September 2004 - openSUSE Security - openSUSE Mailing Lists

cipher algorithm
by Sébastien V 21 Sep '04

21 Sep '04

Hello, i m using the VPN solution openVPN, and OPENVPN provides quite many cipher algorithm,the default one is blowfish. here is the list: DES-CBC 64 bit default key (fixed) RC2-CBC 128 bit default key (variable) DES-EDE-CBC 128 bit default key (fixed) DES-EDE3-CBC 192 bit default key (fixed) DESX-CBC 192 bit default key (fixed) BF-CBC 128 bit default key (variable) RC2-40-CBC 40 bit default key (variable) CAST5-CBC 128 bit default key (variable) RC2-64-CBC 64 bit default key (variable) AES-128-CBC 128 bit default key (fixed) AES-192-CBC 192 bit default key (fixed) AES-256-CBC 256 bit default key (fixed) CBC mode is recommended but it seems they are all CBC anyway. Which one do you recommand me? i want an efficient and robust cipher algorithm. best regards sebastien _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

2 1

Re: [suse-security] cipher algorithm
by Wilfred van Velzen 21 Sep '04

21 Sep '04

Here's a recent article on hash functions: http://www.schneier.com/crypto-gram-0409.html#3 Draw your own conclusion... ;-) Met vriendelijke groet / Best regards, Wilfred van Velzen >>> Sébastien V <soloturku(a)hotmail.com> 2004-09-21 08:38:46 >>> hello I m trying to setup a VPN under Suse Linux machines(using OpenVPN): i have some questions about cipher and digest algorithm: BlowFish is the default cipher and SHA1 is the default message digest. Are they good algorithms? OpenVPN provides also other cipher such as: cipher DES-EDE3-CBC # Triple-DES cipher AES-128-CBC # AES Which cipher and digest method should i use? i want to secure my VPN as much as possible. thanks a lot sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- SERCOM Regeltechniek b.v. Heereweg 9 2161 AB Lisse Nederland +31 (0)252 416530 (voice) +31 (0)252 419481 (fax) <http://www.sercom.nl/> Op al onze offertes, op alle opdrachten aan ons en op alle met ons gesloten overeenkomsten zijn toepasselijk de METAALUNIEVOORWAARDEN, gedeponeerd ter Griffie van de Rechtbank te Rotterdam, zoals deze luiden volgens de laatstelijk aldaar neergelegde tekst. De leveringsvoorwaarden worden u op verzoek toegezonden.

1 0

cipher algorithm
by Sébastien V 21 Sep '04

21 Sep '04

hello I m trying to setup a VPN under Suse Linux machines(using OpenVPN): i have some questions about cipher and digest algorithm: BlowFish is the default cipher and SHA1 is the default message digest. Are they good algorithms? OpenVPN provides also other cipher such as: cipher DES-EDE3-CBC # Triple-DES cipher AES-128-CBC # AES Which cipher and digest method should i use? i want to secure my VPN as much as possible. thanks a lot sebastien _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

1 0

cipher algorithm
by Sébastien V 21 Sep '04

21 Sep '04

hello I m trying to setup a VPN under Suse Linux machines(using OpenVPN): i have some questions about cipher and digest algorithm: BlowFish is the default cipher and SHA1 is the default message digest. Are they good algorithms? OpenVPN provides also other cipher such as: cipher DES-EDE3-CBC # Triple-DES cipher AES-128-CBC # AES Which cipher and digest method should i use? i want to secure my VPN as much as possible. thanks a lot sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp

1 0

firewall/mailServer
by Paul Ikanza 21 Sep '04

21 Sep '04

Can Anyone please recommend for me between suse 9.1 and 8.2 which one is better for mail (postfix) as well as proxy/firewall-not too familiar with 9.1 yet. Paul

1 0

[Fwd: Fwd: Re: SELinux]
by Jophn Deo 20 Sep '04

20 Sep '04

1 0

FreeSWAN: Win2k ok, XP fails
by Stefan-Michael. Günther (in-put GbR) 20 Sep '04

20 Sep '04

Hello, during this week I have set up a FreeSWAN gateway and tested the configuration succesfully with another gateway and a Win2k client. After this I copied the certificate and the configuration I used with Win2K to a XP box (ipsecmd installed, no SP2, ipsec-tool from vpn.ebootis.de). ipsec -debug looked good and a ping to an apache behind the FreeSWAN gateway told me "ip security negotiated". But in /var/log/messages I find the following line: "encrypted Informational Exchange message is invalid because it is for incomplete ISAKMP SA" I saw this message before, when I used the wrong ca in the Win2k ipsec.conf. But this time the ca must be right, because I was able to connect to the apache with the Win2k -client over the vpn (tcpdump and the browser prooved that) Does anyone of you know whether it's necessary to make any change to the config files when the client is an XP box ? I haven't found a note on that in the documentation. Thanks for any hint. Bye, Stefan -- ***************************************** in-put GbR - Das Linux-Systemhaus Stefan-Michael Günther Moltkestraße 49 D-76133 Karlsruhe Tel./Fax : +49 (0)721 / 83044 - 98/93 http://www.in-put.de *****************************************

2 2

startup and shutdown
by Sébastien V 20 Sep '04

20 Sep '04

hi, I made a small shell script(firewall) and i want to launch this script when suse linux boot and shut down this script when i close suse linux. how can i do that? best regards sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp

3 2

Re: [suse-security] SuSE Firewall and CUPS (UDP rules)?
by Maxim A Belushkin 17 Sep '04

17 Sep '04

No, my question is *much* simpler, sorry :) The 4 steps of configuring the firewall with Yast: Step 1: select interface. I have no trusted net, no "internal" interface. So eth0 is the only one, and it's set to external. Step 2: Services. Additional services is set to: 631. This is what's causing my confusion. It drops UDP packets destined for port 631. And in fact, in that dialog box it says "TCP services". What am I missing in the Yast firewall setup tool? :P I've normally set iptables rules by hand, but decided to try the Yast setup, and... I feel I'm missing a lot of things :) So my question amounts to: can the Yast tools do it? it's a very simple rule, seriously! Or do I need to insert it by hand? In which case I might as well trash all the rules Yast set up in there and put in my own standard set. - Vfrc - barrulus wrote: > > ------------------------------------------------------------------------ > > On Friday 17 September 2004 09:05, Maxim A Belushkin wrote: > >> a print server on the network is bcasting queue names to UDP port >>631. SuSE firewall seems to only have exceptions for TCP ports, and not >>UDP. Any "clean" workaround for this avoiding digging into the iptables >>rules the firewall creates? > > > ??? > > You can set up trusted nets with UDP, allow interfaces to listen with UDP, > forward UDP traffic and masquerade UDP traffic? > > When you say "exceptions" what do you mean? > Do you want the local CUPS server to be listening on that port to pick up the > broadcasts, or do you want the broadcasts to be forwarded into your LAN from > your DMZ?

4 5

connecting 2 machine via internet
by Giovanni Racciu 17 Sep '04

17 Sep '04

Hi, I need to establish a secure connection between 2 machines (running Suse9.1pro) via Internet. I have a server machine, with a static ip address while the client is behind a modem/router/ADSL which has its own static/dynamic IP and performs NAT translation. client (192.168.0.x) ----- NAT/ADSL(Router static ip) ---- Server (Suse9.1pro with static IP) My final purpose is to be able to login on the client suse box. I also would like to support multiple clients and the connection on client side should be established without user intervention. I am evaluating vtun a the moment. Do you have any suggestion ? Thanks Ciao Giovanni

3 2

SUSE Security Announcement: XFree86-libs, xshared (SUSE-SA:2004:034)
by Thomas Biege 17 Sep '04

17 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: XFree86-libs, xshared Announcement-ID: SUSE-SA:2004:034 Date: Friday, Sep 17th 2004 14:23 MEST Affected products: 8.1, 8.2, 9.0, 9.1 SUSE Linux Enterprise Server 8, 9 remote command execution Severity (1-10): 9 SUSE default package: yes Cross References: CAN-2004-0687 CAN-2004-0688 Content of this advisory: 1) security vulnerability resolved: - stack-based buffer overflow - integer overflow problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - samba - a2ps - mozilla - mc - squid - gaim - nessus - konqueror 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion Chris Evans reported three vulnerabilities in libXpm which can be exploited remotely by providing malformed XPM image files. The function xpmParseColors() is vulnerable to an integer overflow and a stack-based buffer overflow. The functions ParseAndPutPixels() as well as ParsePixels() is vulnerable to a stack-based buffer overflow too. Additionally Matthieu Herrb found two one-byte buffer overflows. 2) solution/workaround There is no workaround known. 3) special instructions and notes After you have updated your system it would be best to restart the X server to remove all running instances of vulnerable libXpm code from your computer's memory. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/XFree86-libs-4.3.99.90… 3012c0528b52f9c32887469166d07c97 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/XFree86-libs-4.3.99.90… ff5ace1728b192c1be0ead104e7074a8 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/XFree86-4.3.99.902-43.3… e54b7716eecbadba26d29d808dfc253c SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/XFree86-libs-4.3.0.1-5… 80960eb494a1448276e07b88bcdf93b9 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/XFree86-libs-4.3.0.1-5… ef4e99c7ab08ee6f4ae4e6f6020d036e source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/XFree86-4.3.0.1-55.src.… 5320885836408599cd154b98e9f11c44 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/XFree86-libs-4.3.0-127… c4c9e786460c73d25442aa0fbbbf3022 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/XFree86-libs-4.3.0-127… efa7c28f19acce67e82aae8b9beb5126 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/XFree86-4.3.0-127.src.r… d61403ce550e0873054ffe887f6406f3 SUSE Linux 8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/xshared-4.2.0-267.i586… edea41c34e213abf627d3a9388a1e35d patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/xshared-4.2.0-267.i586… 517062ac1548ce2eafc734534cef6ba4 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/xf86-4.2.0-267.src.rpm 5a840979d8615102e8cdad652608629d x86-64 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/XFree86-libs-4.3.9… b0686b3f2cc91167e596202aacd3294a patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/XFree86-libs-4.3.9… 9fc1ff5c09f45843c94ed50da0110496 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/XFree86-4.3.99.902-43… faf725c1202d2b36ad9d85158b6c6479 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/XFree86-libs-4.3.0… 24ae6856520a90d0125c343f7e26201f patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/XFree86-libs-4.3.0… c137982b3935200e1f114877003c1022 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/XFree86-4.3.0.1-55.sr… bdf6c8d0f7f4d92f6de0d5429486fd5b ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - samba This version fixes several bugs in the Samba suite including two denial-of-service (DoS) Vulnerabilities. Microsoft Windows XP clients with installed Service Pack 2 crash the Samba (smbd) process while printing. Using macros in the smb.conf 'log file' statement might lead to an infinite recursion. A wrong counter and pointer handling in samba-vscan leads to a crash of the Samba (smbd) process sometimes. A DoS bug in smbd may allow an unauthenticated user to cause smbd to spawn new processes, each one entering an infinite loop. After sending a sufficient amount of packets it is possible to exhaust the memory resources on the server. This issue is known as CAN-2004-0807. A DoS bug in nmbd may allow an attacker to remotely crash the nmbd daemon. This issue is known as CAN-2004-0808. New packages are available on our FTP servers. - a2ps This update fixes the handling of filenames that include shell meta- characters. Without this patch it was possible to execute shell commands via a2ps by providing a filename that includes meta- characters as an argument. New packages are available on our FTP servers. - mozilla We are in the process of releasing updates for mozilla (and related browsers), fixing various issues: CAN-2004-0597, CAN-2004-0718, CAN-2004-0722, CAN-2004-0757, CAN-2004-0758, CAN-2004-0759, CAN-2004- 0760, CAN-2004-0761, CAN-2004-0762, CAN-2004-0763, CAN-2004-0764 and CAN-2004-0765. We will give you concrete details in a separate mozilla advisory when the updates are available. - mc The console filesystem browser mc was found vulnerable to various meta-char attacks in the extfs perl and shell scripts. These bugs can be exploited by providing a malformed archive file to a victim user to execute shell commands with her/his privileges. (CAN-2004-0494) New packages will be available soon. - squid Certain malformed NTLMSSP packets can crash the NTLM helpers provided by Squid (CAN-2004-0832). New packages will be available soon. - gaim This security update fixes four security issues which are registered as: + CAN-2004-0754 An integer overflow in the groupware message handler exists in Gaim. + CAN-2004-0784 A shell escape vulnerability in the handling of smiley theme tar- ball filenames could lead to arbitrary command execution. + CAN-2004-0785 Buffer overflows in Gaim could lead to a denial of service or arbitrary code execution. Additionally a buffer overflow in the URL parsing code of gaim is fixed. This bug let to remote system compromise with the privileges of the user running gaim. - nessus The nessus-adduser creates temporary files in $TMPDIR in an insecure manner. New packages will be available soon. - konqueror Westpoint notified us about a cookie stealing problem in various web- browsers (http://www.westpoint.ltd.uk/advisories/wp-04-0001.txt). The already available kdelibs3 packages (announced in SUSE-SA:2004:026) include patches for this vulnerability. We would like to thank Westpoint for their cooperation. Other browsers (Mozilla, Opera, ...) will be updated as soon as possible. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBQUrmxney5gA9JdPZAQHMXAf/e20MzDlLSfVlxqgYF87iRSo81MOUFFe7 8U/wqYAyMVuvUGqmxGb4ahh205j6iW1stxnaxTzIRN/y004bTsO3AUjjr/DfT6bn 8ErYoaMdRCvlFkVl2qPflOCiVsuPs0zCOF5Bu9Hb98B35JDUc18KWg74UXN7I98d lRPEhkccF1JymWxVIhKXhUupbNaBaroxqo9Pgrdcuv8fF8MvO5xsNqngU3DUFkWl C6zCLVNtXiLqYZsIqTtDM01wiEkgnY3srLh5A8uvofXPbX/pN+V/XEvF8l+OLXjo XCj8fp/hIjI7MT0b5mrkx4X6fe8tGguj5/nt+6hYF+eqebSU+t+GOA== =QGRJ -----END PGP SIGNATURE-----

1 0

SuSE Firewall and CUPS (UDP rules)?
by Maxim A Belushkin 17 Sep '04

17 Sep '04

Hi, running SuSE 9.1 Professional. a print server on the network is bcasting queue names to UDP port 631. SuSE firewall seems to only have exceptions for TCP ports, and not UDP. Any "clean" workaround for this avoiding digging into the iptables rules the firewall creates? Thanks :) - Vfrc -

2 1

gdk-pixbuf-devel and/or gdk-pixbuf security updates break gnumeric
by Anthony Edwards 17 Sep '04

17 Sep '04

One, other or both of the 15 September 2004 security updates for these two packages seem to have broken gnumeric: anthony@catfish:~> gnumeric gnumeric: relocation error: /opt/gnome/lib/gdk-pixbuf/loaders/libpixbufloader-xpm.so: undefined symbol: g_try_malloc Any idea what a fix might be? -- Anthony Edwards anthony.edwards(a)uk.easynet.net

2 3

SUSE Security Announcement: gtk2, gdk-pixbuf (SUSE-SA:2004:033)
by Ludwig Nussel 17 Sep '04

17 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: gtk2, gdk-pixbuf Announcement-ID: SUSE-SA:2004:033 Date: Wednesday, Sep 17th 2004 12:00 MEST Affected products: 8.1, 8.2, 9.0, 9.1 SUSE Linux Enterprise Server 8, 9 SuSE Linux Desktop 1.0 Vulnerability Type: remote code execution Severity (1-10): 9 SUSE default package: yes Cross References: CAN-2004-0782 CAN-2004-0783 CAN-2004-0788 Content of this advisory: 1) security vulnerability resolved: - heap based overflow - stack based overflow - integer overflow 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - mozilla - mc - squid - gaim - nessus 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion gdk-pixbuf is an image loading and rendering library mostly used by GTK and GNOME applications. It is distributed as a separate package for gtk1 and integrated into the gtk2 package. Chris Evans has discovered a heap based, a stack based and an integer overflow in the XPM and ICO loaders of those libraries. The overflows can be exploited by tricking an application to display a malformed image to make it crash or to execute code. 2) solution/workaround There is no known workaround, please install the update packages. 3) special instructions and notes After the update packages have been installed, all applications linked against gdk-pixbuf libraries must be restarted. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-2.2.4-125.4.i586.… 6bef703af85fcded2c953e508e0fffea ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-0.22.0-62.7… 73949b52a855b2a53eb7c0abdb5a9823 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-2.2.4-125.4.i586.… 7326343f2db2f859a22c1c52c4b4e0ef ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-0.22.0-62.7… a2b2cfe3f04cf45147c27a821df77f63 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gtk2-2.2.4-125.4.src.rpm b82cc25deca74c04d074f4f1bd137349 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gdk-pixbuf-0.22.0-62.7.… 7dfece40e4e1ef17da8ef4a97cc57fa7 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-2.2.3-54.i586.rpm ccfef6e4d79588221235028a5fc100d2 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-0.18.0-610.… 0748a443ba301f2538650cd7145edf53 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-2.2.3-54.i586.pat… 87aa3c619340a1dd8e70695171eb5597 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-0.18.0-610.… d2be310f9f9d222ebf3979e65c23746e source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gtk2-2.2.3-54.src.rpm 67798c77985fbb707011c52035bc31e1 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gdk-pixbuf-0.18.0-610.s… ab9854039bbcdde141b9ddd666cc67cc SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/gtk2-2.2.1-102.i586.rpm bd5acc20314f84cfc5ef157dd413e103 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/gdk-pixbuf-0.18.0-609.… ecc397996e6efae04e65db962225a09b patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/gtk2-2.2.1-102.i586.pa… b852ce69a5927922488e8476ab538cbb ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/gdk-pixbuf-0.18.0-609.… 1f8a531333bcea1931aa55458d74783a source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/gtk2-2.2.1-102.src.rpm cb96ca0160702b23bfa947df9dd6a75b ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/gdk-pixbuf-0.18.0-609.s… 19c65cf5e847efec236d5c1c1c5bf68c SUSE Linux 8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/gtk2-2.0.6-154.i586.rpm 0deb5df027c6f5380927c688ae2015aa ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/gdk-pixbuf-0.18.0-609.… 635848714d0e82daf67bbdb184b82e1c patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/gtk2-2.0.6-154.i586.pa… 317bf98a5ee87dd6b3e62ef29144ad92 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/gdk-pixbuf-0.18.0-609.… 4066bfc94676589f097b0bfe5492f2b5 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/gtk2-2.0.6-154.src.rpm 7283265c139a32de9cc62eb9ed52d312 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/gdk-pixbuf-0.18.0-609.s… 0496d349d3174f8acf4e51f3c617aa59 x86-64 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-2.2.4-125.4.x… 510586d509e3010b24ea7ed848132291 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-0.22.0-… 24fbedab59dfd403bda2492102d21487 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-2.2.4-125.4.x… 7eb6e9adc8509cd356094c460809324a ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-0.22.0-… 43fc35b1805d48eb2c488033ffb05162 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gtk2-2.2.4-125.4.src.… bda00431cb962a10f973f5553b94a2cf ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gdk-pixbuf-0.22.0-62.… 14a1a69061096c93f7532afc9bc3dd2d SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-2.2.3-54.x86_… 90a63449d75cbc2ab698f500eb596987 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-0.18.0-… 20d0ddb67ef73a71b271e4a66fd613a2 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-2.2.3-54.x86_… 230ecdddec3899cecf93390a9922578d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-0.18.0-… 338cf1416be210ab9e3c49c7b9088074 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/gtk2-2.2.3-54.src.rpm 851fa924bd79e6f1995797ea3d3bea52 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/gdk-pixbuf-0.18.0-610… f90e100d97a015e065b0bb849349d59c ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - mozilla We are in the process of releasing updates for mozilla (and related browsers), fixing various issues: CAN-2004-0597, CAN-2004-0718, CAN-2004-0722, CAN-2004-0757, CAN-2004-0758, CAN-2004-0759, CAN-2004- 0760, CAN-2004-0761, CAN-2004-0762, CAN-2004-0763, CAN-2004-0764 and CAN-2004-0765. We will give you concrete details in a separate mozilla advisory when the updates are available. - mc The console filesystem browser mc was found vulnerable to various meta-char attacks in the extfs perl and shell scripts. These bugs can be exploited by providing a malformed archive file to a victim user to execute shell commands with her/his privileges. (CAN-2004-0494) New packages will be available soon. - squid Certain malformed NTLMSSP packets can crash the NTLM helpers provided by Squid (CAN-2004-0832). New packages will be available soon. - gaim This security update fixes four security issues which are registered as: + CAN-2004-0754 An integer overflow in the groupware message handler exists in Gaim. + CAN-2004-0784 A shell escape vulnerability in the handling of smiley theme tar- ball filenames could lead to arbitrary command execution. + CAN-2004-0785 Buffer overflows in Gaim could lead to a denial of service or arbitrary code execution. Additionally a buffer overflow in the URL parsing code of gaim is fixed. This bug let to remote system compromise with the privileges of the user running gaim. - nessus The nessus-adduser creates temporary files in $TMPDIR in an insecure manner. New packages will be available soon. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQUqvKXey5gA9JdPZAQHcJgf+PU/zjIJLiM5SWYkSSlo42TtNONvIWmiX olcI/gQN1UUevyZTCSkoMlMIVO9VD6BkajQYdVYVnXEs38ZNdjQrTDC0sYUtJL7+ 7p1FyS3EXJvY9j9g+zjiBCLuDipRG3A2FokgMbD7XdGw7Be+6Ujj53adwRbPMEt+ nZUbA0UTzriR9CucMFNSSiMsKmEVWomr9sOGlFQB9jcG/unendda1unEfaJn6mTd gyn6atepgUwPTjaac79b5BpwjuRxgk+usFOgXwZg8IgmiTeXCrx2gopggI2MxA9k swb3baLB2WCY3SSq9QkdhdXt0N2eUjUo3G7bD3MuSJs97Z+ZiEsaig== =zKOM -----END PGP SIGNATURE-----

1 0

SuSE Firewall 2 and PPTP connections
by Vieri Di Paola 16 Sep '04

16 Sep '04

Hi, I'm running SuSE 9.0 with SuSEfirewall2 and poptop. I'm trying to connect from a Windows PPTP client to the Linux box. Connection succeeds (chap authentication ok). However, once connected, I can't PING to any remote host (neither the Linux server nor the PCs behind it, on the remote LAN). I noticed that if I bring SuSEfirewall2 down and I repeat the latter operation, my Windows client can ping the Linux server just fine, but won't ping the hosts behind it probably because forwarding is disabled (? - not really an expert in this). So I guess my problem is that I missed something in the SuSEfirewall2 configuration. Here are my settings: Linux server eth0 has public WAN IP, eth1 has private IP 192.168.1.92. Eth1 links to a switch to which the remote LAN's PCs are connected (all are within the 192.168.1.0 range). Server-side connectivity is OK (I can ping to LAN PCs from within 192.168.1.92). Yast configuration is as follows: * IP forwarding enabled * susefirewall2 config file: FW_QUICKMODE="no" FW_DEV_EXT="eth0 ppp0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="pptp http https 137" FW_SERVICES_EXT_UDP="137 500" FW_SERVICES_EXT_IP="gre icmp 50 51" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="137" FW_SERVICES_INT_UDP="137" FW_SERVICES_INT_IP="gre icmp" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" >From Window client I can connect and a fixed IP is assigned: 192.168.1.101. If I try to ping the remote 192.168.1.92 Linux server (for example; or any other PC on the remote LAN) and I check the Linux server's SYSLOG messages, I get: kernel: SUSE-FW-DROP-ANTI-SPOOF IN=ppp0 OUT=eth1 SRC=192.168.1.101 DST=192.168.1.92 LEN=78 TTL=127 PROTO=UDP SPT=137 DTP=137 LEN=58 So, pinging the Linux server or any host behind it (192.168.1.xxx)from the Windows client doesn't give any response. Any suggestions? Regards, Vieri _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

3 2

su - huh?
by Patrick B. O'Brien 16 Sep '04

16 Sep '04

When I "su -" I get the following. Putting hooks into my .bash_profile file it does not get to that file, so it reads something before aht too? Tia nvlnxt21:/etc # su - -bash: listserv:/root: No such file or directory hit0 hit hit2 nvlnxt21:/root # cat .bas*pro* listserv:/root # cat .bash_profile # .bash_profile echo "hit0" # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi echo "hit" # User specific environment and startup programs set -o vi export PS1=`hostname`':$PWD # ' #export PATH echo "hit2"

3 2

RE: [suse-security] su - huh?
by Wilde Martin 16 Sep '04

16 Sep '04

Hi Eric, you might get stderror and stdout combine by inserting "exec 2>&1" at the beginning of the profile. So you will se everything the shell produces. Additionally you might want to use "exec > /tmp/profile.out 2>&1" in order to store everything into a file. Martin > -----Original Message----- > From: e.mueller [mailto:eric.mueller@eds.com] > Sent: Thursday, September 16, 2004 9:02 AM > To: Suse-Security(a)Suse.Com > Subject: Re: [suse-security] su - huh? > > > Right, > even more additionally be aware that if you write in a script > to stdout > and stderr ( error messages on stderr, the "hitx" on stdout ), the > sequence you see on screen is not necessarily the sequence > the outputs > were initiated. This depends on when which stream will be flushed. > > Normally I would try a <command> 2>&1 for seeing the true > sequence, but > I dont know how this works out with su. > Eric > > > > > > > Wilde Martin wrote: > > Hi Patrick, > > > > additionally you might want to make "set -x" at the beginning of > > /etc/profile - so you will see what commands are executed > during your su and > > you will see which scripts are sourced in what order. As > you can see in > > Armins mail the amount of sourced "profile-files" has > increased (though this > > list is not complete) and obviously still will grow. > > > > > > Martin > > > > > >>-----Original Message----- > >>From: Armin Schoech [mailto:schoech@iap-kborn.de] > >>Sent: Thursday, September 16, 2004 8:17 AM > >>To: suse-security(a)suse.com > >>Subject: Re: [suse-security] su - huh? > >> > >> > >>Hi Patrick, > >> > >> > >>>When I "su -" I get the following. Putting hooks into my > >>>.bash_profile file it does not get to that file, so it reads > >>>something before aht too? Tia > >>> > >>>nvlnxt21:/etc # su - > >>>-bash: listserv:/root: No such file or directory > >>>hit0 > >>>hit > >>>hit2 > >>> > >> > >>--> Have a look at ~/.bashrc, ~/.profile, /etc/bash.bashrc, > >>/etc/profile > >>and any script that is called from within these files. > >> > >>HTH, > >>Armin > >> > >>-- > >>Am Hasenberg 26 office: Institut für Atmosphärenphysik > >>D-18209 Bad Doberan Schloss-Straße 6 > >>Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY > >>Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 > >>WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 > >> > >> > >>-- > >>Check the headers for your unsubscription address > >>For additional commands, e-mail: suse-security-help(a)suse.com > >>Security-related bug reports go to security(a)suse.de, not here > >> > > > > > > -- > Eric Mueller > EDS Operations Services GmbH > Global IMDS Technology Management > Eisenstr. 56, D-65428 Ruesselsheim, Germany > phone : +49 6142 80 1218 > http://services.mdsystem.com > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RE: [suse-security] su - huh?
by Wilde Martin 16 Sep '04

16 Sep '04

Hi Patrick, additionally you might want to make "set -x" at the beginning of /etc/profile - so you will see what commands are executed during your su and you will see which scripts are sourced in what order. As you can see in Armins mail the amount of sourced "profile-files" has increased (though this list is not complete) and obviously still will grow. Martin > -----Original Message----- > From: Armin Schoech [mailto:schoech@iap-kborn.de] > Sent: Thursday, September 16, 2004 8:17 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] su - huh? > > > Hi Patrick, > > > When I "su -" I get the following. Putting hooks into my > > .bash_profile file it does not get to that file, so it reads > > something before aht too? Tia > > > > nvlnxt21:/etc # su - > > -bash: listserv:/root: No such file or directory > > hit0 > > hit > > hit2 > > > --> Have a look at ~/.bashrc, ~/.profile, /etc/bash.bashrc, > /etc/profile > and any script that is called from within these files. > > HTH, > Armin > > -- > Am Hasenberg 26 office: Institut für Atmosphärenphysik > D-18209 Bad Doberan Schloss-Straße 6 > Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY > Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 > WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

SUSE Security Announcement: cups (SUSE-SA:2004:031)
by krahmer＠suse.de 15 Sep '04

15 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: cups Announcement-ID: SUSE-SA:2004:031 Date: Wednesday, Sep 15th, 15:30:00 MEST 2004 Affected products: 8.1, 8.2, 9.0, 9.1 SUSE Linux Enterprise Server 8, 9 SUSE Linux Desktop 1.0 Vulnerability Type: remote code execution Severity (1-10): 6 SUSE default package: Yes. Cross References: CAN-2004-0801 CAN-2004-0558 Content of this advisory: 1) security vulnerability resolved: - remote command execution and remote DoS in CUPS problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - squid - OpenOffice - mozilla - mpg123 - ImageMagick 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion The Common Unix Printing System (CUPS) enables local and remote users to obtain printing functionallity via the Internet Printing Protocol (IPP). Alvaro Martinez Echevarria has found a remote Denial of Service condition within CUPS which allows remote users to make the cups server unresponsive. Additionally the SUSE Security Team has discovered a flaw in the foomatic-rip print filter which is commonly installed along with cups. It allows remote attackers, which are listed in the printing ACLs, to execute arbitrary commands as the printing user 'lp'. 2) solution/workaround If you use CUPS, we recommend an update in any case. Additionally the IPP port (TCP port 631) should be firewalled and the printing ACLs should be set up in a way to reflect the local security policy. 3) special instructions and notes After successfully updating the cups package, you need to run the following command as root: rccups restart 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cups-1.1.20-108.8.i586… 976655f117091c2bbc78399ffedf6c9c ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cups-libs-1.1.20-108.8… f4af26bd260fc756e2070c340105295d ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cups-client-1.1.20-108… 90cf964bf8b3ea5567754b15c0ab6988 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/foomatic-filters-3.0.1… b67b7187ecb708d7ec2980f7cdcdaa81 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cups-1.1.20-108.8.i586… ce0f75db69c838557ecda3e3300bb763 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cups-libs-1.1.20-108.8… 213cbdc01c0f39895f75eb6816641b82 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cups-client-1.1.20-108… 9c47790dcd6fa339ea7a8d21ad841e54 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/foomatic-filters-3.0.1… 8ccae3fb4988acf0c829ffe491472716 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/cups-1.1.20-108.8.src.r… 96a63ac94b63f0d54d16bd2d3ea73a24 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/foomatic-filters-3.0.1-… 18816a89350fe3fa234506d40e4812b1 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cups-1.1.19-93.i586.rpm f72e1b1c033695ef9f3fe9a64ace220b ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cups-libs-1.1.19-93.i5… 46f540ce3bcf72a870eeb2ef78d1e7ec ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cups-client-1.1.19-93.… 9c9d4eb93c3dbf2ad740f6041224ff90 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/foomatic-filters-3.0.0… 4f5c750a1f756161407e4186b378ac51 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cups-1.1.19-93.i586.pa… 91b88efa969bb367ead02dfa686f5711 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cups-libs-1.1.19-93.i5… 9952d1df78213228f1a0fc129c60331a ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cups-client-1.1.19-93.… e83d2d6a85445fdaf186e4eba91a68da ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/foomatic-filters-3.0.0… 3d91bc3f72cfb8efa4c1a38bf6a46d60 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/cups-1.1.19-93.src.rpm 236dd9aab66ee87ef73cfe9c7a4dd3a4 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/foomatic-filters-3.0.0-… 56b6200d339a0bd727b102b65d327493 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cups-1.1.18-96.i586.rpm 5092cfbf2d9f71b53cfa571d23ac8e26 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cups-libs-1.1.18-96.i5… 1b52320ac8e50797b9e140ba0339008c ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cups-client-1.1.18-96.… b0cc87346a3b2270081123bbb5fd932a patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cups-1.1.18-96.i586.pa… d67014a864afaa86952ed752d89a251a ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cups-libs-1.1.18-96.i5… be6ae574c2f26a7f07d1b5e16f4ede02 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cups-client-1.1.18-96.… c176435d584a763ae5b57dcde996f82c source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/cups-1.1.18-96.src.rpm 870f0825115fdf9526beb6e1ec867381 SUSE Linux 8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cups-1.1.15-170.i586.r… b8a1daf19c2fa58fecc3f9dafb8c4c8d ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cups-libs-1.1.15-170.i… 9f7a2dbc92804cb54749e72426d79a62 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cups-client-1.1.15-170… 7a82aedac6586fa27109e3576f5c4c27 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cups-1.1.15-170.i586.p… 341ebcf57e793a836b5475353cb21e7c ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cups-libs-1.1.15-170.i… 3b75cf2265150044560555785e8e4c82 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cups-client-1.1.15-170… 926eca878ee8c36c4efa509d7b7243d4 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/cups-1.1.15-170.src.rpm ffc7b24d6638f04933621b9b49bb9e9e x86-64 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cups-1.1.20-108.8.… fc7b3c21d0bdd1b5617263045a0f0058 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cups-libs-1.1.20-1… 4490d72429d54417049a4daabc763e56 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cups-client-1.1.20… 23e430a166baef8840b067f71b7ae96d ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/foomatic-filters-3… cfc0d3052c29da4e9b9bccac8cb0211e patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cups-1.1.20-108.8.… 4f347e2efa5151cee929889b18ddfed4 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cups-libs-1.1.20-1… 5157c96ec037e965c39ee0139c6287cf ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cups-client-1.1.20… ef1f955450463ee0a751ae1a4f5ceacc ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/foomatic-filters-3… 4f34ffee4f359ca09eaf481c2904796e source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/cups-1.1.20-108.8.src… 00ecd612999696c7f3a4e531c1a2198e ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/foomatic-filters-3.0.… 33e32a64142f72a224691d64c50f9f66 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cups-1.1.19-93.x86… 1b68c217134d058a5036f9a0058ddd0d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cups-libs-1.1.19-9… 1d48cc152e891fb3baeb2d2409830878 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cups-client-1.1.19… a313c4956f44e230c0df9909ba0a7d25 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/foomatic-filters-3… 9b4d8b411702153be4a73222e6a12553 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cups-1.1.19-93.x86… f7bda7125579c9bda8cfd9f4e0f6f4a0 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cups-libs-1.1.19-9… 608d96f3f6566a65e70a57fcc367f777 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cups-client-1.1.19… a7d38ee463699f6152f8e42ee1da745d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/foomatic-filters-3… c83d5f8d7d41083bdad779505b777d11 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/cups-1.1.19-93.src.rpm c05016dadf2756e7e66c32c2c2b25858 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/foomatic-filters-3.0.… aa0436134b6b46418455e1c5235c36c0 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - squid The NTLM authentication in squid suffers from a DoS vulnerability. New packages are currently being tested and will soon be available on our ftp servers. - OpenOffice OpenOffice sets the permissions of tmp-files according to the umask, which might be unsuitable. This will be fixed in upcoming distributions. If you work in an untrusted environment, you may set the $TEMP, $TMP and $TMPDIR environment variables to a location within your $HOME as a workaround. - mozilla We are in the process of releasing updates for mozilla (and related browsers), fixing various issues: CAN-2004-0597, CAN-2004-0718, CAN-2004-0722, CAN-2004-0757, CAN-2004-0758, CAN-2004-0759, CAN-2004-0760, CAN-2004-0761, CAN-2004-0762, CAN-2004-0763, CAN-2004-0764 and CAN-2004-0765. We will give you concrete details in a separate mozilla advisory when the updates are available. - mpg123 A buffer overflow in the decoding of data streams has been fixed. New packages are available on our ftp servers. CAN-2004-0805 has been assigned to this issue. - ImageMagick A buffer overflow in the code handling BMP images has been fixed. New packages are available on our ftp servers. CAN-2004-0827 has been assigned to this issue. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBQUhF9ney5gA9JdPZAQGH7gf/epYSwaWsZXV80JNzDitZ4xSxm8RFWCXh iTLA+YQ6cBPbhPDLIUYA9zI/iGIjQeSYfU5olPqhbd8DjUDL/i7jJlbyZeAVAHuO i57O6YIgKbhvrP/zbW2PGbO73e91Mfl1nyy+BapNp/xHLcBue/gVi6zG+vgQAxUp f0bg9jA7TZrm28Lmb6ImkgGqmQbgmyEwRSe/HTN8r0vFqppT5AjZsIm1EtXliQlx LIEqWK2jBpfWME2j+TjS14t95uuS+FIR1upEAewjOBVcYgV60nbyoUR7O+WtwSof /lTNwvGh6mcY2u99tdxeuYe3m/lvcwrCtKiTrXnVsyko+Fa9/gBOCg== =wF7S -----END PGP SIGNATURE-----

1 0

Re: [suse-security] Issues with pptpd
by Johannes Becker 14 Sep '04

14 Sep '04

Hi! First idea: Is it an authentication problem? As far as I know, different versions of MS Windows use different authentication methods by default (PAP, CHAP, CHAP2 etc.). To figure out the exact source of the problem, you might try to configure the clients and the server to use only PAP for authentication and then step by step try the other authentication methods. Of course, you should finally disable PAP authentication again, as it uses cleartext passwords and therefore is rather insecure. CHAP is considered insecure, too, but CHAP2 needs a special kernel patch, being based on a patented algorithm. That could be another source of your problems. Are there any errors reported in /var/log/messages? Best regards, Johannes Am Freitag, 10. September 2004 16:34 schrieb Joebstl Thomas: > Hi, > > I'm experiencing some weird issues with pptpd: > The pptp server has an external interface with a routeable IP and an > internal interface with 10.x.x.x IP where clients should connect to from > our wlan and get assigned routeable IP's as well. > pptpd is configured to listen on the internal 10.x.x.x address and > accepts incoming calls fine, but some clients can never successfully > establish a connection. > I cant isolate the problem to a specific group of clients though - after > a reboot (rcpptpd restart doesn't change anything) win98/ME/XP clients > can connect, after the next restart only 98/XP, then only ME and so forth. > I'm really getting annoyed with that stuff - latest version which works > for me now is the one in Debian 3.0 which is ancient. > > I've had a tcpdump running and it showed some really weird traffic from > pppd. Everytime a client couldnt establish a connection pppd used the > external routeable IP as source IP for its packets - although ps awx and > debug/dump show that it gets the proper local (10.x.x.x) IP address > specified on the command line. > > The system is running 9.1 Pro with the latest updates as of 2 hours ago. > I think I had it working before on a system running either 9.0 or 9.1 > without any updates, but I cant remember exactly and thanks to maxtors > QA department I cant check it anymore since the hdd is dead.... > > Would be nice to get some clues how to get it working reliable again. > > Regards, > > Thomas -- Dipl.-Vw. Johannes Becker Alfred-Weber-Institut für Wirtschaftswissenschaften der Universität Heidelberg Lehrstuhl für Statistik Hauptstraße 126 D-69117 Heidelberg Telefon: +49-(0)6221-54 2931 Telefax: +49-(0)6221-54 3589 e-Mail: Johannes.Becker(a)urz.uni-heidelberg.de WWW: http://wss.uni-hd.de

2 1

RE: [suse-security] Kernel update
by Wolf Josef 14 Sep '04

14 Sep '04

Marcus Meissner [mailto:meissner@suse.de] wrote: > On Mon, Sep 13, 2004 at 12:38:12PM -0400, Selcuk Ozturk wrote: > > At the time of last 2.6 kernel update, updates for the various 2.4 > > kernels was promised. It has been about 2 weeks since then > > and I still don't see any new 2.4 kernels. What is the status on > > these? > > Were they maybe not affected by the latest bugs? > > They are still in our update queue. While at it: The web pages that used to list available updates (for example http://www.suse.de/de/private/download/updates/91_i386.html ) don't list them anymore. Were they moved to a different place?

2 1

Fou4s 0.12.1 released
by Markus Gaugusch 13 Sep '04

13 Sep '04

Many thanks to all contributors and people who sent me mails about bugs in the last version! I just released fou4s 0.12.1 with the following changes: - The --checkdeleted option was broken (Please not that it doesn' work at all on SuSE 9.0/9.1 because I just can't find any deleted files after an update there - if you do, please tell me) - The kernel update reboot reminder did not work on SMP machines - Servers with user:pass URLs were not parsed correctly - The nagios check script was updated (thanks to Christoph Wegener) The latest version is available via "fou4s -ui --checkf" or from my homepage: http://fou4s.gaugusch.at/ kind regards Markus Gaugusch -- ____________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

FTP server dirctory layout
by Muhammad Reza 13 Sep '04

13 Sep '04

Dear Lists What its exactly directory layout for FTP Installation server suse-9.1 ? -- regards, reza "Name one thing UNIX can't do that Win can, and I'll name 100 things it can't do that UNIX can"

1 0

Kernel update
by Selcuk Ozturk 13 Sep '04

13 Sep '04

At the time of last 2.6 kernel update, updates for the various 2.4 kernels was promised. It has been about 2 weeks since then and I still don't see any new 2.4 kernels. What is the status on these? Were they maybe not affected by the latest bugs? Selcuk

2 1

Tripwire vs rootkit Hunter
by John 13 Sep '04

13 Sep '04

Which is best? Has anyone tried both these tools?

2 2