April 2005 - openSUSE Security - openSUSE Mailing Lists

SUSE Security Announcement: RealPlayer buffer overflow in RAM file handling (SUSE-SA:2005:026)
by Marcus Meissner 20 Apr '05

20 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: RealPlayer Announcement-ID: SUSE-SA:2005:026 Date: Wed, 20 Apr 2005 09:00:00 +0000 Affected products: 9.2, 9.3 Novell Linux Desktop 9 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE default package: yes Cross References: Content of this advisory: 1) security vulnerability resolved: buffer overflow in RAM file handling problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: See SUSE Security Summary Report. 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion This update fixes a security issue within the RealPlayer media player. A remote attacker could craft a special .RAM (Real Audio Media) file which would cause a buffer overflow when played within RealPlayer. This is the Real Player Update as referenced on this page: http://service.real.com/help/faq/security/050419_player/EN/ 2) solution/workaround None, please install the updated packages. 3) special instructions and notes Restart RealPlayer if running. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/RealPlayer-10.0.4-1.1.… b6ca6d5c87690fca385981ccf272ddf1 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/RealPlayer-10.0.4-1.1.… 7e87cb712e6f07b9bdefe4f2ea79d6d0 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQmYE/3ey5gA9JdPZAQGn2ggAl+THJtR4kixnP9wihTn7TSm+bEIpD8Sl tTtTWyE45ivyMeiwfhzNbkO8wb4vfUBCA6mHlzufIic5iZ93VPprPaO9Za1Y+Pmb YcuzLwMHaTPx7oDy2j0BbCG2gntXgK6PgIuvACYPyGxYjh8XgH48knCKyiP5jgzQ weZQAZ9kHn+SDLoFzHSW7D9wa3G5e/8Z3hsQXBUSv0/EtgLHzyzMbkdiT6kVczXe av0+pzZVpVWB/Z8DKTFK20ENL1QJYRkFt2jq9FM5NkPABIgtgYbEgH2/KoTwx29w d3FrTm7HI5PBfE/HisCmV2lc79p3BG0tHr+JNfpnV/IO1KF9quvHmQ== =CqtJ -----END PGP SIGNATURE-----

3 5

SUSE Security Announcement: PostgreSQL buffer overflow problems (SUSE-SA-2005:027)
by Marcus Meissner 20 Apr '05

20 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: postgresql Announcement-ID: SUSE-SA:2005:027 Date: Wed, 20 Apr 2005 09:00:00 +0000 Affected products: 8.2, 9.0, 9.1, 9.2, 9.3 SUSE Linux Desktop 1.0 SUSE Linux Enterprise Server 8, 9 Novell Linux Desktop 9 Vulnerability Type: remote code execution Severity (1-10): 5 SUSE default package: no Cross References: CAN-2005-0247 Content of this advisory: 1) security vulnerability resolved: code execution due to bugs in several SQL commands problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: none 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion Several problems were identified and fixed in the PostgreSQL database server. Multiple buffer overflows in the low level parsing routines may allow attackers to execute arbitrary code via: (1) a large number of variables in a SQL statement being handled by the read_sql_construct() function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function. This is tracked by the Mitre CVE ID CAN-2005-0247. 2) solution/workaround None, please install the updated packages. 3) special instructions and notes If you are running a PostgreSQL server please make sure that it is stopped or at least doesn't have any client connections during the update. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-8.0.1-6.i58… 678cf8fac25f43217a75ff1b69afa1e1 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-contrib-8.0… 9f71e3a477cb37e96b6252d3e41af5d0 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-devel-8.0.1… 13befe8d62a70898b576f46332b04016 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-docs-8.0.1-… d51a60a473567c87c3f94cc0d5abde2d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-libs-8.0.1-… 50af9cba7571c4859b033a420782c5c3 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-pl-8.0.1-6.… 3d68c0e2f026e3c1f1d33ec828ade723 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/postgresql-server-8.0.… 4601a1e4308348a7a27fbe4dd0bfe029 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-libs-32bi… 55c4a7c5b510b4a05b789540adbcca00 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-7.4.7-0.3.i… 6d5ca6b626a70cee2b34e49d33855648 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-contrib-7.4… 62020a1c26ed41635cf07f37f1c22817 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-devel-7.4.7… eb20f825e8c1ee955e6904bd718ad1ba ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-docs-7.4.7-… 79194edc8a6a6ad10104b964e66cf789 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-libs-7.4.7-… 67353952335be148e0f3719a50edf8c5 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-pl-7.4.7-0.… caad51baf0dfca24df09fec5d4385555 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/postgresql-server-7.4.… 55a89a0f695e5dc892fa31af6140e367 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-libs-32bi… 91ac32a40b548d187ca78fb095f182ac SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-7.4.7-0.5.i… 7027aa706e60a5074b294edba529479c ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-contrib-7.4… f7f3ef933b3cef23e892ede41d30b7e2 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-devel-7.4.7… 8b48f30541f0834d14c7c1297202a55f ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-docs-7.4.7-… e4456b0be9e08ffab52bc8476d2a25c8 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-libs-7.4.7-… 9a936afc00a75b243c7c7bd040eb3e97 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-pl-7.4.7-0.… 7037b8f9f9ca4d0c3325b1f52a38338c ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/postgresql-server-7.4.… a6699829779cf0f1adc9eb899e028cce ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/i586/postgresql-libs-32bi… 6d7c782b577a97024d5b388957686eb9 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/postgresql-7.4.7-0.5.sr… 10074702f7983e615b0d4da932915419 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-7.3.9-7.i58… dbefa2ff236099277275e050196832f9 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-contrib-7.3… 9e933821ae869b86c9dbb9899df86d75 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-devel-7.3.9… 8c2f83c0acb4bda10989a90082126324 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-docs-7.3.9-… 4fa5151ac425ef2765600082c8772d38 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-libs-7.3.9-… c038222567e7692081dfef91f56fa73b ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-pl-7.3.9-7.… 57730936587d5214f45d498721abc0d4 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-server-7.3.… a66b7aa7172c4accefad29b98b725452 ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/postgresql-test-7.3.9-… c2d0256ea4ce83f12e73e4f23a0f4929 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/i586/postgresql-libs-32bi… 0a754eb5f8535cd7a291ffefb724f537 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/postgresql-7.3.9-7.src.… 174eb88726ae089eb80327613d0191c9 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-7.3.9-6.i58… a2b5993ddc330ffc4caf596b95cd44da ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-contrib-7.3… 80f40fb76c5eb8b04634836f5da87839 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-devel-7.3.9… e97783f94a2e103b4f36d8309525e03b ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-docs-7.3.9-… df6f2407af9063765d3100efda4e9fd7 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-libs-7.3.9-… 158525f64b5ce8b4e84307442c55cf69 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-pl-7.3.9-6.… b214dab6c7691e408c8cb94f3d89266b ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-server-7.3.… ef2c190ddcca664c6d24c30cee18b06a ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/postgresql-test-7.3.9-… 598bc10d2956c68c44bbc15c1048b961 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/postgresql-7.3.9-6.src.… b9607afe3c591211cd4828387b78e844 x86-64 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-8.0.1-6.x… a608a80f0c5e52244ef0e06f71179eec ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-contrib-8… 3fc4c4e413857244670ec31d132ecf6e ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-devel-8.0… 604493537efd3eefdb6c2268c76d9fce ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-docs-8.0.… 4f9cdf3fef5cbc05655a61c0d40188ac ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-libs-8.0.… 1693e687c7175143a8417a1971b7561d ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-pl-8.0.1-… 231201858f97d931a342cc54197fede0 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/postgresql-server-8.… cf53838797c30f7c0d6c20780b3df994 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/postgresql-8.0.1-6.src.… 72d273fb0e710ce3b36f8a75760faca0 ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/postgresql-pl-8.0.1-6.n… b12ca9ab8d1e1403d64608447cef61af SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-7.4.7-0.3… 376426e12fa067ed9750ff729e7af64f ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-contrib-7… a2a1174114c9f2cd8b0bd24dc15603ad ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-devel-7.4… 52c49022348810ee55dc74a986a10324 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-docs-7.4.… c4ffdce772938cb5ca851a09eb05ccb9 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-libs-7.4.… b89fbdd68337b6f6d557e030fdee385c ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-pl-7.4.7-… 6fe8b6011a779152b659b85278176084 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/postgresql-server-7.… 94bd74ce6d5e215c0cc910227606b081 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/postgresql-7.4.7-0.3.sr… b8c6138e39ecc4c75537c7bf99cbcee4 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/postgresql-pl-7.4.7-0.3… e9c71d98739d760557aa9719ac45083b SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-7.4.7-0… 000d9921b17457f420806deb0b52b864 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-contrib… 7ae07a0f82e1c752a43f1d2f1d6f76a4 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-devel-7… 959493267003db19075030c88b288e53 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-docs-7.… 452dc62ada42a821a7d6e8bc79e6fbd8 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-libs-7.… 6d07eec96e67f4c3b316b980db2ded02 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-pl-7.4.… a9a394f502ce7d45b72e8d037513cc60 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/postgresql-server-… 090f72759ce39af0b49170ff3b0e939a source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/postgresql-7.4.7-0.5.… 8bd7c2894ca62fe59e52f5ee79a13a8c SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-7.3.9-7… d9b71b21317c17281a1d0b5ac058ee7e ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-contrib… df00a736fbbc1fe396ca802f28556a6e ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-devel-7… b1bc20c65730504cb68204644b53c3b1 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-docs-7.… aa2a266f6cfb859e248d7c6a9168cd5d ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-libs-7.… ff5014d8c7d7c2d3b044bb2f268c0bf8 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-pl-7.3.… 9e9dc0405761bde26676ad71b71d18c8 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-server-… 0235a9bd3d8b582c8eeec89ae5cc02ff ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/postgresql-test-7.… 2cd64de68e37398c11448271c87d8f9b source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/postgresql-7.3.9-7.sr… cb17afaeae94a5d9c982654047c46b7f ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: none ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQmYWjXey5gA9JdPZAQE2hgf9HiTUk55ar7ggbJwBwSxOOqxLt5fJ4z/E REl6bZM0ti5xuk0dlbQpM4ZlSkQfajpp3SMmou2lsD8ZFteEbmbN/NZvgp3CBZRA Ci8EnTldo3/Sfv9cUj1Obd1CGFYAost0pK+khX3QNGJOfTBOu2HVi6DCaY4PNGcP 8V09PM/8INpcWvvuX+FLZpiHMJlu3JpDArTTsTtulNoIPoe3zKa1Bjns9SdMzD/S 9o5+0xG/ObuOZqomhsBBbb4+u66Rd0fVsLTflEvbaulcvavIhgkyDQn6dkrj9za7 SvJG2vYYXtY3WZWQRJsUiM1AfMAy9mCXflk+Yj7vh1x5iKcCRBntpw== =IWpL -----END PGP SIGNATURE-----

1 0

wget MD5 mismatch?
by Maxim A Belushkin 20 Apr '05

20 Apr '05

While updating my SuSE 9.2 via YaST, just got: Retrieving wget: "A tool for mirroring FTP and HTTP servers" ... ERROR(You:MD5 checksum does not match.)[file './i386/update/9.2/deltas/wget-1.9.1-50.4_50.6.i586.delta.rpm' has wrong MD5 checksum: '58239d09af0b5aea88973fea3503ed11' != '384843093d16aa8489b550c5e957c426'] Ok Installing wget: "A tool for mirroring FTP and HTTP servers" Ok Erm, isn't that wrong? A) If the checksum was wrong, why did YOU install it? B) What's up with the checksum?

3 2

SuSE Firewall2 and ethernet bridging
by Marc Rieber 19 Apr '05

19 Apr '05

Hallo, I want to connect two networks via openvpn. Each network is connected over a suse linux 9.2 router to the internet. On each router i created a tap0 device for the openvpn connection and bridged it to the eth0 device which is the device to the internal network. Everything works fine, but I have problems with the firewall. I can ping router 1 form router 2 and router 2 from router 1. If I try to ping a pc behind router 1 from router 2 and on the other way, it doesn't work. In the log file I get the following message: SFW2-FWDint-DROP-ICMP-CRIT IN=br0 OUT=br0 PHYSIN=tap0 PHYSOUT=eth0 SRC=192.168.0.1 DST=192.168.1.50 .......... Broadcasts were also filtered. Does somebody know how to configure the SuSEFirwall2, that all traffic from PHYSIN=tap0 to PHYSOUT=eth0 and on the other way with a source address of the internal network can go through the firewall. Thanks in advance Marc

3 4

LAUS in Suse 9.2 Professional
by White, Joseph 19 Apr '05

19 Apr '05

Hi All, I need to install LAUS on a Suse 9.2 Professional machine. I have found packages for Suse Enterprise 9 but not for 9.2 Pro. I believe the packages are built for certain kernel versions, and require a kernel patch, where can these files be found. I see that Suse 9.3 is now out, is all the pieces for Laus included with that distro? Any Help Greatly Appreciated! Joe White

2 1

Windows Update through Squid cache fails
by SuSE Security 18 Apr '05

18 Apr '05

I have configured the (Windows XP) clients on the LAN to use Squid as a proxy for web access. This (mostly) works without any issues. However, the latest batch of updates from Microsoft are causing severe problems. The XP clients are not able to download two updates (the ones mentioned in KB890859 and KB890923). The following is logged in the access.log of Squid: 1113736515.291 300331 winxp.de-korte.org TCP_MISS/200 535 GET http://au.download.windowsupdate.com/msdownload/update/v5/psf/windowsxp-kb8… - DIRECT/63.236.111.222 application/octet-stream 1113736579.898 302423 winxp.de-korte.org TCP_MISS/200 430 GET http://au.download.windowsupdate.com/msdownload/update/v5/psf/windowsxp-kb8… - DIRECT/213.200.98.29 application/octet-stream 1113736880.519 300381 winxp.de-korte.org TCP_MISS/200 430 GET http://au.download.windowsupdate.com/msdownload/update/v5/psf/windowsxp-kb8… - DIRECT/206.24.192.222 application/octet-stream Obviously, the client in question (all show similar behaviour) are using Squid, but somehow the downloads are aborted after about five minutes. With the network connectivity available at that time, about 30MB is downloaded then. I then tried to download both files with 'wget' (which is configured to use the same Squid proxy) and ended up with two files of 334MB (!) and 60MB respectively. Also, when the clients are instructed to bypass Squid (having a PAC file is very useful in these cases), the downloads went smooth too. Apparently, Windows Update doesn't like the way Squid is configured now. Is there some kind of issue with Windows Update and Squid? Regards, Arjen

3 2

Mozilla Firefox JavaScript Engine Information Disclosure Vulnerability
by Anthony Edwards 18 Apr '05

18 Apr '05

A new, quite fascinating vulnerability was apparently discovered today, which allows attackers to craft custom JavaScript code in order to gain access to information contained in system RAM; all current versions of Mozilla Firefox are believed to be affected: http://secunia.com/advisories/14820/ An intriguing test for this vulnerability (watch information contained in system memory echo to the screen!) appears here: http://secunia.com/mozilla_products_arbitrary_memory_exposure_test/ A temporary workaround is to disable JavaScript support, however SuSE will be releasing a patched version of Firefox presumably? -- Anthony Edwards anthony.edwards(a)uk.easynet.net

6 11

SUSE Security Announcement: cvs (SUSE-SA:2005:024)
by krahmer＠suse.de 18 Apr '05

18 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: cvs Announcement-ID: SUSE-SA:2005:024 Date: Monday, Apr 18st 2005 13:30 MEST Affected products: 8.2, 9.0, 9.1, 9.2, 9.3 SUSE CORE 9 for x86 SuSE Linux Enterprise Server 8, 9 UnitedLinux 1.0 School-Server 1 Open-Enterprise-Server 9 Vulnerability Type: remote code execution Severity (1-10): 6 SUSE default package: No Cross References: CAN-2005-0753 Content of this advisory: 1) security vulnerability resolved: buffer overflow and memory access problem in cvs problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - IDN (Internationalized Domain Name) cloaking - PostgreSQL - Mozilla - OpenOffice_org 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. The current maintainer of CVS reported various problems within CVS such as a buffer overflow and memory access problems which have been fixed within the available updates. The CVE project has assigned the CAN number CAN-2005-0753. 2) solution/workaround There is no easy workaround except shutting down the CVS server. 3) special instructions and notes No special actions need to be taken after installing this update. 4) package location and checksums Download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered for installation from the maintenance web. x86 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/cvs-1.12.11-4.2.i586.r… 8e27dd3b7a9867940830aa9dd8fd95bc patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/cvs-1.12.11-4.2.i586.p… acd6904641df500ca50da8147ee54019 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/cvs-1.12.11-4.2.src.rpm 6a075a97c2bd30ade965e90e0f9671c4 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/cvs-1.12.9-2.2.i586.rpm 7192dce3bb42cd51c98a3510e9e5e73a patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/cvs-1.12.9-2.2.i586.pa… ae4b8f9096b50e7f1c3a15e715e4c8e7 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/cvs-1.12.9-2.2.src.rpm cebc4e07ac34f6a6f76789d6ce0eba37 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cvs-1.11.14-24.10.i586… 07778aea3050bcf05c96ae680b9d01e4 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/cvs-1.11.14-24.10.i586… 60591530555521e34d798a0d0365686a source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/cvs-1.11.14-24.10.src.r… bd4b0324b51cee45f247e41f2f6139d4 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-85.i586.rpm 795f6e5a6849706bb439366129833841 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-85.i586.pat… ec2bb29f912831f9d5e7dd15ec950d9b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/cvs-1.11.6-85.src.rpm a3695ffd8f741a9f376e5e3244d412c8 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-116.i586.rpm 6fc24ea4712d10855e60d26b9262f48c patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-116.i586.pa… 7b4e1cae79c33c4965b53159bd888a70 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/cvs-1.11.5-116.src.rpm 401896062510804b79ba75a5e800d9e2 x86-64 Platform: SUSE Linux 9.3: ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/cvs-1.12.11-4.2.x8… db2665d2e95762aa2c376fed929c44f1 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/cvs-1.12.11-4.2.x8… 8b3070a29bd15c430980937b53928640 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/cvs-1.12.11-4.2.src.r… 6a075a97c2bd30ade965e90e0f9671c4 SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/cvs-1.12.9-2.2.x86… 21518326918a0a7e42176b60544e214e patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/cvs-1.12.9-2.2.x86… 8bbb9b4bda742cb62836b6a6453aef2c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/cvs-1.12.9-2.2.src.rpm cebc4e07ac34f6a6f76789d6ce0eba37 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cvs-1.11.14-24.10.… 7543263ca5374da3a9926cde6c8bd58c patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/cvs-1.11.14-24.10.… 1b245e5669be7b6e082c67d5e094466a source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/cvs-1.11.14-24.10.src… 8c399e20f6046faa3de70ae0fc133060 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-85.x86_… 708318fbf0d27efd212c16ac26f63003 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-85.x86_… 7d5f303351ae584f07998847cc476f7c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/cvs-1.11.6-85.src.rpm ff6eddc0257dfd8dfa1b97653117d2c7 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - IDN (Internationalized Domain Name) cloaking / homograph attacks Problems with the IDN / punycode handling that allows non-ASCII domain names were reported for every browser. - The KDE approach is currently filtering on the top level domain. - The Mozilla approach is currently to display punycode. We have released Mozilla Firefox and KDE / konqueror updates for this problem, the others (mozilla suite and opera) are still pending. - PostgreSQL problems Additional PostgreSQL problems were reported: - A local user could bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. CAN-2005-0244 - Other earlier listed problems are already fixed. We are still working on updates for this problem. - new Mozilla security problems Several new Mozilla browser security problems have been reported. We are currently addressing these issues. - OpenOffice_org heap overflow A heap overflow was found in the MS Word document handing of OpenOffice_org, allowing a remote attacker to execute code via a handcrafted .doc file. We are preparing updates for this issue. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We recommend against subscribing to security lists that cause the e-mail message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the file name of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.7 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBiEYEExECAAYFAkGJG+YACgkQGsiRhDTRlzm8CQCg14Wz vg6j45e/r1oyt9EaHhleSacAnA+2dArk1I3xt49Z5rdnhqheF//9mQGiBDnu9IER BACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff4JctBsgs47tj miI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlW t6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcOQliHu8jwRQHx lRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifr ZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBED3+D2t1V/f8l 0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1 krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoEmyW/xC1sBbDk DUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25p bmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkDwmcABAsKAwQD FQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6dNfnwI2PAsgCg jH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzO AKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUD BRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4 fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklL snr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMn snT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/ xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmp U661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0EExECAB0FAjxq qTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1fAJ9dR7saz2KP NwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0EOe70khAIAISR 0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/HZnh3TwhBIw1 FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44ht5h+6HMBzoFC MAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPTtGzcAi2jVl9h l3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM523AMgpPQtsK m9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q2Y+GqZ+yAvNW jRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8QnSs0wwPg3xE ullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWawJxRLKH6Zjo/F aKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ1sj2xYdB1xO0 ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCHORrNjq9pYWlr xsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1wwylxadmmJaJ HzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQYEQIADAUCOe70 kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol0JdGwACeKTtt geVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAKCRCoTtronIAK yofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3coSPihn1+OBNw= =Fv2n - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iQEVAwUBQmO/u3ey5gA9JdPZAQF6GggAgTCAQEADDglUXgjsnso7O70e676qNHi/ Ftr5gjDFl4D2FTEGCPiaZZLDueyxduETAVs9Aseu8vaiMB1TTbknpB9k40FjU13f tlvbRnFj/bbMk6YxN/dcYm+0YxCmNdc8SEcCLRWTiUAAq9DSi6xdVYo3RfWdzmPe vc/sU24CEPX/nXimtkxevslPAwqV/Wngbhw8AuqWe9VnN/cKQTFmKAYiEyfXe6OK 1WNeZeLb99s0eHPcT7uuxiPd7NxBOF5d5K/Ga9pR5UL/sHX9Dvbn8oeeuVFnlAPP FKXo9as0/yuk/mtQMhoOXLkLgoB/XUu+3WjekRe+PkBzCMBwbVFU1Q== =d+0e -----END PGP SIGNATURE-----

1 0

How to block Acroread 7 with SuSE FW2?
by Al Bogner 18 Apr '05

18 Apr '05

Since I don't like that Acroread 7 sends messages home, I would like to do something like this: iptables -A OUTPUT -m owner --cmd-owner acroread -j DROP How do I include this using the SuSE FW2 of 9.2? Al

10 13

Suppress certain SuSE-FW-UNALLOWED-TARGETIN messages in /var/log/messages and warn
by Joachim Raue 14 Apr '05

14 Apr '05

Hi! I'm frequently getting unallowed targetins from my gateway, which my SuSE firewall logs as: SuSE-FW-UNALLOWED-TARGETIN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:49:1f:70:8e:08:00 SRC=10.0.132.2 DST=224.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=255 I Everything's working fine, I would just like to suppress messages from this specific host in my logs. Is there a way to do so? Cheers, Joachim

1 0