d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-cs-2.0… e0751ca9a1fc33147a32472b65da4ed2 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-cy-2.0… 5fc86fc2b3d20c87e7d173ecc8e3e593 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-da-2.0… ecb32dd2c12a8f40f731c8e4a61daf7c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-de-2.0… 144617276d8e8037a05490529970800c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-el-2.0… f35a9300b2265bef11ae5bc645e70384 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-en-GB-… 113395204a868a6a569679322af534a0 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-es-2.0… 7cb6394676b090106d8209ee0bc325a3 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-et-2.0… 4e5b407d15d85aabe3e9e9bd324cd317 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-fi-2.0… f9f0301702937f0e632ef5c3b27618d7 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-fr-2.0… 7c1c99dd9d2cf8ddd76739b409e88494 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-galler… 4090e1c6a4ebee1360c71ee5693aab1b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-gnome-… c5ff202f2b5b6a0e535144536612eae0 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-gu-IN-… 77495fa38f85d6f962200092e6d513bb ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-hr-2.0… d6ca238f4470aff96b5efbde4b17176a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-hu-2.0… cb7feb287121fda60f94122bc32a0444 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-hunspe… d262f78b441f8e87293ea5a50a1e58a5 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-it-2.0… d3c3daeaf6cf06e546976352dc99af67 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-ja-2.0… e5a71e9be49f9680f59b1432e817c967 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-kde-2.… 50cd7d91aefeb6ec80bbb94e47aa67ba ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-ko-2.0… 835a4a8bca862f51d71d43f6256b2914 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-mono-2… d916428c9ca9218ead8aff4236cce5c2 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-nb-2.0… 02f56857fa91a306057d4fe95d79e77a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-nl-2.0… c57e39bd151725692051efa3bf0ee7ba ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-nn-2.0… 1b505a63f3e04e14d04f54ef01a4c594 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-office… a7e4016475dca64f9a99e5912d300cdd ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-pa-IN-… 57a82939688d779f5b69c3a305bafa9b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-pl-2.0… ce7b7c36d489a78620d7685c9ba77f4e ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-pt-2.0… 61f30a3a0432232c9ea86a5f9f0366a2 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-pt-BR-… 8f2a0e0dd358a3a358cabc3453e9f5be ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-ru-2.0… fe898d738217dfdced31e807a9140784 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-sk-2.0… 9c1a614619aa69627fa8bc9fa51ec4bd ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-sl-2.0… ea798171c407cb3ed1fd1347eea22a94 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-sv-2.0… 1373b5bd4d808691fcb5e8e13ac56005 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-tr-2.0… 64ca9735287b612d5e9bc858ddd82679 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-vi-2.0… d927cd43fd2301c19748be4496f20349 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-xh-2.0… cadf70db30ba45ac1a365fe318a6997a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-zh-CN-… 378b2ec63021b7fce007ac270f33d3f3 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-zh-TW-… 0a096ef4bb51369ea76e496e4d00b05b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/OpenOffice_org-zu-2.0… 891de62d7740fe3479bec3d4d9e2293e SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-1.1.3-… 589951f886a3b8a71af962a440e2d5d7 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-ar-1.1… e035689819add5a79cac86c080107591 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-ca-1.1… 440b7b8abf1e26a7e1ac94bad2159fa1 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-cs-1.1… 53346bde2f7c7a61ea9e33faa9c725a7 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-da-1.1… dae5b0bf3d98f9691f1e8d8d167547ce ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-de-1.1… 16c6aa50e44a585147fcf1494caacd29 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-el-1.1… 9d289713e0104cda3bd06b5f9f5d378c ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-en-1.1… 8cf58c072f67152ba542d03b7659af78 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-es-1.1… b275c33d9881de79e8df9a060b7d846d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-et-1.1… 82dc46d3679a4cbed5d3b56f400bd0bb ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-fi-1.1… e7d5bdc9e0faf758917d08c46e303a9e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-fr-1.1… 0f4a918a9f6e7d33260a238cb8fc5f22 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-gnome-… 5826669ac9581afff84470dfa3a772f1 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-hu-1.1… f40b061176334959bc25d4a5e015f543 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-it-1.1… a331919c158b3ea676dafed45754fb8f ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-ja-1.1… 16d77dd832360590ed456940b45e3279 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-kde-1.… 244053050edc83cf5f1cb35836feb956 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-ko-1.1… 0289dc7444bb236959c68814227c1aab ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-nl-1.1… 5dfc28ff432aaa352178b228e26d6797 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-pl-1.1… 9c898ed84206f5653f8a19bc9abed974 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-pt-1.1… bae59314219a654dd3d197270a4cd89d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-ru-1.1… b96857f0c6c8064fcefe41c3499ec16c ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-sk-1.1… 19587fd04412b2a6815eb3d5516178dc ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-sl-1.1… 97c4d1521086521c66e97aa37a795952 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-sv-1.1… a95c6151cb2d29e1e30cc9b9f0b3ab5c ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-tr-1.1… d4cb3dda4d2a77c306f2d2e1eebca7d8 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-zh-CN-… 123313c1d70234d0224c357c3454023d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/OpenOffice_org1-zh-TW-… 8aaadec1d3220f793bc6e66ad4293050 Power PC Platform: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-2.0.2-27.15.… 47475bcf3d13d3fe4e03a245de77299a ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-gnome-2.0.2-… fdcf3ab9522f5d931ab45aa361d39a71 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-kde-2.0.2-27… c69710053fee5f830ffa0fe276237db4 ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-mono-2.0.2-2… d6ce3d25640cc1ddbd04969a72601eea ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-officebean-2… 7fba6800f065447114d6435e96a0d799 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-2.0.0-1… 75763dce1d1a4705cb22b261ba5d3260 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-af-2.0.… 1b129691c1ece1cdcf7d41fe90ab26ec ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-ar-2.0.… ce359d45fd6e73860f5b95c759667483 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-be-BY-2… 737edb9a51e2308b65c806db18eb8e38 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-bg-2.0.… ab9b0121f51f6cb695c3a698da732d85 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-ca-2.0.… 262468c5a4b4681147c6ce26d5ef63ca ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-cs-2.0.… 1528bd884d1d178ac48a65658f54f67e ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-cy-2.0.… 26fb36e224f72e01dfd850982c10e842 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-da-2.0.… 6b434d5882776a0b0aa832d764756030 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-de-2.0.… bcdb3136e83d9c86d3714bd63b1627a3 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-el-2.0.… 23a8b36d116bdfdb70868468d3a1a104 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-en-GB-2… 3d2d276b47fab13ab328f20fcc51efa6 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-es-2.0.… 90dac95b1346bf9e91642365777e592b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-et-2.0.… e981a11acd19a1dbfe0d4336f0b8ff7a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-fi-2.0.… e234e2cff42a2687dae123bc62eb604d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-fr-2.0.… fac1261ab2a6f4cb68b3893437c257b8 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-galleri… b485220c5d75535ebd68d2458d05c328 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-gnome-2… f619a868c8f67593b12b6403046970fd ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-gu-IN-2… 7e3c98a3926337ab392c8f044f4e1d11 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-hr-2.0.… 4bd3ba3ba25476548e020b8ec970a6f5 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-hu-2.0.… 5e51bd0e338676d2f883aa76ce4d00e8 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-hunspel… dd7f560e51e96e6a3a6e448f5658d8bb ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-it-2.0.… 4d037c6a9f237cadf99f3e8a88fa224a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-ja-2.0.… 4044cd5fd5995b38f2ddc2032b3675c4 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-kde-2.0… 7e82c539eede13763365ddfeb9739d24 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-ko-2.0.… 8e7a9b881392d2b12cc84b2cab9a19e4 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-mono-2.… 95028076b7fbbaccdee76d65b616fbdc ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-nb-2.0.… d7bead9618b82987401bfee42d1b5ac7 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-nl-2.0.… 3f8847780643b48c43c556b036661c45 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-nn-2.0.… 2f43aacccf2e861b2781dea0d23a4308 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-officeb… 1b3748db1855e5946d8c62243261c927 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-pa-IN-2… 37489ea414dc7def0ef1dd52097a7974 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-pl-2.0.… 4bb114f9b8b3e09fe772bbba0962e13c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-pt-2.0.… 0b1f1f1712c0607556ab5acafbe4a379 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-pt-BR-2… e32e6c3a20ebc46ecac41031d4294847 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-ru-2.0.… 7d723cba896f9f3189b01e2e7173a08c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-sk-2.0.… 7b5b3c7d748ab396d541ac7daaa56896 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-sl-2.0.… 890f3a37ea44ad44a65bca00949a0c00 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-sv-2.0.… 773f47069a7eb2084a6c6a40ecc04814 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-tr-2.0.… 5078bca7a5184827009f569924ada80a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-vi-2.0.… ec364edf19438461e9fdf308b260b4a6 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-xh-2.0.… 22d0387a1b523ac61f06ade13618e979 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-zh-CN-2… d68bf26b23896890e38d4ea30d10813d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-zh-TW-2… acc180374ade9fd27ed844f58576fa7b ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/OpenOffice_org-zu-2.0.… 7b4a3590b94bfbb70b316dc62dac28f6 Sources: SUSE LINUX 10.1: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/OpenOffice_org-2.0.2-27.15.… fe0ad3c361d857bc7504bf2215ae8948 SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/OpenOffice_org-2.0.0-1… e214e34e63fc0631959d452597025514 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/OpenOffice_org1-1.1.3-4… 66f134cb40880d6ee219c8c1a01c1a5b Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SLE SDK 10 http://support.novell.com/techcenter/psdb/5de7a5faac735ff75aae048d9aeaa21f.… SUSE SLED 10 http://support.novell.com/techcenter/psdb/5de7a5faac735ff75aae048d9aeaa21f.… Novell Linux Desktop 9 http://support.novell.com/techcenter/psdb/b38ccbe0fb2200869a3553e136fde4f2.… SuSE Linux Desktop 1.0 http://support.novell.com/techcenter/psdb/b38ccbe0fb2200869a3553e136fde4f2.… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBRZ0Hiney5gA9JdPZAQIt2QgAnPR0ULJsL2Nw+czxXDTmXC+kFdUU0eua 8j0LLIbl/DfqiDLRGxQ1QEn3I54jTva06G5Z/Jzr4YRKyLurZopjK9XmVJxiw/SW GXxmnmywL3+mXmbOKN76CpevgSDw33y35kGBk1nfFLCl3OhLYz1PBvLvK9DayS/r E1xA/2yiXtccVA6HmI8IWkvNGiE5uvQn4qJSXleXofT1SWIvcRugHchcA74inGg2 okMdEs+t6zSKMRkX9Z9atBa3KbKCAdgq8xFChNP0jqNS1JzG8Gt+Kud2itQK49oN kqH9JS3ypTNEjx1nyup7g084I6StqvfPeLpiIRgQ+cWj1OIghrYz1w== =uggf -----END PGP SIGNATURE-----

1 0