April 2005 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Paranoid File Permissions
by Ian Douglas 21 Apr '05

21 Apr '05

I haven't worked out why the login error occurs, but it is annoying. However, you can easily fix the su problem by editing the /etc/permissions.paranoid file and changing the value of /bin/su from 0755 to 4755 as shown below (this may have security implications for others!!): # suid system programs that need the suid bit to work: # /bin/su root:root 4755 Run "SuSEconfig" to update the file or change permissions manally. This at least will allow users to su to root. This was critical on a couple of boxes I had that were headless and keyboard-less, and root logins had been disabled! Bear in mind, any updates may change the value back. Cheers Ian -----Original Message----- From: White, Joseph [mailto:jwhite@sandia.gov] Sent: Thursday, April 21, 2005 8:28 AM To: suse-security(a)suse.com Subject: [suse-security] Paranoid File Permissions Hi All, Using Suse 9.2 /KDE w/GDM Has anyone noticed if you go into Yast and select security, then custom, and change file permissions from "Easy" to "Paranoid", once you do that you will not be able to unlock your screen saver or su to root. Also, if your logged in as a regular user and you launch Yast it will ask for you root password, probably just anther su function, but that won't work any longer as well. You have to log out and log back in as root to run Yast to undo the setting. It is probably messing with 'pam' in some strange way, but don't know exactly. Thanks, Joe -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

OpenOffice_org 1.1.3 update (for SUSE 9.3)
by pelibali 21 Apr '05

21 Apr '05

Hi, Is there an update scheduled for the "obsolete" OpenOffice_org 1.1.3 package included on SUSE 9.3? For the 1.9.79 series there are updates provided, but in fact nothing for the 1.1.3 variant. Just have to wait a little, or no chance? Thanks, Pelibali

2 1

Paranoid File Permissions
by White, Joseph 20 Apr '05

20 Apr '05

Hi All, Using Suse 9.2 /KDE w/GDM Has anyone noticed if you go into Yast and select security, then custom, and change file permissions from "Easy" to "Paranoid", once you do that you will not be able to unlock your screen saver or su to root. Also, if your logged in as a regular user and you launch Yast it will ask for you root password, probably just anther su function, but that won't work any longer as well. You have to log out and log back in as root to run Yast to undo the setting. It is probably messing with 'pam' in some strange way, but don't know exactly. Thanks, Joe

1 0

YOU installs RPM with bad MD5 checksum
by Klaus Layer 20 Apr '05

20 Apr '05

Hi all, I just installed the security updates for wget and openoffice. During checking the RPM checksum YOU reported a wrong checksum but instead of canceling it installed the RPM: ---------------------------------------------------------------------- OpenOffice_org: "Ein freies Office-Paket (der sprachunabhängige Teil)" wird abgerufen ... Ok wget: "Programm zum Spiegeln von HTTP- und FTP-Servern" wird abgerufen ... ERROR(You:Die MD5-Prüfsumme passt nicht überein.)[Die Datei './i386/update/9.2/deltas/wget-1.9.1-50.4_50.6.i586.delta.rpm' besitzt eine falsche MD5-Prüfsumme: '58239d09af0b5aea88973fea3503ed11' != '384843093d16aa8489b550c5e957c426'] Ok Delta wird angewendet ... Ok Delta wird angewendet ... Ok OpenOffice_org: "Ein freies Office-Paket (der sprachunabhängige Teil)" wird installiert Ok wget: "Programm zum Spiegeln von HTTP- und FTP-Servern" wird installiert Ok Installation abgeschlossen. 2 Patches wurden installiert. ----------------------------------------------------------------------- I cant believe it. If YOU ignores bad checksums this would be a major security hole. Can anyone from SUSE please comment on this. Thanks, -- Klaus Layer .~. Walldorf /V\ Germany // \\ EMail: klaus.layer(a)gmx.de /( )\ ICQ: 230933667 ^`~'^ GnuPG Fingerprint: 466D 12F8 28A3 D137 A77E FC3B 271C 2D79 6F5E 94C9

1 1

Samba Problem?
by Philippe Vogel 20 Apr '05

20 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Yesterday I backuped my dayly data to my home samba share while listening to some music from the same share. After copy was finished the server crashed. Is there a filehandler problem in SuSE 9.1 with current samba and current smp-kernel? For me it looks like this as I got this behaviour the second time. Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQmaZLUNg1DRVIGjBAQIdywcAi53mJ/oRXG0A62eRRnFQqWvD/UzBZfev 7L4n9D5opKTNyKZANYsANon3JSWgcBit3nDSqyfToeaQFo73xxeXuwnR0Py6Ph9H vHyZQmNK5AxSJhlQooEgRgBPIXj/YpSyremOvB99ClraB0cmpbG95u7uSMyNqg8N 2llFXLV/OHaAZy6Ifnl6vR6kLwDLGEiuMMxprdTlNe15bQWJh+vJXjG0fScidgB9 KslI59BP1XLv7R2YW4MMsVuORKV18vRFXGpDEYBV0q9MS5nreZ5JEyQs9IP9ctzC VbybbH2bBck= =nzrM -----END PGP SIGNATURE-----

1 0

SUSE Security Announcement: RealPlayer buffer overflow in RAM file handling (SUSE-SA:2005:026)
by Marcus Meissner 20 Apr '05

20 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: RealPlayer Announcement-ID: SUSE-SA:2005:026 Date: Wed, 20 Apr 2005 09:00:00 +0000 Affected products: 9.2, 9.3 Novell Linux Desktop 9 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE default package: yes Cross References: Content of this advisory: 1) security vulnerability resolved: buffer overflow in RAM file handling problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: See SUSE Security Summary Report. 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion This update fixes a security issue within the RealPlayer media player. A remote attacker could craft a special .RAM (Real Audio Media) file which would cause a buffer overflow when played within RealPlayer. This is the Real Player Update as referenced on this page: http://service.real.com/help/faq/security/050419_player/EN/ 2) solution/workaround None, please install the updated packages. 3) special instructions and notes Restart RealPlayer if running. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/RealPlayer-10.0.4-1.1.… b6ca6d5c87690fca385981ccf272ddf1 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/RealPlayer-10.0.4-1.1.… 7e87cb712e6f07b9bdefe4f2ea79d6d0 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQmYE/3ey5gA9JdPZAQGn2ggAl+THJtR4kixnP9wihTn7TSm+bEIpD8Sl tTtTWyE45ivyMeiwfhzNbkO8wb4vfUBCA6mHlzufIic5iZ93VPprPaO9Za1Y+Pmb YcuzLwMHaTPx7oDy2j0BbCG2gntXgK6PgIuvACYPyGxYjh8XgH48knCKyiP5jgzQ weZQAZ9kHn+SDLoFzHSW7D9wa3G5e/8Z3hsQXBUSv0/EtgLHzyzMbkdiT6kVczXe av0+pzZVpVWB/Z8DKTFK20ENL1QJYRkFt2jq9FM5NkPABIgtgYbEgH2/KoTwx29w d3FrTm7HI5PBfE/HisCmV2lc79p3BG0tHr+JNfpnV/IO1KF9quvHmQ== =CqtJ -----END PGP SIGNATURE-----

3 5

SUSE Security Announcement: PostgreSQL buffer overflow problems (SUSE-SA-2005:027)
by Marcus Meissner 20 Apr '05

20 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: postgresql Announcement-ID: SUSE-SA:2005:027 Date: Wed, 20 Apr 2005 09:00:00 +0000 Affected products: 8.2, 9.0, 9.1, 9.2, 9.3 SUSE Linux Desktop 1.0 SUSE Linux Enterprise Server 8, 9 Novell Linux Desktop 9 Vulnerability Type: remote code execution Severity (1-10): 5 SUSE default package: no Cross References: CAN-2005-0247 Content of this advisory: 1) security vulnerability resolved: code execution due to bugs in several SQL commands problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: none 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion Several problems were identified and fixed in the PostgreSQL database server. Multiple buffer overflows in the low level parsing routines may allow attackers to execute arbitrary code via: (1) a large number of variables in a SQL statement being handled by the read_sql_construct() function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function. This is tracked by the Mitre CVE ID CAN-2005-0247. 2) solution/workaround None, please install the updated packages. 3) special instructions and notes If you are running a PostgreSQL server please make sure that it is stopped or at least doesn't have any client connections during the update. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-8.0.1-6.i58… 678cf8fac25f43217a75ff1b69afa1e1 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-contrib-8.0… 9f71e3a477cb37e96b6252d3e41af5d0 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-devel-8.0.1… 13befe8d62a70898b576f46332b04016 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-docs-8.0.1-… d51a60a473567c87c3f94cc0d5abde2d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-libs-8.0.1-… 50af9cba7571c4859b033a420782c5c3 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-pl-8.0.1-6.… 3d68c0e2f026e3c1f1d33ec828ade723 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-server-8.0.… 4601a1e4308348a7a27fbe4dd0bfe029 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-libs-32bi… 55c4a7c5b510b4a05b789540adbcca00 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-7.4.7-0.3.i… 6d5ca6b626a70cee2b34e49d33855648 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-contrib-7.4… 62020a1c26ed41635cf07f37f1c22817 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-devel-7.4.7… eb20f825e8c1ee955e6904bd718ad1ba ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-docs-7.4.7-… 79194edc8a6a6ad10104b964e66cf789 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-libs-7.4.7-… 67353952335be148e0f3719a50edf8c5 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-pl-7.4.7-0.… caad51baf0dfca24df09fec5d4385555 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-server-7.4.… 55a89a0f695e5dc892fa31af6140e367 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-libs-32bi… 91ac32a40b548d187ca78fb095f182ac SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-7.4.7-0.5.i… 7027aa706e60a5074b294edba529479c ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-contrib-7.4… f7f3ef933b3cef23e892ede41d30b7e2 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-devel-7.4.7… 8b48f30541f0834d14c7c1297202a55f ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-docs-7.4.7-… e4456b0be9e08ffab52bc8476d2a25c8 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-libs-7.4.7-… 9a936afc00a75b243c7c7bd040eb3e97 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-pl-7.4.7-0.… 7037b8f9f9ca4d0c3325b1f52a38338c ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-server-7.4.… a6699829779cf0f1adc9eb899e028cce ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/i586/postgresql-libs-32bi… 6d7c782b577a97024d5b388957686eb9 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/postgresql-7.4.7-0.5.sr… 10074702f7983e615b0d4da932915419 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-7.3.9-7.i58… dbefa2ff236099277275e050196832f9 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-contrib-7.3… 9e933821ae869b86c9dbb9899df86d75 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-devel-7.3.9… 8c2f83c0acb4bda10989a90082126324 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-docs-7.3.9-… 4fa5151ac425ef2765600082c8772d38 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-libs-7.3.9-… c038222567e7692081dfef91f56fa73b ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-pl-7.3.9-7.… 57730936587d5214f45d498721abc0d4 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-server-7.3.… a66b7aa7172c4accefad29b98b725452 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-test-7.3.9-… c2d0256ea4ce83f12e73e4f23a0f4929 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/i586/postgresql-libs-32bi… 0a754eb5f8535cd7a291ffefb724f537 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/postgresql-7.3.9-7.src.… 174eb88726ae089eb80327613d0191c9 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-7.3.9-6.i58… a2b5993ddc330ffc4caf596b95cd44da ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-contrib-7.3… 80f40fb76c5eb8b04634836f5da87839 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-devel-7.3.9… e97783f94a2e103b4f36d8309525e03b ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-docs-7.3.9-… df6f2407af9063765d3100efda4e9fd7 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-libs-7.3.9-… 158525f64b5ce8b4e84307442c55cf69 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-pl-7.3.9-6.… b214dab6c7691e408c8cb94f3d89266b ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-server-7.3.… ef2c190ddcca664c6d24c30cee18b06a ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-test-7.3.9-… 598bc10d2956c68c44bbc15c1048b961 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/postgresql-7.3.9-6.src.… b9607afe3c591211cd4828387b78e844 x86-64 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-8.0.1-6.x… a608a80f0c5e52244ef0e06f71179eec ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-contrib-8… 3fc4c4e413857244670ec31d132ecf6e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-devel-8.0… 604493537efd3eefdb6c2268c76d9fce ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-docs-8.0.… 4f9cdf3fef5cbc05655a61c0d40188ac ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-libs-8.0.… 1693e687c7175143a8417a1971b7561d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-pl-8.0.1-… 231201858f97d931a342cc54197fede0 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-server-8.… cf53838797c30f7c0d6c20780b3df994 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/postgresql-8.0.1-6.src.… 72d273fb0e710ce3b36f8a75760faca0 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/postgresql-pl-8.0.1-6.n… b12ca9ab8d1e1403d64608447cef61af SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-7.4.7-0.3… 376426e12fa067ed9750ff729e7af64f ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-contrib-7… a2a1174114c9f2cd8b0bd24dc15603ad ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-devel-7.4… 52c49022348810ee55dc74a986a10324 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-docs-7.4.… c4ffdce772938cb5ca851a09eb05ccb9 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-libs-7.4.… b89fbdd68337b6f6d557e030fdee385c ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-pl-7.4.7-… 6fe8b6011a779152b659b85278176084 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-server-7.… 94bd74ce6d5e215c0cc910227606b081 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/postgresql-7.4.7-0.3.sr… b8c6138e39ecc4c75537c7bf99cbcee4 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/postgresql-pl-7.4.7-0.3… e9c71d98739d760557aa9719ac45083b SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-7.4.7-0… 000d9921b17457f420806deb0b52b864 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-contrib… 7ae07a0f82e1c752a43f1d2f1d6f76a4 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-devel-7… 959493267003db19075030c88b288e53 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-docs-7.… 452dc62ada42a821a7d6e8bc79e6fbd8 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-libs-7.… 6d07eec96e67f4c3b316b980db2ded02 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-pl-7.4.… a9a394f502ce7d45b72e8d037513cc60 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-server-… 090f72759ce39af0b49170ff3b0e939a source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/postgresql-7.4.7-0.5.… 8bd7c2894ca62fe59e52f5ee79a13a8c SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-7.3.9-7… d9b71b21317c17281a1d0b5ac058ee7e ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-contrib… df00a736fbbc1fe396ca802f28556a6e ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-devel-7… b1bc20c65730504cb68204644b53c3b1 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-docs-7.… aa2a266f6cfb859e248d7c6a9168cd5d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-libs-7.… ff5014d8c7d7c2d3b044bb2f268c0bf8 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-pl-7.3.… 9e9dc0405761bde26676ad71b71d18c8 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-server-… 0235a9bd3d8b582c8eeec89ae5cc02ff ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-test-7.… 2cd64de68e37398c11448271c87d8f9b source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/postgresql-7.3.9-7.sr… cb17afaeae94a5d9c982654047c46b7f ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: none ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQmYWjXey5gA9JdPZAQE2hgf9HiTUk55ar7ggbJwBwSxOOqxLt5fJ4z/E REl6bZM0ti5xuk0dlbQpM4ZlSkQfajpp3SMmou2lsD8ZFteEbmbN/NZvgp3CBZRA Ci8EnTldo3/Sfv9cUj1Obd1CGFYAost0pK+khX3QNGJOfTBOu2HVi6DCaY4PNGcP 8V09PM/8INpcWvvuX+FLZpiHMJlu3JpDArTTsTtulNoIPoe3zKa1Bjns9SdMzD/S 9o5+0xG/ObuOZqomhsBBbb4+u66Rd0fVsLTflEvbaulcvavIhgkyDQn6dkrj9za7 SvJG2vYYXtY3WZWQRJsUiM1AfMAy9mCXflk+Yj7vh1x5iKcCRBntpw== =IWpL -----END PGP SIGNATURE-----

1 0

wget MD5 mismatch?
by Maxim A Belushkin 20 Apr '05

20 Apr '05

While updating my SuSE 9.2 via YaST, just got: Retrieving wget: "A tool for mirroring FTP and HTTP servers" ... ERROR(You:MD5 checksum does not match.)[file './i386/update/9.2/deltas/wget-1.9.1-50.4_50.6.i586.delta.rpm' has wrong MD5 checksum: '58239d09af0b5aea88973fea3503ed11' != '384843093d16aa8489b550c5e957c426'] Ok Installing wget: "A tool for mirroring FTP and HTTP servers" Ok Erm, isn't that wrong? A) If the checksum was wrong, why did YOU install it? B) What's up with the checksum?

3 2

SuSE Firewall2 and ethernet bridging
by Marc Rieber 19 Apr '05

19 Apr '05

Hallo, I want to connect two networks via openvpn. Each network is connected over a suse linux 9.2 router to the internet. On each router i created a tap0 device for the openvpn connection and bridged it to the eth0 device which is the device to the internal network. Everything works fine, but I have problems with the firewall. I can ping router 1 form router 2 and router 2 from router 1. If I try to ping a pc behind router 1 from router 2 and on the other way, it doesn't work. In the log file I get the following message: SFW2-FWDint-DROP-ICMP-CRIT IN=br0 OUT=br0 PHYSIN=tap0 PHYSOUT=eth0 SRC=192.168.0.1 DST=192.168.1.50 .......... Broadcasts were also filtered. Does somebody know how to configure the SuSEFirwall2, that all traffic from PHYSIN=tap0 to PHYSOUT=eth0 and on the other way with a source address of the internal network can go through the firewall. Thanks in advance Marc

3 4

LAUS in Suse 9.2 Professional
by White, Joseph 19 Apr '05

19 Apr '05

Hi All, I need to install LAUS on a Suse 9.2 Professional machine. I have found packages for Suse Enterprise 9 but not for 9.2 Pro. I believe the packages are built for certain kernel versions, and require a kernel patch, where can these files be found. I see that Suse 9.3 is now out, is all the pieces for Laus included with that distro? Any Help Greatly Appreciated! Joe White

2 1

Windows Update through Squid cache fails
by SuSE Security 18 Apr '05

18 Apr '05

I have configured the (Windows XP) clients on the LAN to use Squid as a proxy for web access. This (mostly) works without any issues. However, the latest batch of updates from Microsoft are causing severe problems. The XP clients are not able to download two updates (the ones mentioned in KB890859 and KB890923). The following is logged in the access.log of Squid: 1113736515.291 300331 winxp.de-korte.org TCP_MISS/200 535 GET http://au.download.windowsupdate.com/msdownload/update/v5/psf/windowsxp-kb8… - DIRECT/63.236.111.222 application/octet-stream 1113736579.898 302423 winxp.de-korte.org TCP_MISS/200 430 GET http://au.download.windowsupdate.com/msdownload/update/v5/psf/windowsxp-kb8… - DIRECT/213.200.98.29 application/octet-stream 1113736880.519 300381 winxp.de-korte.org TCP_MISS/200 430 GET http://au.download.windowsupdate.com/msdownload/update/v5/psf/windowsxp-kb8… - DIRECT/206.24.192.222 application/octet-stream Obviously, the client in question (all show similar behaviour) are using Squid, but somehow the downloads are aborted after about five minutes. With the network connectivity available at that time, about 30MB is downloaded then. I then tried to download both files with 'wget' (which is configured to use the same Squid proxy) and ended up with two files of 334MB (!) and 60MB respectively. Also, when the clients are instructed to bypass Squid (having a PAC file is very useful in these cases), the downloads went smooth too. Apparently, Windows Update doesn't like the way Squid is configured now. Is there some kind of issue with Windows Update and Squid? Regards, Arjen

3 2

Mozilla Firefox JavaScript Engine Information Disclosure Vulnerability
by Anthony Edwards 18 Apr '05

18 Apr '05

A new, quite fascinating vulnerability was apparently discovered today, which allows attackers to craft custom JavaScript code in order to gain access to information contained in system RAM; all current versions of Mozilla Firefox are believed to be affected: http://secunia.com/advisories/14820/ An intriguing test for this vulnerability (watch information contained in system memory echo to the screen!) appears here: http://secunia.com/mozilla_products_arbitrary_memory_exposure_test/ A temporary workaround is to disable JavaScript support, however SuSE will be releasing a patched version of Firefox presumably? -- Anthony Edwards anthony.edwards(a)uk.easynet.net

6 11

SUSE Security Announcement: cvs (SUSE-SA:2005:024)
by krahmer＠suse.de 18 Apr '05

18 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: cvs Announcement-ID: SUSE-SA:2005:024 Date: Monday, Apr 18st 2005 13:30 MEST Affected products: 8.2, 9.0, 9.1, 9.2, 9.3 SUSE CORE 9 for x86 SuSE Linux Enterprise Server 8, 9 UnitedLinux 1.0 School-Server 1 Open-Enterprise-Server 9 Vulnerability Type: remote code execution Severity (1-10): 6 SUSE default package: No Cross References: CAN-2005-0753 Content of this advisory: 1) security vulnerability resolved: buffer overflow and memory access problem in cvs problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - IDN (Internationalized Domain Name) cloaking - PostgreSQL - Mozilla - OpenOffice_org 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. The current maintainer of CVS reported various problems within CVS such as a buffer overflow and memory access problems which have been fixed within the available updates. The CVE project has assigned the CAN number CAN-2005-0753. 2) solution/workaround There is no easy workaround except shutting down the CVS server. 3) special instructions and notes No special actions need to be taken after installing this update. 4) package location and checksums Download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered for installation from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/cvs-1.12.11-4.2.i586.r… 8e27dd3b7a9867940830aa9dd8fd95bc patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/cvs-1.12.11-4.2.i586.p… acd6904641df500ca50da8147ee54019 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/cvs-1.12.11-4.2.src.rpm 6a075a97c2bd30ade965e90e0f9671c4 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/cvs-1.12.9-2.2.i586.rpm 7192dce3bb42cd51c98a3510e9e5e73a patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/cvs-1.12.9-2.2.i586.pa… ae4b8f9096b50e7f1c3a15e715e4c8e7 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/cvs-1.12.9-2.2.src.rpm cebc4e07ac34f6a6f76789d6ce0eba37 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cvs-1.11.14-24.10.i586… 07778aea3050bcf05c96ae680b9d01e4 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cvs-1.11.14-24.10.i586… 60591530555521e34d798a0d0365686a source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/cvs-1.11.14-24.10.src.r… bd4b0324b51cee45f247e41f2f6139d4 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-85.i586.rpm 795f6e5a6849706bb439366129833841 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-85.i586.pat… ec2bb29f912831f9d5e7dd15ec950d9b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/cvs-1.11.6-85.src.rpm a3695ffd8f741a9f376e5e3244d412c8 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-116.i586.rpm 6fc24ea4712d10855e60d26b9262f48c patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-116.i586.pa… 7b4e1cae79c33c4965b53159bd888a70 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/cvs-1.11.5-116.src.rpm 401896062510804b79ba75a5e800d9e2 x86-64 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/cvs-1.12.11-4.2.x8… db2665d2e95762aa2c376fed929c44f1 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/cvs-1.12.11-4.2.x8… 8b3070a29bd15c430980937b53928640 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/cvs-1.12.11-4.2.src.r… 6a075a97c2bd30ade965e90e0f9671c4 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/cvs-1.12.9-2.2.x86… 21518326918a0a7e42176b60544e214e patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/cvs-1.12.9-2.2.x86… 8bbb9b4bda742cb62836b6a6453aef2c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/cvs-1.12.9-2.2.src.rpm cebc4e07ac34f6a6f76789d6ce0eba37 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cvs-1.11.14-24.10.… 7543263ca5374da3a9926cde6c8bd58c patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cvs-1.11.14-24.10.… 1b245e5669be7b6e082c67d5e094466a source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/cvs-1.11.14-24.10.src… 8c399e20f6046faa3de70ae0fc133060 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-85.x86_… 708318fbf0d27efd212c16ac26f63003 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-85.x86_… 7d5f303351ae584f07998847cc476f7c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/cvs-1.11.6-85.src.rpm ff6eddc0257dfd8dfa1b97653117d2c7 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - IDN (Internationalized Domain Name) cloaking / homograph attacks Problems with the IDN / punycode handling that allows non-ASCII domain names were reported for every browser. - The KDE approach is currently filtering on the top level domain. - The Mozilla approach is currently to display punycode. We have released Mozilla Firefox and KDE / konqueror updates for this problem, the others (mozilla suite and opera) are still pending. - PostgreSQL problems Additional PostgreSQL problems were reported: - A local user could bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. CAN-2005-0244 - Other earlier listed problems are already fixed. We are still working on updates for this problem. - new Mozilla security problems Several new Mozilla browser security problems have been reported. We are currently addressing these issues. - OpenOffice_org heap overflow A heap overflow was found in the MS Word document handing of OpenOffice_org, allowing a remote attacker to execute code via a handcrafted .doc file. We are preparing updates for this issue. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We recommend against subscribing to security lists that cause the e-mail message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the file name of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.7 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBiEYEExECAAYFAkGJG+YACgkQGsiRhDTRlzm8CQCg14Wz vg6j45e/r1oyt9EaHhleSacAnA+2dArk1I3xt49Z5rdnhqheF//9mQGiBDnu9IER BACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff4JctBsgs47tj miI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlW t6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcOQliHu8jwRQHx lRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifr ZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBED3+D2t1V/f8l 0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1 krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoEmyW/xC1sBbDk DUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25p bmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkDwmcABAsKAwQD FQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6dNfnwI2PAsgCg jH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzO AKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUD BRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4 fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklL snr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMn snT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/ xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmp U661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0EExECAB0FAjxq qTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1fAJ9dR7saz2KP NwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0EOe70khAIAISR 0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/HZnh3TwhBIw1 FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44ht5h+6HMBzoFC MAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPTtGzcAi2jVl9h l3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM523AMgpPQtsK m9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q2Y+GqZ+yAvNW jRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8QnSs0wwPg3xE ullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWawJxRLKH6Zjo/F aKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ1sj2xYdB1xO0 ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCHORrNjq9pYWlr xsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1wwylxadmmJaJ HzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQYEQIADAUCOe70 kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol0JdGwACeKTtt geVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAKCRCoTtronIAK yofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3coSPihn1+OBNw= =Fv2n - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQmO/u3ey5gA9JdPZAQF6GggAgTCAQEADDglUXgjsnso7O70e676qNHi/ Ftr5gjDFl4D2FTEGCPiaZZLDueyxduETAVs9Aseu8vaiMB1TTbknpB9k40FjU13f tlvbRnFj/bbMk6YxN/dcYm+0YxCmNdc8SEcCLRWTiUAAq9DSi6xdVYo3RfWdzmPe vc/sU24CEPX/nXimtkxevslPAwqV/Wngbhw8AuqWe9VnN/cKQTFmKAYiEyfXe6OK 1WNeZeLb99s0eHPcT7uuxiPd7NxBOF5d5K/Ga9pR5UL/sHX9Dvbn8oeeuVFnlAPP FKXo9as0/yuk/mtQMhoOXLkLgoB/XUu+3WjekRe+PkBzCMBwbVFU1Q== =d+0e -----END PGP SIGNATURE-----

1 0

How to block Acroread 7 with SuSE FW2?
by Al Bogner 18 Apr '05

18 Apr '05

Since I don't like that Acroread 7 sends messages home, I would like to do something like this: iptables -A OUTPUT -m owner --cmd-owner acroread -j DROP How do I include this using the SuSE FW2 of 9.2? Al

10 13

Suppress certain SuSE-FW-UNALLOWED-TARGETIN messages in /var/log/messages and warn
by Joachim Raue 14 Apr '05

14 Apr '05

Hi! I'm frequently getting unallowed targetins from my gateway, which my SuSE firewall logs as: SuSE-FW-UNALLOWED-TARGETIN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:49:1f:70:8e:08:00 SRC=10.0.132.2 DST=224.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=255 I Everything's working fine, I would just like to suppress messages from this specific host in my logs. Is there a way to do so? Cheers, Joachim

1 0

Problems setting up key based ssh access to suse 9.2 ...
by Robert Rozman 14 Apr '05

14 Apr '05

Hi, I have problems setting up rsa based ssh access to suse 9.2 machine. I did this: ssh-keygen -t dsa -C 'root@voipy' cat .ssh/id_dsa.pub >> .ssh/authorized_keys and then corrected /etc/ssh/sshd_config (at the end of email). I did /etc/init.d/sshd restart and I can still log in in old fashioned way with username and password.... I can login also with private key (but it asks for normal user password instead of passphrase of the key??), but I'd like to eliminate old fasioned way... What am I doing wrong ? Thanks in advance, regards, Rob. -----------------------------------------------sshd_config---------------------------------------------------------------- $OpenBSD: sshd_config,v 1.69 2004/05/23 23:59:53 dtucker Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options change a # default value. #Port 22 #Protocol 2,1 #ListenAddress 0.0.0.0 #ListenAddress :: # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 768 # Logging #obsoletes QuietMode and FascistLogging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m PermitRootLogin yes #StrictModes yes #MaxAuthTries 6 RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication IgnoreUserKnownHosts yes # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! PasswordAuthentication no PermitEmptyPasswords no # Change to no to disable s/key passwords ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'yes' to enable support for the deprecated 'gssapi' authentication # mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is included # in this release. The use of 'gssapi' is deprecated due to the presence of # potential man-in-the-middle attacks, which 'gssapi-with-mic' is not susceptible to. #GSSAPIEnableMITMAttack no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication mechanism. # Depending on your PAM configuration, this may bypass the setting of # PasswordAuthentication, PermitEmptyPasswords, and # "PermitRootLogin without-password". If you just want the PAM account and # session checks to run without PAM authentication, then enable this but set # ChallengeResponseAuthentication=no UsePAM yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #UsePrivilegeSeparation yes #PermitUserEnvironment no #Compression yes #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10 # no default banner path #Banner /some/path # override default of no subsystems Subsystem sftp /usr/lib/ssh/sftp-server

3 2

Re: [suse-security] Problems setting up key based ssh access to suse 9.2 ...
by Robert Rozman 14 Apr '05

14 Apr '05

Hi, yes I cannot login in username/password way, but also cannot login with key.... Is problem if I use keys that were generated in Linux on Windows clients (winscp, putty) ? I get this : Authentication log (see session log for details): Using username "root". Unable to use key file "C:\robi\TINIA\ASTERISK_development\Astera 2\id_dsa" (OpenSSH SSH2 private key) No supported authentication methods left to try! Connection has been unexpectedly closed. Server sent command exit status 0. Any advice ? regards, Rob. ----- Original Message ----- From: "Christian Volkmann" <dummy100(a)cv-sv.de> To: "Robert Rozman" <rozman(a)fri.uni-lj.si> Sent: Thursday, April 14, 2005 2:54 AM Subject: re: [suse-security] Problems setting up key based ssh access to suse 9.2 ... > Hi, I am read only to the list. > > you might try to turn this parameter off: > > # Set this to 'yes' to enable PAM authentication, account processing, > # and session processing. If this is enabled, PAM authentication will > # be allowed through the ChallengeResponseAuthentication mechanism. > # Depending on your PAM configuration, this may bypass the setting of > # PasswordAuthentication, PermitEmptyPasswords, and > # "PermitRootLogin without-password". If you just want the PAM account and > # session checks to run without PAM authentication, then enable this but > set > # ChallengeResponseAuthentication=no > UsePAM yes > > Please post to the list if you have success. > > Best regards, > > Christian

1 1

how to do switching between two gateways
by Markus Feilner 13 Apr '05

13 Apr '05

Hello list, we have two dsl gateways with two DSL lines. One line is used for VPN, the other for the rest. I want to test the availability of both lines and switch routing to the other while line one is not available, and back when everything works again. I have read about heartbeat and linux-ha, it works fine, but not for that purpose. Or did I miss something? How would you do that? Any help appreciated! Thanks! -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

3 2

RE: [suse-security] how to do switching between two gateways
by Matt T. Duval 12 Apr '05

12 Apr '05

I would use a commercial box like F5 or radware (sub 10K). If that is not an option, you could use a script that pings a host or hosts and then makes routing changes based on the return. AIX also has a dead gateway detection routine, dunno if this is in Linux. Thank you, Matt Duval Sr. Systems Engineer HealthTrans www.healthtrans.com (720) 493-8252 6061 South Willow Drive Suite 125 Greenwood Village, CO 80111 "Transforming Healthcare, One Transaction At A Time" -----Original Message----- From: Bill.Light(a)kp.org [mailto:Bill.Light@kp.org] Sent: Tuesday, April 12, 2005 11:17 AM To: suse-security(a)suse.com Subject: Re: [suse-security] how to do switching between two gateways Hello list, we have two dsl gateways with two DSL lines. One line is used for VPN, the other for the rest. I want to test the availability of both lines and switch routing to the other while line one is not available, and back when everything works again. I have read about heartbeat and linux-ha, it works fine, but not for that purpose. Or did I miss something? How would you do that? Any help appreciated! Thanks! ===================================== Take a look at http://www.lartc.org/ Lots of goodies that address what you want.

1 0

help: iproute2 portbased routing (in combination with heartbeat)
by Markus Feilner 12 Apr '05

12 Apr '05

Hello List, I need some help about iproute2... I have a linux router / firewall connected via two dsl lines (one fast, one flat) to the internet. heartbeat and linux-ha seem to switch flawlessly when one line disconnects but: [ now comes the hard part: ] I want to forward all our VPN traffic (one UDP port, e.g. 6000) via the fast line. [if this line is down, linux-ha should switch routing, to the other line, but thats another little problem] I did not manage up to now to have the linux router do port-based routing. (even though i read LARTC howto and many other docs.) I know: 1) iptables -t mangle "tags" packets 2) a routing table is added with ip route 3) ip rule add fwmark 4 table should "sort" the packages to the routing tables According to http://www.linux-ip.net/html/adv-multi-internet.html that should be all. But it's not working - why? Is there a mistake in the document? Are there any steps i forgot? -- Mit freundlichen Grüßen Markus Feilner -------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 skype ID: mfeilner mail: mfeilner(a)feilner-it.net -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

1 1

SuSE Firewall
by Guus Teley RI 11 Apr '05

11 Apr '05

Hello, I'm really lost at the SuSE firewall 2. As far as I can see, the ONLY firewall in place is the SuSE firewall, but it doesn't seem to matter what rules I configure, it keeps blocking those ports I thought I'd just opened. The system is up to date as far as patches are concerned. I'm wondering what other mysterious component is acting as a firewall? I recently upgraded from 8.2 to 9.2 I did not see any errors, but did notice that the default KDE login screen keeps saying 8.2 instead of 9.2. Please give me some direction to look for.

6 11

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 11 Apr '05

11 Apr '05

just for the archive, problem solved ! for a little howto, look below my layout: suse 9.x for reverse proxy ( public ip ) | firewall ( allow access on port 443 to internal owa server, restrict from proxy server only: tcp host public-ip host private-ip eq 443) | outlook web access on exchange 2003 ( private ip ) first: enable the formular based login on the owa server for https reverse proxy running now with apache (2.0.5x) apache configure: ./configure --enable-layout=SuSE --enable-headers --enable-ssl --enable-cgi --enable-vhost-alias --enable-dir --disable-userdir --enable-mime --enable-auth --enable-log-config --enable-rewrite --enable-so --enable-cache --enable-dav --enable-mime-magic --enable-proxy --enable-proxy-connect --enable-proxy-ftp --enable-proxy-http --with-ssl=/usr/include/ssl --with-mpm=prefork this apache running as webserver too, for reverse the proxy parts the important add to http.conf: Listen 443 NameVirtualHost *:443 create ssl certificates for this host ! virtual host layout: <VirtualHost *:443> SSLEngine on SSLProxyEngine on ServerSignature off ServerName host.domain.tld ProxyPreserveHost on ProxyRequests off ErrorLog /var/log/httpd/owa_error CustomLog /var/log/httpd/owa_access \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown SSLCertificateFile /etc/httpd/certs/server.crt SSLCertificateKeyFile /etc/httpd/certs/server.key Redirect / https://host.domain.tld/exchange ## srv066 = 192.168.22.25, better work with ip here ProxyPass /exchange https://192.168.22.25/exchange ProxyPassReverse /exchange https://192.168.22.25/exchange ProxyPass /exchweb https://192.168.22.25/exchweb ProxyPassReverse /exchweb https://192.168.22.25/exchweb ProxyPass /public https://192.168.22.25/public ProxyPassReverse /public https://192.168.22.25/public ProxyPass /exchweb/bin/auth https://192.168.22.25/exchweb/bin/auth ProxyPassReverse /exchweb/bin/auth http://192.168.22.25/exchweb/bin/auth ProxyPass /iisadmpwd https://192.168.22.25/iisadmpwd ProxyPassReverse /iisadmpwd https://192.168.22.25/iisadmpwd </VirtualHost> hope it will help someone in the future. greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ > -----Original Message----- > From: Dörfler Andreas [mailto:Andreas.Doerfler@kempten.de] > Sent: Wednesday, March 23, 2005 12:11 PM > To: suse-security(a)suse.com > Subject: [suse-security] OWA with squid 2.5 stable6, problem > with connect > > > hi there, > > after reading multible sites over a long time > i hope im getting help via this list, im running > crazy here > > sheme: > > client (www) -> squid (www - public ip) -> firewall -> owa > (lan - private ip) > > squid.conf: > > visible_hostname host.domain.tld > https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key > hosts_file /etc/squid/hosts > http_port 127.0.0.1:8080 > > httpd_accel_host srv066 > httpd_accel_port 80 > httpd_accel_uses_host_header off > httpd_accel_single_host on > httpd_accel_with_proxy off > > acl acl_testmail dstdomain srv066 > http_access allow acl_testmail > > acl to_index urlpath_regex /$ > acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange > urlpath_regex /exchange http_access allow to_index > http_access allow to_favicon http_access allow to_exchange > > acl all src 0.0.0.0/0.0.0.0 > header_access Accept-Encoding deny all > never_direct allow all > http_access deny all > > > when i try the connect via https://host.domain.tld, the following > error ocoured: > > While trying to retrieve the URL: http://srv066 > > The following error was encountered: > > * Unable to forward this request at this time. > > This request could not be forwarded to the origin server or > to any parent caches. The most likely cause for this error is that: > > * The cache administrator does not allow this cache to > make direct connections to origin servers, and > * All configured parent caches are currently unreachable. > > > > its an urgent problem, so i hope getting help here

1 0

SUSE Security Announcement: various KDE security problems (SUSE-SA:2005:022)
by Marcus Meissner 11 Apr '05

11 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: kdelibs3 Announcement-ID: SUSE-SA:2005:022 Date: Mon, 11 Apr 2005 15:00:00 +0000 Affected products: 9.1, 9.2, 9.3 SUSE Linux Enterprise Server 9 Novell Linux Desktop 9 Vulnerability Type: remote code execution local denial of service Severity (1-10): 8 SUSE default package: yes Cross References: CAN-2005-0237 CAN-2005-0396 Content of this advisory: 1) security vulnerability resolved: several security problems in KDE problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: See SUSE Security Summary Report. 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion Several vulnerabilities have been identified and fixed in the KDE desktop environment. - A buffer overflow via specially crafted PCX pictures was fixed. This could lead to a remote attacker being able to execute code as the user opening or viewing a PCX images. This PCX image could have been embedded within a web page or Email. This affects SUSE Linux 9.1 up to 9.3, SUSE Linux Enterprise Server 9 and Novell Linux Desktop 9. - The IDN domain name cloaking problem was fixed. A remote website could disguise its name as another potentially trusted site by using a extension originally meant for non-ASCII domain names by using "homographs" which look exactly like other letters. The fix used by KDE is only use homographs for trusted domains. It is disabled by default for the .net, .com and .org domains. This issue exists in SUSE Linux 9.1 and 9.2, SUSE Linux Enterprise Server 9 and Novell Linux Desktop 9. It has been assigned the Mitre CVE ID CAN-2005-0233. - A denial of service attack against the DCOP service was fixed. A local user could cause another users KDE session to visible hang by writing bad data to the world writable DCOP socket. The socket has been made writable only for the user itself. This was found by Sebastian Krahmer of SUSE Security. This affects all SUSE Linux versions, except SUSE Linux 9.3. Updates for SUSE Linux up to 9.0 and SUSE Linux Enterprise Server 8 are not included for this minor issue. They will be included should a later security update for different issues be necessary. This is tracked by the Mitre CVE ID CAN-2005-0396. Additionally following bug was fixed: - A possible race in the DNS resolver causing unresolved hosts in rare cases was fixed. This only affected SUSE Linux 9.3. 2) solution/workaround Please install the updated packages. 3) special instructions and notes Make sure you restart your KDE session after this update. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/kdelibs3-3.4.0-20.3.i5… 6b63160218d7e9023418980186942ab3 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/kdelibs3-32bit-9.3-7… 7de0dcf016ad28f3f95c9110a376dc7b SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/kdelibs3-3.3.0-34.5.i5… 47c8c9ccb24b30261de0910ff5bfa19e ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/kdelibs3-32bit-9.2-2… 7da9ca5c0cefb043ea170c59beaa588a SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kdelibs3-3.2.1-44.46.i… 6dd4f0b38a750f256f6639decda2a968 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/i586/kdelibs3-32bit-9.1-2… 955791a7b3973698f2c9ea8b0cd09716 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/kdelibs3-3.2.1-44.46.sr… 3f5585b97d663b7d6d9bcac0f8c0b7a0 x86-64 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/kdelibs3-3.4.0-20.3.… 5c79a3e9e143bd0c29ecbf7d4b4222a2 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/kdelibs3-3.4.0-20.3.src… 6a3f653fe866b9cfb7f9215fed404e94 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/kdelibs3-3.3.0-34.5.… d2970930a5757b3a2758eb53efda5d8b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/kdelibs3-3.3.0-34.5.src… 4ae72b2108db739ebc4aefca67b5b566 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/kdelibs3-3.2.1-44.… 7355ab449354f49fdc0de161d6fb86ab source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/kdelibs3-3.2.1-44.46.… 1587e0cfa6ce3dae17c4f6fa8c10ef01 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQlqaQney5gA9JdPZAQHmVAf/ZmqLy6ioDYLfaw3xzwFjVGCKPMJMwCDw z7ncZ53/l82oLlFNIlt4A9FpK6Nq3vXCQuNCI0av6uGlhlRvqlp+XoWfYfPDVIuX wQ6ROHyJBVV2NgLCendUp/DzukF0V1aeZ8dJ4zYwlqrc5lq6HGrkxBN2ILNuBOwA mxMRk2mXcFO8f1LKqTQxrONyWRsj08F8JwZNvqosZ92ft+MnY5Cv48dl6GeRKBMX zyHvN6j/mknEUCUmTJmXHWT8bhLYCdgdWNcxvZGrMSz32m6p/B+AM4nOVn22lfYN swdN8VvaRoaGu+PBFSdvRXep71cDMZ0Y2mLMoD/+c9eHaDrs6UI7RQ== =LHnC -----END PGP SIGNATURE-----

1 0

unsubscribe,
by Stephen Aaron Meade 11 Apr '05

11 Apr '05

unsubscribe,

2 1

Open Source Protocol Analyzers
by Lucky Leavell 08 Apr '05

08 Apr '05

OS: SuSE 9.2 Pro We are currently using ethereal to analyze various attacks on our network but it is rather time consuming and we were wondering if there are any good protocol analyzers out there which can summarize and present the results. The commercial appliance NetVCR looks good but with a starting price of $US 10,000, it is WAY beyond our means. Thank you, Lucky Leavell

2 1