October 2008 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] SUSE Security Summary Report: SUSE-SR:2008:023
by Thomas Biege 31 Oct '08

31 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2008:023 Date: Fri, 31 Oct 2008 14:00:00 +0000 Cross-References: CVE-2008-2696, CVE-2008-3271 CVE-2008-4555, CVE-2008-4776 Content of this advisory: 1) Solved Security Vulnerabilities: - graphviz - libexiv2, exiv2 - tomcat5, apache-jakarta-tomcat-connectors - libgadu - opera 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - graphviz An update of graphviz was released to fix a buffer overflow that occurs while parsing a DOT file. (CVE-2008-4555) Affected products: openSUSE 10.2-11.0, SLE SDK 10 SP1, SLE SDK 10 SP2, SLED 10 SP1, SLED 10 SP2 - libexiv2, exiv2 A bug in libexiv2/exiv2 could lead to a crash while parsing metadata. (CVE-2008-2696) Affected products: openSUSE 10.2-11.0 - tomcat5, apache-jakarta-tomcat-connectors This update of tomcat fixes an information leak due to incorrect IP address filtering. (CVE-2008-3271) Affected products: openSUSE 10.2, NLD 9 SDK, Novell Linux POS 9, Open Enterprise Server, SLES 9, SLE SDK 10 SP1, SLE SDK 10 SP2, SLES 10 SP1, SLES 10 SP2 - libgadu The library libgadu was vulnerable to a denial of service bug. (CVE-2008-4776) Affected products: openSUSE 10.3-11.0 - opera Opera was upgraded to version 9.62 fix multiple vulnerabilities For details have a look at: http://www.opera.com/docs/changelogs/linux/962/ Affected products: 10.2-11.0 ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. opensuse-security-announce(a)opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe(a)opensuse.org>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSQsBe3ey5gA9JdPZAQKkowgAnb5QwZGklsm/0O4jNJ31tOQJ9/6zEPDF GocmP6qKR/thYK7J/yiEfEpFX6ziy540kg+IWqX82z/n6esDnLKaSsD2+BWItG+C T+CaFMZaabW5dLmIOz5JqSKqMQZbBVP7Te7dRord2/y3l05EczedSgvRzWPHQGdn NEnOrNEV3yBUczDrmAwdaIgERuozzUVt/LDP2ltGAm5FK1UYcrVCBG/7sEGDeXRS 7mw+KjUSZXUPVfAOTguDj7o5+bY92MICLqMhNqxiKa4UZ+5I75bls1l0KwHmV6Zy 0HJvf7fnNwLnx3/AHs4EW+lB97ig6wOuYG8YYTfGZ5+L2f1APfvNgg== =RC/X -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

Re: [opensuse-security] mandb is possibly compromised
by Carlos E. R. 28 Oct '08

28 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 El 2008-10-24 a las 17:49 -0700, Clint Moffatt escribió: Please, remember to reply to the list, not in private. > Hi Carlos, > > Thanks for the prompt reply. I thought the mandb was causing the > system freeze, as it was using 40% CPU and rising when it freezes. If > I did not kill it last time, then it would have probably caused it to > freeze again. Powering off is the only thing I can do to get it back > once it has completely frozen. I hope this gives more information as > to what is happening. Well, you may have a problem, but not a security one, I think. That being so, you may get more replies in the standard mail list. There are a series of processes that run every day, about the same hour, and one of them is this mandb. Some of these processes are disk-intensive (like locatedb), and in some cases can slow your system dramatically. Not crash the system, but slow it down: specially if the disk is big and slow, and memory is scarce. The mandb process should not be problematic. Maybe you can help it by deleting some files, maybe /var/cache/man/, but of this I'm not sure. You can make a backup of that entire directory path, delete the files (not directories), and wait for changes. But first look at the logs for clues. - -- Saludos Carlos E.R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkkCdNAACgkQtTMYHG2NR9UCuACfcBKri8tpjeJTe9iKdFGD+CCv 8bwAn2BPeraAb7Cje4F+GPOzivNxVFIL =bg+o -----END PGP SIGNATURE-----

3 3

[opensuse-security] SASL2 + SAMBA - WinBind
by Ariel Sabiguero Yawelak - INCO 27 Oct '08

27 Oct '08

Hi all! I am trying to configure SASL2 authentication against a remote samba/windows server, but all experiences I found on-line seem to suggest to use winbind as the prefered solution. I intend to authenticate cyrus+postfix users with it. Is there a way to avoid Winbind? I don't want to add all those users to the system, and I would also like to avoid winbind problems. Can you point me to a good howto? Can you point in a better direction? regards ariel ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Openssl issue in Opensuse 10.3
by Rainer Sokoll 27 Oct '08

27 Oct '08

Hi, opensuse 10.3, openssl, subversion and neon from the repositories. Occasionally, when I do some svn operations against a Subversion server, I get a "svn: PROPFIND of '/some/path': SSL negotiation failed: SSL error: sslv3 alert bad record mac (https://subversion.example.com)". Nothing is logged at the sever side. I do not have this kind of problems when I use my own-built openssl, neon, and subversion. The server runs openssl 0.9.8i and svn 1.5.4. Any idea how I can track down the problem? Thank you, Rainer -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 1

[opensuse-security] mandb is possibly compromised
by Clint Moffatt 25 Oct '08

25 Oct '08

Hi All Open Suse Users, I have a security concern that I wanted to share with the security team at OpenSuse. I am using OpenSuse11, KDE 4.1, and have found this bug/anomolie while monitoring the System Monitor - Version 4 Using KDE 4.1.2 (KDE 4.1.2) "release 44.2". A mandb buffer overflow(at least that is what I think it is) has frozen my system in the past, so I decided to monitor it, and see what is happening. The last time it was using up to 40% of my CPU's before I killed it with the System Monitor. It has always happened while downloading/uploading torrents, and I have seen a gzip application open and close quickly in the Process Table of the System Monitor before happening once before. I thought I should let someone at Suse know what is happening on my system, and see if there is anything I can do to help fix it. I am not a developer, just a Linux user, and I can follow command line instructions if you need more information. Thanks for your help, Clint -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] SUSE Security Summary Report: SUSE-SR:2008:022
by Thomas Biege 24 Oct '08

24 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2008:022 Date: Fri, 24 Oct 2008 14:00:00 +0000 Cross-References: CVE-2008-3103,CVE-2008-4694, CVE-2008-4695,CVE-2008-4696, CVE-2008-4697,CVE-2008-4698 Content of this advisory: 1) Solved Security Vulnerabilities: - opera - java-1_5_0-ibm,IBMJava5-JRE 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - opera We released two updates of Opera. Version 9.60 and 9.61 fixed several vulnerabilities (CVE-2008-4694, CVE-2008-4695, CVE-2008-4696, CVE-2008-4697, CVE-2008-4698). For details have a look at: http://www.opera.com/docs/changelogs/linux/960/#sec and http://www.opera.com/docs/changelogs/linux/961/#sec Affected products: 10.2-11.0 - java-1_5_0-ibm,IBMJava5-JRE IBM Java 5 was updated to SR8a to fix a security issue: CVE-2008-3103: A vulnerability in the Java Management Extensions (JMX) agent when local monitoring is enabled, allowed remote attackers to "perform unauthorized operations". This update also includes new timezone data and fixes missing .systemPrefs. Affected products: SLED, SLES9, SLES10, Novell Linux POS 9, Open Enterprise Server ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. opensuse-security-announce(a)opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe(a)opensuse.org>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSQG+MXey5gA9JdPZAQIqPggAjvlwEYYxn5tgpu+SYP/3/xNu74YbDxcZ b9wqhbvcugm6TC5Jermwoo7QNiLjK8j0qXZHaBWxH4aXsU6CBrJ/twinhZelLYIF iUarTHkXJiePFQLd5H8FhV71E+tLKyLhQ5Q9Lu1jQzNsGL20MW3q4qC2518JpwwJ wGm7zwJmEGAyLaBPM7+ThpQUuzfO9ePhrn/rkVotSmLpjGv8y8cq9jgkBztYoqQc 01YQn/8NgHIOAbIehkx83/UBGzYBbV/+ZQsh3twBaOG4WdbOmT0KDj4fozq7dh9W 6DSavn1rzyYMaKqjmDhXqY/TCaaF339AbdXM8rmj9eGOgMcp1Em9ng== =P1uu -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

Re: [opensuse-security] Did the last kernel update break v4l?
by Max B 19 Oct '08

19 Oct '08

Sorry, forgot to CC the list! Forwarding. >> When I try to launch xawtv, I get: >> This is xawtv-3.95, running on Linux/i686 (2.6.18.8-0.11-default) >> /dev/video0 [v4l2]: no overlay support >> v4l-conf had some trouble, trying to continue anyway >> ioctl: VIDIOC_G_STD(std=0xbfb9fae4 >> [PAL_G,PAL_D,PAL_D1,PAL_K,PAL_N,PAL_60,NTSC_M,NTSC_M_JP,?,?,SECAM_B,SECAM_H,SECAM_K,SECAM_K1,?ATSC_8_VSB,ATSC_16_VSB,(null),(null),(null),(null),(null),(null)]): >> Invalid argument >> ioctl: VIDIOC_S_STD(std=0x0 []): Invalid argument >> > > The 2.6.18.8-0.11 kernel was released incorrectly, aka should nopt have > been released. It was on the servers for like 1 - 2 hours, before it > was removed again. Thank you for your reply! I downgraded to 2.6.18.8-0.10-default, but still get the same behaviour. Also, the ZMD software updater now shows 2.6.18.8-0.11-default as an available update (I'm still running SuSE 10.2, planning to upgrade soon but can not do it just yet). Any hints would be very appreciated! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Did the last kernel update break v4l?
by Max B 19 Oct '08

19 Oct '08

Hello, I would like to inquire whether the last kernel update (2.6.18.8-0.11-default) changed something about v4l? My webcam suddenly stopped working right, here is the background. Everything worked fine before the update. Now: dmesg correctly identifies the usb webcam as before, the driver is zc0301: V4L2 driver for ZC0301[P] Image Processor and Control Chip v1:1.05, device registered as /dev/video0. Previously, I used mplayer to test the webcam with the driver v4l specified. That no longer works, but if I specify the v4l2 driver I get an image in mplayer. But xawtv and skype no longer work. When I try to launch xawtv, I get: This is xawtv-3.95, running on Linux/i686 (2.6.18.8-0.11-default) /dev/video0 [v4l2]: no overlay support v4l-conf had some trouble, trying to continue anyway ioctl: VIDIOC_G_STD(std=0xbfb9fae4 [PAL_G,PAL_D,PAL_D1,PAL_K,PAL_N,PAL_60,NTSC_M,NTSC_M_JP,?,?,SECAM_B,SECAM_H,SECAM_K,SECAM_K1,?ATSC_8_VSB,ATSC_16_VSB,(null),(null),(null),(null),(null),(null)]): Invalid argument ioctl: VIDIOC_S_STD(std=0x0 []): Invalid argument Both xawtv and skype /used/ to work before the update. Mplayer now only works if I specify the v4l2 driver, not v4l as before. My question is, did something get changed (and how can I fix it back?) or is it a PEBKAC on my side? Thank you for any responses in advance! Best regards Max -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] SUSE Security Summary Report: SUSE-SR:2008:021
by Thomas Biege 17 Oct '08

17 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2008:021 Date: Fri, 17 Oct 2008 14:00:00 +0000 Cross-References: CVE-2008-2940, CVE-2008-2941, CVE-2008-2952 CVE-2008-3658, CVE-2008-3659 Content of this advisory: 1) Solved Security Vulnerabilities: - cups - hplip - apache2-mod_php5 - openldap2 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - cups Specially crafted print jobs could trigger buffer overflows in the 'imagetops', 'texttops' and 'hpgltops' filters. Attackers could potentially exploit that to execute arbitrary code on the cups server (CVE-2008-3639, CVE-2008-3640, CVE-2008-3641). Affected products: openSUSE 10.2-11.0, SLED 10 SP1,SLED 10 SP2, SLES 10 SP1,SLES 10 SP2,SuSE Linux Enterprise Server 8 for IBM S/390 and IBM zSeries,SuSE Linux Enterprise Server 8 for x86, Novell Linux Desktop 9,Novell Linux POS 9,Open Enterprise Server,SLES 9 - hplip,hplip-hpijs,hplip17,hplip17-hpijs hplip was updated because it does allow to send alert mails as user (CVE-2008-2940) and was affected by a denial-of-service bug (CVE-2008-2941). Affected products: openSUSE 10.2-10.3,SLED 10 SP1,SLED 10 SP2,SLES 10 SP1, SLES 10 SP2 - apache2-mod_php5,php5* The current update of apache2-mod_php5 fixes some overflows in the gd extension and in the memnstr() function that could crash php or possibly allow remote code execution (CVE-2008-3658, CVE-2008-3659) Affected products: openSUSE 10.2-11.0 (previously released), SLE SDK 10 SP1,SLES 10 SP1 - openldap2 This update fixes a security problem in the liblber client library of openldap that allowed remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams, which triggers an assertion error. (CVE-2008-2952) Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active. Affected products: openSUSE 10.2-11.0, Novell Linux Desktop 9, Novell Linux POS 9,Open Enterprise Server,SLE 10 DEBUGINFO SP2,SLE SDK 10 SP1, SLE SDK 10 SP2,SLED 10 SP1,SLED 10 SP2,SLES 10 SP1,SLES 10 SP2,SLES 9, SuSE Linux Enterprise Server 8 for IBM S/390 and IBM zSeries, SuSE Linux Enterprise Server 8 for x86 ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. opensuse-security-announce(a)opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe(a)opensuse.org>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSPiHhHey5gA9JdPZAQLuvQf/dD7RrQFyrC0U2GGm54CMBkawv3xfHrIs ou0RlDQin4Zvc6VpV1sIPoU1uXIEYZclaSrBma8oAPSE/pbTqeAVBNO9soOTM0pF t+sKQDMSO8nEf373XR7iyncZ2xIFOu5Ufy+XeI9l1tcYIBsy2h4lZARCtBFvG94/ Qsi0/6XsGwkkJ9nUKicQzfmNnGYozn8xHajxJ6U/LqDpUro4q3ZfV3NFOj5eXv+L 4XCudSg3RUf2YxvHSdwAUt+gaaSkrp6zP+jl1BFmohJoo1eEklb2tyKX72mKYB6U Doqy0ijlwPKyfaBIHkc1edxCAW1Nx8i0PnaLUIA/aXboBNEvtnMP2A== =dPPv -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] nss-mdns and SuSEfirewall2
by Jan Ritzerfeld 14 Oct '08

14 Oct '08

Hello, I am trying to resolve the name of my printer via nss-mdns. It works fine with "avahi-resolve -n KY623B6B.local". But "ping KY623B6B.local" does not work because the SuSEfirewall2 blocks the incoming answers from port 5353 of the printer to a random port of my computer. The avahi service opens upd and broadcast on port 5353 but not answers from port 5353. Using FW_ALLOW_INCOMING_HIGHPORTS_UDP="mdns" makes "ping KY623B6B.local" working but that option is deprecated ... Gruß Jan -- If you make people think they're thinking, they'll love you. But if you really make them think they'll hate you. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 6

[opensuse-security] Re: [security-announce] Advance notice of discontinuation of openSUSE 10.2
by Carlos E. R. 13 Oct '08

13 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thursday 2008-10-02 at 11:17 +0200, Marcus Meissner wrote: > Dear opensuse-security-announce subscribers and openSUSE users, > > SUSE Security announces that openSUSE 10.2 will be discontinued soon. > Having provided security-relevant fixes for more than two years, we will > stop releasing updates after November 30th 2008. > > As a consequence, the openSUSE 10.2 distribution directory on our > ftp server ftp.suse.com will be moved from /pub/suse/*/10.2/ to the > /pub/suse/discontinued/ directory tree structure to free space on our > mirror sites. The 10.2 directory in the update tree /pub/suse/update/10.2 > will follow, as soon as all updates have been published. Er... this is no longer true, there is nothing under the /pub/suse/discontinued/ structure, just a note that versions till 7.1 have been remoed to save 30 gigs of space. But there is nothing there, ¡not even 10.1! However, 10.0 isos are in "/pub/suse/i386/10.0/iso", and some packages I think are under "/pub/suse/i386/10.0/SUSE-Linux10.0-GM-Extra/suse". There is also a partial "/pub/suse/install/10.1" and an emtpy "/pub/suse/install/10.2/", with a note that it has been erased too: ] All openSUSE 10.2 packages from the media as well ] as those that did not make it due to space reasons to them, ] are available via the mirrors of ftp.opensuse.org. ] ] For details read: http://en.opensuse.org/Released_Version ] about the "Internet Installation Repository". So, where are you keeping your own SUSE history, if even 10.2 is not there, before the date of end of november you mentioned? - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkjliekACgkQtTMYHG2NR9UixACdFpcDwZV2StyVgDEIL+UJU+pr qRQAnjC4zKjGU0w9hOszgtmpFCC7Hp7B =sWZj -----END PGP SIGNATURE-----

3 2

[opensuse-security] ACLs, HAL and serial devices (was: HAL and serial devices)
by Jan Ritzerfeld 12 Oct '08

12 Oct '08

Hello, inspired by the thread "Want to could use /dev/ttyS0 as user" on the opensuse-factory maling list, I tried to figure out whether access to /dev/ttyS0 can be granted by HAL/resmgr (since this works fine with the alsa devices). According to /etc/hal/fdi/policy/90osvendor/80-resmgr.fdi, access to serial devices should be granted to "members" of the resmgr modem class (desktop users are not "member" of this class by default). But using 10.3, I cannot even find any serial device via HAL: jan@karl:~> hal-find-by-capability --capability serial jan@karl:~> Obviously, udev recognizes my /dev/ttyS0: jan@karl:~> udevinfo --query=all --name=/dev/ttyS0 P: /devices/platform/serial8250/tty/ttyS0 N: ttyS0 I do not need access to /dev/ttyS0, but I do want to learn more about HAL. :) Gruß Jan -- A fail-safe circuit will destroy all others. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 4

[opensuse-security] udev rules; use of uucp group for devices
by Günter Dannoritzer 02 Oct '08

02 Oct '08

Hi, I had asked this question over at the [opensuse] mailing list on 09/14/2008 12:46 AM and got the recommendation to ask the security people about this issue. So here I am. I want to use a USB device which comes up as /dev/ttyUSB0 with the user:group = root:uucp. Now my question is how is the intended use of this device for a normal user? When I look at my user information with the id command I get: uid=1000(linux) gid=100(users) groups=16(dialout),33(video),100(users) I am hesitant to add my user to the uucp group, as I am not sure whether that is the intended use of the group. I know there are some user/groups on Linux only intended for some software and not for real user accounts. I tried to overwrite the udev rule and make the ttyUSB0 device belong to the dialout group, as my user belongs to it, but was not successful with that. Could someone please explain the intended use of the uucp group in connection with hardware devices and how users are intended to access the hardware? Thanks for your help. Cheers, Guenter -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

6 15

[opensuse-security] Re: [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:2008:048)
by Frank Steiner 02 Oct '08

02 Oct '08

Hi Marcus, Marcus Meissner wrote > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: kernel > Announcement ID: SUSE-SA:2008:048 > Date: Wed, 01 Oct 2008 15:00:00 +0000 > Affected Products: SLE SDK 10 SP2 > SUSE Linux Enterprise Desktop 10 SP2 > SUSE Linux Enterprise 10 SP2 DEBUGINFO > SUSE Linux Enterprise Server 10 SP2 I'm a bit confused. There are updates for SLED10 SP2 x86_64, release 2.6.16.60-0.30 There are no x86_64 releases for SLES10 SP2, though. But there are i586 and ppc releases for SLES10 SP2, release 2.6.16.60-0.29. Usually, SLES and SLES kernels used to have the same release number. I wonder if there is sth. from .29 to .30 that I should have in SLES, too. And why are there no x86_64 releases for SLES10 SP2? Usually one can take the SLED packages and put on the SLES system, but this time I'm really confused because of the different releases. cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 2

[opensuse-security] Bind dnssec-validation
by Petr.Jiran＠cdt.cz 02 Oct '08

02 Oct '08

Hi, I want to start DNSSEC on my DNS server, but I use old version of Bind 9.3.5. This version doesnt support "dnssec-validation". Is some eazy way how to upgrade BIND? Thanks for help. Best regards Petr Jiran, DiS. Senior specialista datové a IP sítě Úsek elektronických komunikací ČD-Telematika a. s. Kancelář: Dělnická 12, 170 00 Praha 7 Sídlo: Pernerova 2819/2a, 130 00 Praha 3 Tel.: +420 210 021 692 Mob.: +420 724 013 723 Fax: +420 210 021 610 E-m@il: Petr.Jiran(a)cdt.cz URL: http://www.cdt.cz -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0