- openSUSE Security Announce

SUSE Security Announcement: kernel various security and bugfixes (SUSE-SA:2005:067)
by Marcus Meissner 06 Dec '05

06 Dec '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: kernel Announcement ID: SUSE-SA:2005:067 Date: Tue, 06 Dec 2005 13:00:00 +0000 Affected Products: SUSE LINUX 10.0 Vulnerability Type: denial of service Severity (1-10): 6 SUSE Default Package: yes Cross-References: CVE-2005-2973, CVE-2005-3044, CVE-2005-3055 CVE-2005-3180, CVE-2005-3181, CVE-2005-3271 CVE-2005-3527, CVE-2005-3783, CVE-2005-3784 CVE-2005-3805, CVE-2005-3806, CVE-2005-3807 Content of This Advisory: 1) Security Vulnerability Resolved: Various security fixes, bugfixes and a XEN update Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This kernel update for SUSE Linux 10.0 contains fixes for XEN, various security fixes and bug fixes. CVE-200n-nnnn numbers refer to Mitre CVE IDs (http://cve.mitre.org/) This update includes a more recent snapshot of the upcoming XEN 3.0. Many bugs have been fixed. Stability for x86_64 has been improved. Stability has been improved for SMP, and now both i586 and x86_64 kernels are built with SMP support. This update contains the following security fixes: - CVE-2005-3783: A check in ptrace(2) handling that finds out if a process is attaching to itself was incorrect and could be used by a local attacker to crash the machine. - CVE-2005-3784: A check in reaping of terminating child processes did not consider ptrace(2) attached processes and would leave a ptrace reference dangling. This could lead to a local user being able to crash the machine. - CVE-2005-3271: A task leak problem when releasing POSIX timers was fixed. This could lead to local users causing a local denial of service by exhausting system memory. - CVE-2005-3805: A locking problem in POSIX timer handling could be used by a local attacker on a SMP system to deadlock the machine. - CVE-2005-3181: A problem in the Linux auditing code could lead to a memory leak which finally could exhaust system memory of a machine. - CVE-2005-2973: An infinite loop in the IPv6 UDP loopback handling can be easily triggered by a local user and lead to a denial of service. - CVE-2005-3806: A bug in IPv6 flow label handling code could be used by a local attacker to free non-allocated memory and in turn corrupt kernel memory and likely crash the machine. - CVE-2005-3807: A memory kernel leak in VFS lease handling can exhaust the machine memory and so cause a local denial of service. This is seen in regular Samba use and could also be triggered by local attackers. - CVE-2005-3055: Unplugging an user space controlled USB device with an URB pending in user space could crash the kernel. This can be easily triggered by local attacker. - CVE-2005-3180: Fixed incorrect padding in Orinoco wireless driver, which could expose kernel data to the air. - CVE-2005-3044: Missing sockfd_put() calls in routing_ioctl() leaked file handles which in turn could exhaust system memory. - CVE-2005-3527: A race condition in do_coredump in signal.c allows local users to cause a denial of service (machine hang) by triggering a core dump in one thread while another thread has a pending SIGSTOP. Additionally the following non security bugs were fixed: - Fix NFS cache consistency races which could lead to data corruption and crashes. - A kernel panic when loading the r8169 module without powermanagment was fixed. - i386: A race condition in the power management module powernow-k8 was fixed. - Special ELF binaries without DATA and BSS segments could not be loaded due to too strict kernel checks. - Various bugs in the ALSA sound system were fixed. - A problem in IPv6 initialization with IPv6 disabled by policy that could leave dangling kernel pointers around was fixed. - Added sis 965l support to the sis5513 ide driver. - Disabled C2/C3 power management states on all IBM R40e BIOSes. - Fixed machine crash when switching the io-scheduler away from CFQ. - Call reboot notifiers of power off to switch off certain machines. - AMD64: Don't use TSC for time keeping on AMD single socket dual core systems. - Fixed the "treason uncloaked" kernel messages that were caused by a stale pred_flags variable when the TCP snd_wnd changes. - USB floppy drive SAMSUNG SFD-321U/EP was detected 8 times. - CONFIG_ACPI_HOTKEY is not supportable yet according to Intel, so we disabled it. - Disable ACPI on machines from before 2001 on all kernels again. - USB: always export interface information for modalias. - Various iSCSI fixes. - Avoid a potential fs corruption on SMP systems. - i386: Increased number of CONFIG_SERIAL_8250_NR_UARTS to 8. - Fixed a data corruption in the MD device driver when the delayed recovery is interrupted. - ahci: Don't set SActive for non-NCQ commands. This could have left the LED burning even for inactivity. - ppc: Handle GCC 4 generated relocations for 32bit memory access in the module loader. - ppc: Removed a special case for ppc to use MAC from prom if CSR is corrupt - CIFS: Made cifsd (kernel daemon for the CIFS filesystem) suspend aware. - Fixed ACPI issues on an ASUS L5D. - IDE: Worked around power management problems. - Disable AMD TLB flush filter on i386/x86-64 (might help 3d drivers) - Quiet down capacity reading from IDE CD when no media inserted. - ACPI: Worked around undefined ZOO* objects on certain Acer Aspire notebooks. - ACPI: Fixed Oops on pcc_acpi unloading. - ACPI: Fix hang in ACPI device scan on certain HP nx Laptops. - Fixed a bug in ACL handling of tmpfs. - Fix time going twice as fast problem on ATI Xpress chip sets. 2) Solution or Work-Around None, please install the fixed packages. 3) Special Instructions and Notes SPECIAL INSTALLATION INSTRUCTIONS ================================= The following paragraphs guide you through the installation process in a step-by-step fashion. The character sequence "****" marks the beginning of a new paragraph. In some cases, the steps outlined in a particular paragraph may or may not be applicable to your situation. Therefore, make sure that you read through all of the steps below before attempting any of these procedures. All of the commands that need to be executed must be run as the superuser 'root'. Each step relies on the steps before it to complete successfully. **** Step 1: Determine the needed kernel type. Use the following command to determine which kind of kernel is installed on your system: rpm -qf --qf '%{name}\n' /boot/vmlinuz **** Step 2: Download the packages for your system. Download the kernel RPM package for your distribution with the name indicated by Step 1. Starting from SUSE LINUX 9.2, kernel modules that are not free were moved to a separate package with the suffix '-nongpl' in its name. Download that package as well if you rely on hardware that requires non-free drivers, such as some ISDN adapters. The list of all kernel RPM packages is appended below. The kernel-source package does not contain a binary kernel in bootable form. Instead, it contains the sources that correspond with the binary kernel RPM packages. This package is required to build third party add-on modules. **** Step 3: Verify authenticity of the packages. Verify the authenticity of the kernel RPM package using the methods as listed in Section 6 of this SUSE Security Announcement. **** Step 4: Installing your kernel rpm package. Install the rpm package that you have downloaded in Step 2 with the command rpm -Uhv <FILE> replacing <FILE> with the filename of the RPM package downloaded. Warning: After performing this step, your system may not boot unless the following steps have been followed completely. **** Step 5: Configuring and creating the initrd. The initrd is a RAM disk that is loaded into the memory of your system together with the kernel boot image by the boot loader. The kernel uses the content of this RAM disk to execute commands that must be run before the kernel can mount its root file system. The initrd is typically used to load hard disk controller drivers and file system modules. The variable INITRD_MODULES in /etc/sysconfig/kernel determines which kernel modules are loaded in the initrd. After a new kernel rpm has been installed, the initrd must be recreated to include the updated kernel modules. Usually this happens automatically when installing the kernel rpm. If creating the initrd fails for some reason, manually run the command /sbin/mkinitrd **** Step 6: Update the boot loader, if necessary. Depending on your software configuration, you either have the LILO or GRUB boot loader installed and initialized on your system. Use the command grep LOADER_TYPE /etc/sysconfig/bootloader to find out which boot loader is configured. The GRUB boot loader does not require any further action after a new kernel has been installed. You may proceed to the next step if you are using GRUB. If you use the LILO boot loader, lilo must be run to reinitialize the boot sector of the hard disk. Usually this happens automatically when installing the kernel RPM. In case this step fails, run the command /sbin/lilo Warning: An improperly installed boot loader will render your system unbootable. **** Step 7: Reboot. If all of the steps above have been successfully completed on your system, the new kernel including the kernel modules and the initrd are ready to boot. The system needs to be rebooted for the changes to be active. Make sure that all steps have been completed then reboot using the command /sbin/shutdown -r now Your system will now shut down and restart with the new kernel. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/Intel-536ep-4.69-14.2… 02d032c2a4e43516e382faa1c38593ff ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-bigsmp-2.6.13-… 16ebf82f7f0eb76a7e95239a7748bd49 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-bigsmp-nongpl-… 5efbba52b5b452ee68770c234d1c4206 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-default-2.6.13… 201dd3f4f090b01034c2706860a2ded1 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-default-nongpl… 890a9500a671e62c872a316094c976fc ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-smp-2.6.13-15.… 3824bd72e5e38f170a1f53cdf12b7936 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-smp-nongpl-2.6… f1d4ca38c6f19b92a3ec2bdc4ee55ab7 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-source-2.6.13-… 444382d73c4ea88144b58155032f3979 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-syms-2.6.13-15… 88ddaf01d3cdfc2a02f40c246f27a03f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-um-2.6.13-15.7… 4a4282db387b1a50b7f0d8358811955c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-um-nongpl-2.6.… fd64850adff5fc8fab2a807afc07bac0 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-xen-2.6.13-15.… ec1ccdf16b4c2eadd789871e5bda3361 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/kernel-xen-nongpl-2.6… ad5b17a6998f04832d29f189a5f42240 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/um-host-kernel-2.6.13… 1ed3738e413c0df9a131989560effb85 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-3.0_7608-2.1.i586… dafe91eab2d6fbe749693373a561609d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-devel-3.0_7608-2.… 8a20190de6fef952115623503b2149f9 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-doc-html-3.0_7608… 1c27687f9f9482c72fdf300c64d0db4f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-doc-pdf-3.0_7608-… 356c1d14e0873344b8789e6bf36b94e2 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-doc-ps-3.0_7608-2… 7b9066e6834db4b1eb5505d089830714 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-tools-3.0_7608-2.… 43b7333eea6e0e52ce2cb9431a9d3627 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xen-tools-ioemu-3.0_7… f8d51a8b0119ea984317cad976ca16d5 Power PC Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/kernel-default-2.6.13-… b5b4e1ad4db39e8bede52cd0f171c508 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/kernel-iseries64-2.6.1… a7fbffd1f09d4e6c9a58950fe1692361 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/kernel-ppc64-2.6.13-15… a09e0b94d50c24ea8065b709ccb53775 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/kernel-source-2.6.13-1… ae4c7ad291aaa37dceb43e331651b2c4 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/kernel-syms-2.6.13-15.… 51ddc5ea24587d210edb3e249b0472c9 x86-64 Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-default-2.6.… ae11f5ccb7e1f96d9cb38444d1ae770f ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-default-nong… a2f3716cc423c87b8f7505629c13716a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-smp-2.6.13-1… 0899d5b37db71c18ac4d7733189388bd ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-smp-nongpl-2… 108a43a7e5386d1f2b098e31f9299ec1 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-source-2.6.1… 94f28fdcbeff5b02c95da380808a0347 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-syms-2.6.13-… 2d106be84319cdf38210076c4113a95a ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-xen-2.6.13-1… 58f4740f9538a21e9e187c751a58a376 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/kernel-xen-nongpl-2… 3c8a4dd3378a988c79675f9a84a2969c ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-3.0_7608-2.1.x8… 7595b44074a3d8cc51288e9473c81e0d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-devel-3.0_7608-… 135cc2d6855f10518bbf6555405dd63d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-doc-html-3.0_76… 481e6f688096bb367c35a67fb2185504 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-doc-pdf-3.0_760… 7f67dd3c63742fb07f424ff7cd1f87b3 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-doc-ps-3.0_7608… e768c5066b488a556496574bccbda414 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-tools-3.0_7608-… 118c0e872deb66309fc9c6957969bad4 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xen-tools-ioemu-3.0… 00ecbc085cb200937224d8a2bbda3ec7 Sources: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/Intel-536ep-4.69-14.2.… c4ee0c5893efbde6ecf45f0da05e5103 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/kernel-source-2.6.13-1… 56dd71a804ebcaa1eb8268665dfa2b18 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/xen-3.0_7608-2.1.src.r… 3571ce3e27ca472bffc2f2794eeae8a0 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ), send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ5V3B3ey5gA9JdPZAQJZkgf9HaTAuew58a6H/AoTc4ukxp23L6UI1moZ 4Z7kZRTE/+BTK54QAyAswj9ad428jBJeVJC1tsIfP/vaZhl4nJ3ML99lPJHt2FBq 3qsuQgK2aXxCR1UlURlUPR6NWeXvHxIY3LBdW+ngQRYKNASkB2AZ9az0Z771OaTx lIAa2KQMFP9lAyftLFlkfqcZI9zewCqAy5r657koyv2SjPdNaK0O8dtW+kX35LvF x9AgxJCSJgtEf7ZOGXsHmvcFaoHftiy6S21ddgzNHLPEGCZg54yAMDVyR2TT0kWs ml/91KJTIvuVb0wssECS9cJhIvOlNyrY3wEbUk5xwT6SbGnMX2et8Q== =XMU5 -----END PGP SIGNATURE-----

1 0

SUSE Security Summary Report SUSE-SR:2005:028
by Marcus Meissner 02 Dec '05

02 Dec '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2005:028 Date: Fri, 02 Dec 2005 15:00:00 +0000 Cross-References: CVE-2005-2869, CVE-2005-2970, CVE-2005-3123 CVE-2005-3256, CVE-2005-3300, CVE-2005-3301 CVE-2005-3322, CVE-2005-3349, CVE-2005-3354 CVE-2005-3355, CVE-2005-3424, CVE-2005-3425 CVE-2005-3621, CVE-2005-3632, CVE-2005-3662 CVE-2005-3737, CVE-2005-3750 Content of this advisory: 1) Solved Security Vulnerabilities: - netpbm various buffer overflows - opera remote execution - inkscape svg importer buffer overflow - apache2-worker memory leak - mozilla-mail enigmail encryption problem - sylpheed-claws buffer overflow in import plugins - phpMyAdmin various problems - gnump3d various problems - squid crashes - php4 / php5 security update broken 2) Pending Vulnerabilities, Solutions, and Work-Arounds: - Kernel updates 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - netpbm various buffer overflows This update fixes a buffer overflow in the RGBA-palette code. This bug can be abused to trigger a denial-or-service attack by feeding untrusted data to "pnmtopng -alpha" (maybe via a remote service like a CGI, MUA, etc.). The execution of arbitrary code is theoretically possible but very unlikely. Another possible buffer overflow that can occur while handling a text line was fixed too. This is tracked by the Mitre CVE ID CVE-2005-3632 and CVE-2005-3662. All SUSE Linux based products are affected. - opera remote execution The Opera web browser was updated to version 8.51, fixing the following security problem: Insufficient quoting of shell meta characters in the opera start script allowed to execute arbitrary commands if URLs with such characters were passed to the script (CVE-2005-3750). We released this update two times for SUSE Linux 9.x, the first time the update was broken due to libstdc++ dependency problems, the second update, released Thursday, fixes this breakage. SUSE Linux 9.0 up to 10.0 are affected. - inkscape svg importer buffer overflow A buffer overflow in the SVG importer of inkscape could potentially be exploited to execute arbitrary code when opening a crafted SVG file. This is tracked by the Mitre CVE ID CVE-2005-3737. SUSE Linux 9.2 up to 10.0 are affected by this problem. - apache2-worker memory leak A memory leak in apache2-worker that allowed remote attackers to exhaust all available memory was fixed. This is tracked by the Mitre CVE ID CVE-2005-2970. All SUSE Linux based products containing apache2-worker were affected. - mozilla-mail enigmail encryption problem Upon sending an encrypted mail the Mozilla Mail plugin enigmail could accidentally encrypt it for the wrong recipient. During QA of the update it was found that in various older distributions the plugin is not functional at all (and so not affected). This issue is tracked by the Mitre CVE ID CVE-2005-3256. The problem affects all SUSE Linux based products containing Mozilla. - sylpheed-claws buffer overflow in import plugins Buffer overflows in various address book import filters of Sylpheed/Sylpheed-Claws was fixed. This is tracked by the Mitre CVE ID CVE-2005-3354. SUSE Linux 9.0 up to 10.0 were affected by this problem. - phpMyAdmin various problems phpMyAdmin was updated to fix several security problems: - Multiple cross-site scripting (XSS) bugs (CVE-2005-3301, CVE-2005-2869, PMASA-2005-5). - Multiple file inclusion vulnerabilities that allowed an attacker to include arbitrary files (CVE-2005-3300, CVE-2005-3301, PMASA-2005-5). - A bug that could lead to 'HTTP response splitting' (CVE-2005-3621, PMASA-2005-6). Exploits for this have been seen in the wild. SUSE Linux 9.0 up to 10.0 are affected. - gnump3d various problems The MP3 streaming server gnump3d was updated to fixes the following security problems: - Several cross-site-scripting bugs (CVE-2005-3424, CVE-2005-3425) - Insecure use of files in /tmp (CVE-2005-3349) - Several directory-traversal bugs (CVE-2005-3123, CVE-2005-3355) - Squid crashes This update of Squid in SUSE Linux 9.0 fixes some bugs that lead to crashes. This bugs were introduced by a previous security-update (SUSE-SA:2005:053). Please note that this is a version upgrade so you should do the following steps: - delete the old cache - adapt the configuration file to new options - "clientProcessHit: Vary object loop!" message can be ignored Only SUSE Linux 9.0 is affected. The issue is tracked by the Mitre CVE ID CVE-2005-3322. - php4 / php5 security update broken We released a security update for PHP 4 and PHP 5 for all SUSE Linux based products. This update is broken when PHP applications are used together with the Apache "mod_rewrite" module. We are working on a fix for this problem and will release updated fixed packages as soon as possible. ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds - Kernel updates We are currently preparing kernel security and bugfix updates for all our products. The first to be released will be a SUSE Linux 10.0 kernel update next week, followed by updates for the other distributions. The updates will be separately announced. ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ) send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ5BW1Hey5gA9JdPZAQKhGQgAkCMTy1JXGMGmC3rzVZ3ltF6mhjT+EIPD OuqPidkuT/itrRcVSxigiuIi5o1jdJbvFmhM8a0i9FWkWp7wK8Cz9g7gQwULLa7j zrH13kEw+mY50J7yfGCPHb4GRMATc5rJKufpq2tvsRy3DFSIKzFLi90IOMPUmlfs Klb1byUA1UI2x+Uej7KU7ZvtpaG8dRmQJ0mHSvXbjPnqS8WRGI1lmZcJKrG4JvqJ 7VxflT82DMj4wFM1QylaPhLoAwxIQ4GXKIPOkktBEL7TiueE6fvYY1B9iMiMJDYx JGjxGDgY64iA9BM7nLZdmaVMiKG3hQ9P24Z4rOYaYaICLQrvzZ/jGQ== =8UiQ -----END PGP SIGNATURE-----

1 0

SUSE Security Summary Report SUSE-SR-2005:027
by Marcus Meissner 18 Nov '05

18 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2005:027 Date: Fri, 11 Nov 2005 15:00:00 +0000 Cross-References: CVE-2005-2628, CVE-2005-2917, CVE-2005-2958 CVE-2005-3122, CVE-2005-3123, CVE-2005-3167 CVE-2005-3258, CVE-2005-3351, CVE-2005-3388 CVE-2005-3389, CVE-2005-3390, CVE-2005-3523 Content of this advisory: 1) Solved Security Vulnerabilities: - libdga format string problem - flash-player buffer overflow - gpsdrive format string problem - squid various denial of service attacks - spamassassin denial of service - mediawiki cross site scripting attack - zope potential remote code execution 2) Pending Vulnerabilities, Solutions, and Work-Arounds: - php4,php5 - gnump3d various problems 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - libdga format string problem libgda contains two format string bugs in logging routines. Those bugs could potentially indirectly lead to arbitrary code execution via applications that link against libgda and supply data to libgda (CVE-2005-2958). All SUSE LINUX products and SLES9 were affected. - flash-player buffer overflow flash-player has been updated to version 7.0.25 to fix a buffer overflow (CVE-2005-2628). Only SUSE Linux 9.0 and 9.1 are affected by this problem. - gpsdrive format string problem gpsdrive was updated to fix the following security problem: A format string bug in friendsd2 allowed an attacker to execute arbitrary code (CVE-2005-3523). This affects SUSE Linux 9.0 up to 10.0. - squid various denial of service attacks Two denial of service attacks against the web proxy Squid were fixed: - A bug in the NTLM authentication could crash Squid (CVE-2005-2917) - Odd replies of FTP servers could crash Squid (CVE-2005-3258) This affects all SUSE Linux based products including Squid. - spamassassin denial of service The spam detection program spamassassin could be crashed by a very long recipient lists in a mail's "To:" header. This is tracked by the Mitre CVE ID CVE-2005-3351. Only SUSE Linux 9.2 up to 10.0 are affected by this problem. - mediawiki cross site scripting attack MediaWiki was updated to fix the following security problem: Unsafe handling of CSS by Microsoft Internet Explorer could be exploited to produce cross-site scripting attacks via Javascript injection to clients running that browser (CVE-2005-3167). This problem affects SUSE Linux 9.3 and 10.0. - zope potential remote code execution The content management system Zope has been updated to fix the following security problem: Zope honors file inclusion directives in RestructuredText objects which potentially allowed attackers to execute arbitrary code (Zope Hotfix 2005-10-09). This is tracked by the Mitre CVE ID CVE-2005-3323. All SUSE Linux versions including Zope are affected by this problem. ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds - php4,php5 Stefan Esser discovered a cross-site scripting bug in the phpinfo() function (CVE-2005-3388), a bug that allows an attacker to enable register_globals (CVE-2005-3389) and a bug that allows an attacker to overwrite the $GLOBALS array (CVE-2005-3390). We are preparing updates for these issues. All SUSE LINUX based products are affected. - gnump3d various problems Steve Kemp discovered a cross-site scripting bug (CVE-2005-3122) and a directory traversal bug (CVE-2005-3123) in gnump3d. We are preparing updates for these issues. All SUSE LINUX products are affected. ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ) send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ33tm3ey5gA9JdPZAQKwVAf/Spcex0ORga71BbBzBaJ0G8kP2Y379YZx zu6Xzami018Wz90VnnUFOUTGUQ7wNkiosLTqaqYw90gfAMey86OZV3//r7996R35 SavbTJiVGF84Iwr1DhiEY07mZVl6sGU6BrG7OFlaYcr5gOIVaM/JoCW1lmFz8NNT WN1XricKZgnDNslnXmQucMfpDVj45wuc/vVvlI6SA0GVHcoDDx+RUSCe81wz8KWb 363n8bdqbbYRSzqMsTcDEKV3EaiKpd9EdH7QUwCtnoW9Qqi4niglwZFoV+qxlEz1 5G1OT7aT8CH7eCOLBGbDJd86Hq8tVYXVcyFIHoIC9odLDVd2JYf6kA== =byFT -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: phpMyAdmin remote code execution (SUSE-SA:2005:066)
by Marcus Meissner 18 Nov '05

18 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: phpMyAdmin Announcement ID: SUSE-SA:2005:066 Date: Fri, 18 Nov 2005 11:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SuSE Linux 9.0 Vulnerability Type: remote code execution Severity (1-10): 7 SUSE Default Package: no Cross-References: CVE-2005-2869, CVE-2005-3300, CVE-2005-3301 PMASA-2005-5 Content of This Advisory: 1) Security Vulnerability Resolved: multiple security problems in phpMyAdmin Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The MySQL configuration frontend phpMyAdmin was updated to fix the following security problems which can be remotely exploited: - Multiple cross-site scripting (XSS) bugs (CVE-2005-3301, CVE-2005-2869, PMASA-2005-5). - Multiple file inclusion vulnerabilities that allowed an attacker to include arbitrary files (CVE-2005-3300, CVE-2005-3301, PMASA-2005-5). 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. Platform Independent: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/noarch/phpMyAdmin-2.6.3pl1… 98fb372df6fbb616bbc3352ed83db7e8 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/noarch/phpMyAdmin-2.6.1pl3-… 99149187c8d0a9b6cbe144723bbcbc4c SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/noarch/phpMyAdmin-2.6.0-4.1… 00db8b743c780dbc730356097a4f163a SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/noarch/phpMyAdmin-2.5.6-34.… d101d0e68c49a9ed2dd2c4358ff87104 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/noarch/phpMyAdmin-2.5.6-3… 74d37eba2dfc928700a573402c0dfc2e SuSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/noarch/phpMyAdmin-2.5.3-41.… 8af75dcd104b8be4bf77e0bb5c1f116d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/noarch/phpMyAdmin-2.5.3-4… 1f2ef8a90a212d99603a866a453dfb04 Sources: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/phpMyAdmin-2.6.3pl1-3.… cdd5526c185af3651bef319950f80a7d SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/phpMyAdmin-2.6.1pl3-4.6… 04e009aa9015d37315c557e7599ff163 SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/phpMyAdmin-2.6.0-4.11.s… 30e6770d3d70799aa069c2d936c19eac SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/phpMyAdmin-2.5.6-34.11.… 4d5fe0f490d25245c029e1da7b04ee56 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/phpMyAdmin-2.5.6-34.1… e1935f0f2aba552f18d028110ddd52d9 SuSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/phpMyAdmin-2.5.3-41.src… 8ae59fb9f3be6cc23581746f6c2be7fb ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/phpMyAdmin-2.5.3-41.s… ff8032bcc6bc197780a74b18fdb4ac5d ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ), send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ33YlHey5gA9JdPZAQIX7ggAnvtNOUvhmh6Ko8XcozSHQZsvuJ5+yTvQ vY03RJUNsrER2htR4uisP1LHuqpWIEkndfbhaQ/+xzjl37S6o+R5pmXp5ylRzgJD //qH8DzhneAJBLu+Jj/y2/tHCq0K0EOyOsKPR8vvFI1RX+hnHVgwpYJE88zbCvTi b/askSurVZlCPpFX83wU9/x+KOJdP0IMDkjxWSXG17jo17vH7QUXxGLHiyfaxLy/ 4dXGj34k1yk3boEf+MqiKdfG7c6tGz5ME9oMtqcKA7xx8qKpqt2LQYU7qhg3geeU STLuIFyuNVqQCNP2J/diU20/uvSwt73aOOTMxKu//zNgtezPpiJA+Q== =zJX+ -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: gdk-pixbuf, gtk2 (SUSE-SA:2005:065)
by Thomas Biege 16 Nov '05

16 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: gtk2, gdk-pixbuf Announcement ID: SUSE-SA:2005:065 Date: Wed, 16 Nov 2005 13:23:50 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SuSE Linux 9.0 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 SUSE SLES 9 UnitedLinux 1.0 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE Default Package: yes Cross-References: CVE-2005-3186 CVE-2005-2976 CVE-2005-2975 Content of This Advisory: 1) Security Vulnerability Resolved: - buffer overflow - integer overflow - infinite loop Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The image loading library of the gdk-pixbug/gtk2 package is vulnerable to several security-related bugs. This makes every application (mostly GNOME applications) which is linked against this library vulnerable too. A carefully crafted XPM file can be used to execute arbitrary code while processing the image file. (CVE-2005-3186) Additionally Ludwig Nussel from the SuSE Security-Team discovered an integer overflow bug that can be used to execute arbitray code too (CVE-2005-2976), and an infinite loop which leads to a denial-of-service bug. (CVE-2005-2975) 2) Solution or Work-Around none 3) Special Instructions and Notes Please restart your system to make the update completely effective. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: SUSE Linux 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-2.8.3-4.3.i586.r… 0be068d079c58cbbaaa52e80820e6c6e ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-devel-2.8.3-4.3.… f6b37ad46fdd2ef2e7e2fc0e0e7598b1 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-0.22.0-72.… a3ed5aec0eb8a110af839d91468d2790 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-devel-0.22… c1981e12a87989d8ccab4d91418a6310 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-2.8.3-4.3.i586.p… f5fb1c48e841a15b4194f196bde2ff10 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-devel-2.8.3-4.3.… 9e94e889694c900d46b02ef6c22ba5e4 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-0.22.0-72.… 64d3bee622ee73b5ac50dbf73e65f526 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-devel-0.22… c431dc98c53e4b9a000822ab311e7b0a source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/gtk2-2.8.3-4.3.src.rpm f827e0f9da7d988d03098559119ac2d7 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/gdk-pixbuf-0.22.0-72.3… 87e193dc3dce8969f47d6772e10b6e3a SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-2.6.4-6.3.i586.rpm e7e6dceafe5a32ebab7a5b8a57661f87 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-devel-2.6.4-6.3.i… 9f4c9d44adb7756dc7c458f266da7420 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-0.22.0-67.3… b30948d644cc33444b5f03eeb3bca654 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-devel-0.22.… d515f01e0bb2292d647c04234b4c836a patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-2.6.4-6.3.i586.pa… 0439cde8222d72a9c1c46de79c609669 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-devel-2.6.4-6.3.i… b9e5a1af3a8ad50879ae2339643b6953 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-0.22.0-67.3… 42f9f1212c01aa7e866197f921646d79 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-devel-0.22.… da1f519c5e1b46cbf99a8eace632301f source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/gtk2-2.6.4-6.3.src.rpm 6b7e57bea2b48ae3a7bfcc6378cdb7fe ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/gdk-pixbuf-0.22.0-67.3.… d546d4e4ca0401b3d530f3263a83639d SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-2.4.9-10.3.i586.r… eea4e22113af4911766b88fb5afff990 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-devel-2.4.9-10.3.… f9bccebbdbc4951ba929c0b3bdd5e748 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-0.22.0-64.3… 2f51e4f26ac2eb72ce9b188cf1a43d12 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-devel-0.22.… 7f9d14be9e038b6079525a99141632c2 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-2.4.9-10.3.i586.p… 3b9834d757ef903331eef11d263765aa ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-devel-2.4.9-10.3.… 71a66acac5bdab4f540745e3f34513db ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-0.22.0-64.3… 564c47762db1dfd0579a15a28a5bf198 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-devel-0.22.… ae58eb0eb9b21b6dc34a88576cda8d40 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/gtk2-2.4.9-10.3.src.rpm 03fbda334b284e4764d287e635738e86 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/gdk-pixbuf-0.22.0-64.3.… 922628a980e0c30438381c8c75ba1681 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-2.2.4-125.10.i586… 7076812e0edec87e47ac3e2773a29908 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-devel-2.2.4-125.1… 6dbc2a7c8ed993e6868ff9becd264e5b ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-0.22.0-62.1… cfd60a7867d3f19fdf2ef457ad61c3e2 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-devel-0.22.… 0d9cd0869e0d461ca12f1b6702e09ae6 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-2.2.4-125.10.i586… c51455321b63c0f9db6b334879b74db2 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-devel-2.2.4-125.1… 2fdce6d74daaa4d0d36b9e299d005cf9 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-0.22.0-62.1… 5d74d0c82efdf390e332e8cf51fe4018 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-devel-0.22.… 953ab164ef73f95aa6eabf1b75fb9e81 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gtk2-2.2.4-125.10.src.r… 7f25bb1592667d945298b55794a5ef34 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gdk-pixbuf-0.22.0-62.13… 3ea3a4213e98c872386be297b34dbe2f SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-2.2.3-57.i586.rpm b7a34c4ca59ad4ff986539d41f5a3c62 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-devel-2.2.3-57.i5… 45cfa2114c629d787f4c94ab7a7a26b5 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-0.18.0-615.… 2e1d762dbce602f2cd4bdba9c6481f22 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-devel-0.18.… 70152ca0189e5af94730a39d362c4679 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-2.2.3-57.i586.pat… 92b162e49010fdd8bc01113a55f98963 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-devel-2.2.3-57.i5… 43f931a74169a3ab25ca2219fad8e260 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-0.18.0-615.… 4736822d29064f7d05bee4f7eb877d5d ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-devel-0.18.… aace0a16af2c70132a5c7ce94ee9315d source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gtk2-2.2.3-57.src.rpm 54ea94d4fadeedc9617c6b9e3ab253c0 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gdk-pixbuf-0.18.0-615.s… af97a34f1df9e537a5babb7309f10e85 x86-64 Platform: SUSE Linux 10.0: ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-… a6f11004299a6bc194758e58631eb14d ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-… a6f11004299a6bc194758e58631eb14d ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-devel-2.8.3-… d10769dfd24dd41298930ba09bfef93f ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-0.22.0… d60b38927a4b25ff8d5c61b15805be4b ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-devel-… 1e4281501647d4d227f6b2c7a6709e44 ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-32bit-… b1331a95be856bca8cc58a6ba92156fa patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-… 57dae5b10043cef231709c75b9c1fef0 ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-… 57dae5b10043cef231709c75b9c1fef0 ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-devel-2.8.3-… 0e1af403bc2a960a10b546b7551a83da ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-0.22.0… d496410edd7f6da4d48a4d8fbb71c6ae ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-devel-… 969bb92ada0efac69c035ed71661deaf ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-32bit-… f43a0a3ff732634d62ec5c0404a8883b source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/src/gtk2-2.8.3-4.3.src.r… f827e0f9da7d988d03098559119ac2d7 ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/src/gdk-pixbuf-0.22.0-72… 87e193dc3dce8969f47d6772e10b6e3a SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-2.6.4-6.3.x86… 270711bb1b6d023c9d3629f312e50749 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-32bit-9.3-7.1… 37515e93536ea2937a0094e96aff080b ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-devel-2.6.4-6… 99822738b70178f12976c93f8bcc9e5e ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9… 7f083e788760599185f5383fbd6074cc ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-devel-0… d07ea6f37ec3914951a4b32f085af0a0 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9… 7f083e788760599185f5383fbd6074cc patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-2.6.4-6.3.x86… 831bcb2924eacdf3e06094f155366a64 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-32bit-9.3-7.1… 5969ab9de490013c104d32070336c702 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-devel-2.6.4-6… 3f8bac290a7417022e4605681db0ec5f ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9… fa40ceaa517c75d2029803f8910b528d ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-devel-0… 7d363a368b905f1f223cc6bb6a50a744 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9… fa40ceaa517c75d2029803f8910b528d source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/gtk2-2.6.4-6.3.src.rpm 6b7e57bea2b48ae3a7bfcc6378cdb7fe ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/baselibs-32bit-9.3-7.… 2a749acae07d01e7249fc8348673e339 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/gtk2-2.6.4-6.3.src.rpm 6b7e57bea2b48ae3a7bfcc6378cdb7fe ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/baselibs-32bit-9.3-7.… 2a749acae07d01e7249fc8348673e339 ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/gdk-pixbuf-0.22.0-67.… d546d4e4ca0401b3d530f3263a83639d ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/baselibs-32bit-9.3-7.… 2a749acae07d01e7249fc8348673e339 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-2.4.9-10.3.x8… 2121161aa786e90f0e6ae4919da90a3a ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-32bit-9.2-200… 3c3d9e1d3a02d7c53b6c9a453c9bbb79 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-devel-2.4.9-1… de587bb88d05ef7ea69d61df65955cbb ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9… 5b3038697146b9fe3a736d6b0be689d6 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-devel-0… dd99a4ce37d4504d17f89a5b835674c6 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9… 5b3038697146b9fe3a736d6b0be689d6 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-2.4.9-10.3.x8… aa15a4974bc6bb066829cf113c0470a9 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-32bit-9.2-200… f509872128353007b4ece66bfd839d6b ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-devel-2.4.9-1… 18f1afa7c3b873f8aecb9d93f273dca6 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9… 364d36b4a5a411054145ba41fb42b637 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-devel-0… 0a6ff2ebe95bedbfd200778e5e771d74 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9… 364d36b4a5a411054145ba41fb42b637 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/gtk2-2.4.9-10.3.src.r… 03fbda334b284e4764d287e635738e86 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-20… 336ba61bad29df1bb83a51d940ce1347 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/gtk2-2.4.9-10.3.src.r… 03fbda334b284e4764d287e635738e86 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-20… 336ba61bad29df1bb83a51d940ce1347 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/gdk-pixbuf-0.22.0-64.… 922628a980e0c30438381c8c75ba1681 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-20… 336ba61bad29df1bb83a51d940ce1347 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-2.2.4-125.10.… dda27248ea4c5a9c1fac68296a02cda1 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-devel-2.2.4-1… 2e6c139ee38655ed850cf7392ec6147a ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-0.22.0-… 5f471e724c1e81511d282b2d5a0741da ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-devel-0… 05577700604c7651e0a9a4b0d34f929d patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-2.2.4-125.10.… c3495bec0ac4043dc7fb60112cd4b93e ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-devel-2.2.4-1… 1a0b8b30d9b5717aea242bab6cc04def ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-0.22.0-… 38523f56baf169bc35579869e77ea3cc ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-devel-0… 34ba091cf09bb721bbbe98194a7b8af7 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gtk2-2.2.4-125.10.src… c78f44a653b8c7078850214d6d0305a4 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gdk-pixbuf-0.22.0-62.… 9d56df6bd1f836bff06f3c320e6af720 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-2.2.3-57.x86_… 1be59dd02108d53f2b6136970281458f ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-devel-2.2.3-5… 8c5a75f2e162f946120fbc1991177141 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-0.18.0-… 9db2ce9ac353de3b3d40baa694a265fc ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-devel-0… c4dbed18cd259adc7069e4df1fb8925b patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-2.2.3-57.x86_… 99bcb3c24cdff9959c01e1f00a8bcd65 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-devel-2.2.3-5… 9ffaea29a6cb96579c158219db2fd8ea ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-0.18.0-… 5a684ec36f5f292aebccb55f7e23260d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-devel-0… f0c738175d874e0c2e29866a6ee87fcc source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/gtk2-2.2.3-57.src.rpm d8c2495842a49bfb178248df91c58464 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/gdk-pixbuf-0.18.0-615… fa3e8a1b1fb4b8fcc35cf9ea0afea3a3 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/4f5fae06488ebd0… http://portal.suse.com/psdb/4f5fae06488ebd06d78f3ec5ecb019e6.html http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/5ec7432d76a4db8… http://portal.suse.com/psdb/5ec7432d76a4db8b287ee5545e207443.html http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/fe498fdfdd2ea49… http://portal.suse.com/psdb/fe498fdfdd2ea49200596544a0aac288.html ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - See SUSE Security Summary Report ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ), send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBQ3srnHey5gA9JdPZAQGEZwgAjudpzo8WdHhcuJiVQcVimBvBSAkJnscR Kr3d6+a4GBmvVZSbEYm5lj0MGC6pxsNMFLgfQYk14DscArRd0X77EiFU/tBOhl2S 6TLE8jPdow5LE5FARuGenhlb1Fj3ZTn98E6M2Do92PCawUCOSYM3uxZH1+8mV09N IJLzSULoxpfBLeaBudRWQke0ACNVFixgqpWnwICNUml4t6CldIGp+x2VmutHNtK/ LJkDSAvNk3kZfzxjh5Oj1TYwjfNiczJIe6+4cgnwXEiBxMIlZ8b5k5yAgzRLLnZY s7+S5ugtUygKmABEbJ3ivo7lHwQE1pu/P4tB//VS9/LN3+yP2qGfPQ== =xMTB -----END PGP SIGNATURE-----

1 0

Discontinued SUSE Linux Distribution: 9.0
by Roman Drahtmueller 14 Nov '05

14 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Dear suse-security-announce subscribers and SUSE LINUX users, SUSE Security announces that SUSE Linux 9.0 (Personal and Professional edition) will be discontinued soon. Having provided security-relevant fixes for more than two years, vulnerabilities found in SUSE Linux 9.0 after December 15 2005 will not be fixed any more for this product. As a consequence, the SUSE Linux 9.0 distribution directory on our ftp server ftp.suse.com has been moved from /pub/suse/i386/9.0/ to the /pub/suse/discontinued/ directory tree structure to free space on our mirror sites. The 9.0 directory in the update tree /pub/suse/i386/update/9.0 will follow, as soon as all updates have been published. The discontinuation of SUSE Linux 9.0 enables us to focus on the SUSE LINUX distributions of a newer release dates to ensure that our customers can continuously take advantage of the quality that they are used to with SUSE LINUX products. This announcement holds true for SUSE Linux 9.0 only. As usual, SUSE will continue to provide update packages for the following products: SUSE LINUX 9.1 SUSE LINUX 9.2 SUSE LINUX 9.3 and SUSE Linux 10.0 for a two-year period after the release of the respective distribution. Please note that the maintenance cycles of SUSE LINUX Enterprise Server products and products based on the SUSE LINUX Enterprise Server operating system are not affected by this announcement. To learn more about SUSE LINUX business products, please visit http://www.novell.com/linux/suse/. If you have any questions regarding this announcement, please do not hesitate to contact SUSE Security at <security(a)suse.de>. Regards, Roman Drahtmüller, SUSE Security. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | Security Architect Phone: // you need vision!" | Novell - SUSE Linux +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQ3iDjHey5gA9JdPZAQHIIwf/dsNHfNJTBiYY5dFG4YlGV6Crfm3kbREz WakxqrLuHbxSBOnUQZLBqItBnNKQaNCgHwUjHEtBeP+PduA9rfG130EtG6YPMn16 YRlOO6aYsoryhE0jMYHL+L17n6UCoE1wcjzBDp+IluIxpZOu0uT+g4PuLBN4ebQL vTPbeWd9cpXRTe9hF/0OjKprqMn9330S24GaIA79njlRUyCwfLzULeKVeScYcZ+C ffDXkLuzS3D66hptvn6xXb/osEaxOo9+zB6DmaRf23UVnIyNaxEJmd8zhLruLfo+ RtpNVcLCPal8URXGKtNuCda/h7SxN3xuL5bTZ/hfi4gJie+Yt1DCkw== =NC2K -----END PGP SIGNATURE-----

1 0

SUSE Security Summary Report SUSE-SR:2005:026
by Marcus Meissner 11 Nov '05

11 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2005:026 Date: Fri, 11 Nov 2005 09:00:00 +0000 Cross-References: CVE-2005-2006, CVE-2005-2629, CVE-2005-2869 CVE-2005-2958, CVE-2005-2974, CVE-2005-3122 CVE-2005-3123, CVE-2005-3239, CVE-2005-3252 CVE-2005-3300, CVE-2005-3301, CVE-2005-3303 CVE-2005-3350, CVE-2005-3388, CVE-2005-3389 CVE-2005-3390, CVE-2005-3500, CVE-2005-3501 Content of this advisory: 1) Solved Security Vulnerabilities: - RealPlayer security problem - giflib,libungif denial of service attack / buffer overflows - snort overflow in back orifice preprocessor - clamav buffer overflows - jboss information disclosure 2) Pending Vulnerabilities, Solutions, and Work-Arounds: - zope - phpMyAdmin cross site scripting and file inclusion problems - libdga format string problem - php4,php5 - gnump3d various problems 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - RealPlayer security problem A RealPlayer security problem was found where a specially crafted .rm movie file could overflow a buffer and allow remote attackers to execute code in the context of the user running the player. We already released a fix with our previous RealPlayer security update, check SUSE-SA:2005:059. This is tracked by the Mitre CVE ID CVE-2005-2629. - giflib,libungif denial of service attack / buffer overflows The GIF processing libraries libungif and giflib were updated to fix the following security issues: - Specially crafted GIF files could crash applications (CVE-2005-2974). - Specially crafted GIF files could overwrite memory which potentially allowed to execute arbitrary code (CVE-2005-3350). This affects all SUSE Linux based products. - snort overflow in back orifice preprocessor A buffer overflow in snort's Back Orifice preprocessor code was fixed. This bug can be exploited by remote attackers to execute arbitrary code with the privileges of the snort daemon. This is tracked by the Mitre CVE ID CVE-2005-3252. All SUSE Linux based products containing snort were affected. - clamav buffer overflows The clamav virus scan engine was updated to version 0.87.1. This upgrade fixes among other things the following security issues: - clamav could be made to crash via a malformed DOC file (CVE-2005-3239). - a buffer overflow in the FSG decoder (CVE-2005-3303). - clamav could run into an endless loop due to malformed CAB files (CVE-2005-3500, CVE-2005-3501). All SUSE Linux based distributions containing clamav were affected. - jboss information disclosure The default configuration of jboss allows disclosure of sensitive information to remote users, by using a GET request with "%." to reveal the local installation path, or "%" before a filename to reveal the contents of this file. We will not release updated packages for this. The jboss group recommends disabling the RMIClassLoadingService webservice. In all jboss-service.xml files you have, change this snippet: <mbean code="org.jboss.web.WebService" name="jboss:service=WebService"> <attribute name="Port">8083</attribute>  <attribute name="DownloadServerClasses">true</attribute> <attribute name="Host">${jboss.bind.address}</attribute> <attribute name="BindAddress">${jboss.bind.address}</attribute> </mbean> to:  This is tracked by the Mitre CVE ID CVE-2005-2006. ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds - zope Zope honors file inclusion directives in RestructuredText objects which potentially allowed attackers to execute arbitrary code (Zope Hotfix 2005-10-09). Updates are currently being QA tested. All SUSE LINUX products >= 9.1 and SLES9 are affected. - phpMyAdmin cross site scripting and file inclusion problems We are preparing updates for the following issues: - multiple cross-site scripting (XSS) bugs (CVE-2005-3301, CVE-2005-2869, PMASA-2005-5). - multiple file inclusion vulnerabilities that allowed an attacker to include arbitrary files (CVE-2005-3300, CVE-2005-3301, PMASA-2005-5). All SUSE LINUX products are affected. - libdga format string problem libgda contains two format string bugs in logging routines. Those bugs could potentially indirectly lead to arbitrary code execution via applications that link against libgda and supply data to libgda (CVE-2005-2958). Updates are currently being QA tested. All SUSE LINUX products and SLES9 are affected. - php4,php5 Stefan Esser discovered a cross-site scripting bug in the phpinfo() function (CVE-2005-3388), a bug that allows an attacker to enable register_globals (CVE-2005-3389) and a bug that allows an attacker to overwrite the $GLOBALS array (CVE-2005-3390). We are preparing updates for these issues. All SUSE LINUX based products are affected. - gnump3d various problems Steve Kemp discovered a cross-site scripting bug (CVE-2005-3122) and a directory traversal bug (CVE-2005-3123) in gnump3d. We are preparing updates for these issues. All SUSE LINUX products are affected. ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ) send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ3S8YHey5gA9JdPZAQLllwf+JYXC2uXae4aDg4NQ9i/sTZ+yRMAoMO1L in0yFJGem0a65+OcZ30LsspklvVWFRdu37qsMCtp+1vfmwLEReH6OnAhKbHWsoJ5 oRr5vqYGoWfLM9ALYYG6I7p9oxw35Ommkub5Kq2x7nE5p+9yomjX2JELCmFCv/k2 4sSaVxtio87zD2GPdh8dhnCH/ngpHnHjQM5vVuVUHj5aXBhNWXAMGmbG0pOu4utA /Sd/9k4BQt2JVBV2QithuzSfaxgrKuw4caax/55yYjXsPRFAFyh1C4+o9QegEZS2 d2yGjcaXUa6M+Z1U+MnRqPHX87tUGJL/xvkocZUzZOz68ZvEcm+IJg== =a6LG -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: pwdutils, shadow (SUSE-SA:2005:064)
by Ludwig Nussel 04 Nov '05

04 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: pwdutils, shadow Announcement ID: SUSE-SA:2005:064 Date: Fri, 04 Nov 2005 14:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SuSE Linux 9.0 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 SUSE SLES 9 UnitedLinux 1.0 Vulnerability Type: local privilege escalation Severity (1-10): 7 SUSE Default Package: yes Cross-References: - Content of This Advisory: 1) Security Vulnerability Resolved: pwdutils privilege escalation Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - See SUSE Security Summary Report 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion Thomas Gerisch found that the setuid 'chfn' program contained in the pwdutils suite insufficiently checks it's arguments when changing the GECOS field. This bug leads to a trivially exploitable local privilege escalation that allows users to gain root access. We like to thank Thomas Gerisch for pointing out the problem. 2) Solution or Work-Around Removing the setuid bit from /usr/bin/chfn renders chfn useless but also prevents successful exploitation. Note that this workaround only lasts until the next run of SuSEconfig which will restore the setuid bit if you are on permissions level 'easy' or 'secure'. 3) Special Instructions and Notes None 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/pwdutils-3.0.4-4.2.i5… 385e9ef4f03e67ddb50a6a21d5b9f0e9 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/pwdutils-2.6.96-4.2.i5… 4705772232599de3a2d9dc83c922ee47 SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/pwdutils-2.6.90-6.2.i5… aae77d1eab9d617be89ab993f9f8a47d SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/pwdutils-2.6.4-2.18.3.… 5e957e0370ac82874979e0c02187517e SuSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/shadow-4.0.3-267.i586.… 8cf127c4d2e74f17cf0ff058f4feaf00 Power PC Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/pwdutils-3.0.4-4.2.ppc… 533274d92b8375bc51b6a3684c1cf506 x86-64 Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/pwdutils-3.0.4-4.2.… cc54040195f24925474d1896c45ccb30 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/pwdutils-2.6.96-4.2.… 785543d9276bd5de611ce0e82bc3c066 SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/pwdutils-2.6.90-6.2.… 82b384b4d65189c2af84677d7fc02dba SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/pwdutils-2.6.4-2.1… f5d860c203d8dc5c6b85318229fe68d8 SuSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/shadow-4.0.3-267.x… 384136f520ebf09d3be779291da92c8d Sources: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/pwdutils-3.0.4-4.2.src… f4b6aedde6cf93e1fe5b47bda874e72a SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/pwdutils-2.6.96-4.2.src… cb0d28c88ecf013418234ed39ff87e85 SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/pwdutils-2.6.90-6.2.src… e8854e2433279f4a2650d354a07f3605 SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/pwdutils-2.6.4-2.18.3.s… 81453f140a633eeb0b0a841b857e49a5 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/pwdutils-2.6.4-2.18.3… 7f5d161dae57bf1fb64cd39269b5255c SuSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/shadow-4.0.3-267.src.rpm 6cc9c84bdea5f04c290c55c942327bb0 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/shadow-4.0.3-267.src.… d463b528a727655b392230302d998976 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/185153682667ec6… http://portal.suse.com/psdb/185153682667ec6862eeea0f4622dde5.html http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/53225e252af46c1… http://portal.suse.com/psdb/53225e252af46c1f6a71fe03f1d76317.html ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - See SUSE Security Summary Report ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ), send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ2tjYney5gA9JdPZAQJcJwf9G2fx7WVaKug1zazB5HVDdTQX5O7VTzGM bbnuMVj3IdNaD8muz0hTo4KdW2cm/OemYfKMFdRVLjpBc4XM2QzMcm/24XyXOlt0 frJOdjjGiNYgnzGdwVaxub7OqrRjjQcmzcx+xOIjvyF96l9UYrvzaf9QuzealrO7 rRr++OWLhHlNDcX1yLm4dZSmibdW7weE3pEPaCF8KOC0VcBHWmgWPP8mEBDXgstb rnG+q2N6vv/+eJf0vc7eOFv26PnztQu1gq56D3VtsH2oH4bmaNT9+xPwMqFqE6hv 7GtoI27hDhPb2gWxWleXUhfZq47M5KECfdgTQlDva5Q2PGUTNS8G/g== =xn71 -----END PGP SIGNATURE-----

1 0

SUSE Security Summary Report: SUSE-SR:2005:025
by Ludwig Nussel 04 Nov '05

04 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2005:025 Date: Fri, 04 Nov 2005 14:00:00 +0000 Cross-References: CVE-2005-2869, CVE-2005-2917, CVE-2005-2958 CVE-2005-2959, CVE-2005-2971, CVE-2005-2974 CVE-2005-3068, CVE-2005-3120, CVE-2005-3122 CVE-2005-3123, CVE-2005-3184, CVE-2005-3185 CVE-2005-3241, CVE-2005-3242, CVE-2005-3243 CVE-2005-3244, CVE-2005-3245, CVE-2005-3246 CVE-2005-3247, CVE-2005-3248, CVE-2005-3249 CVE-2005-3258, CVE-2005-3300, CVE-2005-3301 CVE-2005-3313, CVE-2005-3318, CVE-2005-3350 CVE-2005-3388, CVE-2005-3389, CVE-2005-3390 CVE-2005-3393, CVE-2005-3409 Content of this advisory: 1) Solved Security Vulnerabilities: - openvpn - lynx - liby2util - wget - kchmviewer - koffice-wordprocessing - ethereal 2) Pending Vulnerabilities, Solutions, and Work-Arounds: - zope - phpMyAdmin - libgda - squid - php4, php5 - gnump3d - libungif, giflib - sudo - eric 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - openvpn An openvpn update fixes the following security bugs: - a malicious or compromised server could exploit a format string bug in clients to execute arbitrary code (CVE-2005-3393). - a server in TCP mode could be made to crash due to insufficient checks for the error code of the accept() system call (CVE-2005-3409). SUSE Linux 9.3 and 10.0 are affected. - lynx This update fixes a buffer overflow in function HTrjis() that occurs while processing NNTP headers. An attacker can exploit this remotely by persuading the victim user to connect to a NNTP server which includes a malformated article to execute arbitrary code. (CAN-2005-3120) All SUSE LINUX based products and SLES9 are affected. - liby2util The previous liby2util update on SUSE Linux 9.1 was broken. Fixed packages have been released. - wget Updates for SUSE Linux 9.2 that fix CAN-2005-3185 where missing previously. Update packages are now available. - kchmviewer kchmviewer contained a copy of chmlib that was prone to a buffer overflow (CVE-2005-3318). SUSE Linux 10.0 is affected. - koffice-wordprocessing A buffer overflow in the RTF import filter in koffice was fixed (CAN-2005-2971 / CESA-2005-005). It allowed remote attackers to execute code in the koffice process by preparing a special RTF file. All SUSE LINUX products and SLD are affected. - ethereal A version upgrade to ethereal 0.10.13 fixes several security related bugs ranging from crashes to arbitrary code execution. (CVE-2005-3241, CVE-2005-3242, CVE-2005-3243, CVE-2005-3244, CVE-2005-3245, CVE-2005-3246, CVE-2005-3247, CVE-2005-3248, CVE-2005-3249, CVE-2005-3184, CVE-2005-3313) All SUSE LINUX based products are affected. ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds - zope Zope honors file inclusion directives in RestructuredText objects which potentially allowed attackers to execute arbitrary code (Zope Hotfix 2005-10-09). Updates are currently being QA tested. All SUSE LINUX products >= 9.1 and SLES9 are affected. - phpMyAdmin We are preparing updates for the following issues: - multiple cross-site scripting (XSS) bugs (CVE-2005-3301, CAN-2005-2869, PMASA-2005-5). - multiple file inclusion vulnerabilities that allowed an attacker to include arbitrary files (CVE-2005-3300, CVE-2005-3301, PMASA-2005-5). All SUSE LINUX products are affected. - libgda libgda contains two format string bugs in logging routines. Those bugs could potentially indirectly lead to arbitrary code execution via applications that link against libgda and supply data to libgda (CAN-2005-2958). Updates are currently beeing QA tested. All SUSE LINUX products and SLES9 are affected. - squid We are preparing updates for the following issues: - A bug in the NTLM authentication could crash squid (CVE-2005-2917) - Odd replies of FTP servers could crash squid (CVE-2005-3258) Updates are currently being QA tested. All SUSE LINUX based products are affected - php4, php5 Stefan Esser discovered a cross-site scripting bug in the phpinfo() function (CVE-2005-3388), a bug that allows an attacker to enable register_globals (CVE-2005-3389) and a bug that allows an attacker to overwrite the $GLOBALS array (CVE-2005-3390). We are preparing updates for these issues. All SUSE LINUX based products are affected. - gnump3d Steve Kemp discovered a cross-site scripting bug (CVE-2005-3122) and a directory traversal bug (CVE-2005-3123) in gnump3d. We are preparing updates for these issues. All SUSE LINUX products are affected. - libungif, giflib We are preparing updates for the following issues: - specially crafted GIF files could crash applications (CVE-2005-2974). - specially crafted GIF files could overwrite memory which potentially allowed to execute arbitrary code (CVE-2005-3350). Updates are currently being QA tested. All SUSE LINUX based products are affected. - sudo The fix for CVE-2005-2959 further extends the sudo internal environment variable blacklist to prevent interpretation of those variables by the bash shell. In our opinion a blacklist based approach to improve security is doomed to fail. If you use sudo to grant limited super user access to regular users you should rather configure sudo to clean the entire environment by setting the options env_reset and always_set_home. We will therefore not release security updates for the sole purpose of extending the blacklist. - eric Eric project files may contain python code which is run through eval() by eric. The fix for CVE-2005-3068 does not prevent this. A project file is some kind of Makefile, executing code in such a development environment is a natural property. GPG signatures should be used to validate integrity and authenticity of source releases. We are therefore not going release security updates for eric. ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ) send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ2tjWney5gA9JdPZAQJNYQf/S9weBlI0QZJ7sUHp9isLDzm0xav41Gtt AvrZq6IsCratxWcFgwbg98WL4Y/4oTpDHY21jDdadpZpQZjzLabFoZJd4dQAQpsd IqOzLafNKXQE25JrLocBZ/qc7MoW6h9M8o6guq3w4SLiVN2zup1Gg2yvYx4C30GV jL5ZxckUliMR1CnAi+w+TvS3jrfVHxoukjZ8KLT6cIrRAUifw1OFC/dvbkSt0zLv 5mjI051a+d8aCXih08BI2D1rWDW5t13QNo81rrzsvrj/MLcrwZF2KjZRo+8LGT+N wryHgBI0D+pvbYiecDTFdw9j6f93+S4v9+lZuVQclsCuQBKRw8KQ+g== =+qxh -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: wget/curl overflow in NTLM authentication
by Marcus Meissner 24 Oct '05

24 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: curl, wget Announcement ID: SUSE-SA:2005:063 Date: Mon, 24 Oct 2005 16:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SUSE Linux Enterprise Server 9 Novell Linux Desktop 9 Open Enterprise Server Vulnerability Type: remote code execution Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2005-3185 Content of This Advisory: 1) Security Vulnerability Resolved: stack based buffer overflow in NTLM authentication Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update fixes a stack-based buffer overflow in the NTLM authentication code used by the file download tools/libraries curl and wget that can be triggered by using a long user or domain name (also works with HTTP redirects). By exploiting this bug by using a malicious server an attacker may be able to execute arbitrary code with the privileges of the entity running the process locally. (CVE-2005-3185) This affects both curl/libcurl and wget >= 1.10. wget copied the code from libcurl, making this effectively the same problem. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of programs using libcurl after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/compat-curl2-7.11.0-7… 8f5ea41e7b4e80798c960790bb93e603 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/curl-7.14.0-2.2.i586.… 8e59e94e8745f0916ed00a7040d4e597 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/wget-1.10.1-2.2.i586.… 2a91b99e5adfd78b2e9c6a3b03bcc67d SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/compat-curl2-7.11.0-6.… dc1b2e8dc509adca503b7f2e7724be49 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/curl-7.13.0-5.2.i586.r… 937855b131da29025f48cab5880a91ea ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/wget-1.10-1.3.i586.rpm 556ba3000c278fecfec9c24b1b5ce44f SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/compat-curl2-7.11.0-4.… 2b21dc3b9877f45602191cc33c695734 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/curl-7.12.0-2.4.i586.r… 77802b5fb55775fd00b1e7e71cb03aab SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/curl-7.11.0-39.9.i586.… 8f18c55e56f560e641173b7ca96a13a6 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/i586/curl-32bit-9.1-20051… 07b00ace15bc16b4e6ee878cb4703f34 Power PC Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/compat-curl2-7.11.0-7.… b69c93ed024d1887cb1fafa9140c7235 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/curl-7.14.0-2.2.ppc.rpm 1102f6dd51867fb06921e1b35354821d ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/wget-1.10.1-2.2.ppc.rpm ba717462ca2644628296cb473f228926 x86-64 Platform: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/compat-curl2-32bit-… e42d1a8642003893cc2656effc2befae ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/compat-curl2-7.11.0… f29e8a213abc2a6df3c514849dd58f45 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/curl-32bit-7.14.0-2… 531e4e3a333cd7a869bce42d4f284c34 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/curl-7.14.0-2.2.x86… d11fd9298ca5a0d6009810afc02ffa00 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/wget-1.10.1-2.2.x86… 4025598d1a4d5c1f3bfb288df9ba62e0 SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/compat-curl2-32bit-9… 8064b387585923ca8bf897294d6e0750 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/compat-curl2-7.11.0-… c6174cc85a1a8a7ae0aef33703b255ab ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/curl-32bit-9.3-7.1.x… d4da6969e3c7c08c2387bf2f491ae6b2 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/curl-7.13.0-5.2.x86_… d6db8fa9847c74194db4b11508aa81e5 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/wget-1.10-1.3.x86_64… 62373d0f58db04c85d6d558002b61439 SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/compat-curl2-32bit-9… 8176f04bcc6b8a5b5e6730570d71e1dc ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/compat-curl2-7.11.0-… 77ca0f684608cd05d6680b71a60f3d2b ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/curl-7.12.0-2.4.x86_… 225eaed129a89f522099a4dd05fbd92f SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/curl-7.11.0-39.9.x… c7e53c0f5b9e176ea517b2cd6e212b7b Sources: SUSE LINUX 10.0: ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/compat-curl2-7.11.0-7.… dd327d44a1e34dc62557d731191d8eaa ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/curl-7.14.0-2.2.src.rpm 501302472341f049f32c26158857afe4 ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/wget-1.10.1-2.2.src.rpm 620602e6c0d6745278570b049dc62d6f SUSE LINUX 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/compat-curl2-7.11.0-6.2… f28644961a98a391fcd4f9c220d95976 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/curl-7.13.0-5.2.src.rpm 115bbe666fc6d170f0209bf08d415e94 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/wget-1.10-1.3.src.rpm 201a3d45868f65590bb78bb80f40c1f5 SUSE LINUX 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/compat-curl2-7.11.0-4.4… 9c3f454a7d31bddee04df39a6b10052c ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/curl-7.12.0-2.4.src.rpm f5249c9853905e77323c6febfe319809 SUSE LINUX 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/curl-7.11.0-39.9.src.rpm c64049955adb7067312b8716e61e2819 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/curl-7.11.0-39.9.src.… 9bb9bd0870ab5a6a76e5da583323ca98 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/a4b05b41f1d218a… http://portal.suse.com/psdb/a4b05b41f1d218a2680342fec83ddb5d.html ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum <filename.rpm> after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security(a)suse.de) the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (FAQ), send mail to <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iQEVAwUBQ1z8wXey5gA9JdPZAQI3Zwf9GF+I7RAvlh2FQZSmnsuthdImkPznj9xT KmiSP4IcJm6XOS1ApVVbhnqkpJQbbXqXgD63Syf+/4K6tmuVYBSFyV5fgwvKLUv1 2AiGYsRxJNxKkKTcys8O+zrbK6x2tK4yzfgBp84y6O0BbNi9QJRGCsn7UxGRSUue Md+53TWRDURUahYaHmgbyhgoXJPCFn5sUNex6qrbKmarlU3UeX670lbyxD9ifHKF Z8L8PQL1WU/Q3057/TTvczxpHwsPQBTLLvsmSBtTcBhqRZbu+Ld0NFYv6f72YP10 7zYtHv9Qr0GeyYc8z7TiYIEbZNSsGVIVcNsRpkYTLzOu3eUzu2eKew== =HgM3 -----END PGP SIGNATURE-----

1 0