September 2010 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] otrs and permissions file
by Christian 24 Apr '12

24 Apr '12

Hi, for otrs I need this config: (https://build.opensuse.org/package/show?package=otrs&project=network%3Aotrs…) %defattr(0644,%{name},www,0775) %dir /opt/%{name}/var/article %dir /opt/%{name}/var/log %dir /opt/%{name}/var/tmp but obs is complaining: permissions-directory-setuid-bit and I should contact security(a)suse.de Here I am :) Is this acceptable ? Kind Regards Chris -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 6

[opensuse-security] zypper --quiet suppresses info abaut kernel update
by Joachim Schönberg 28 Sep '10

28 Sep '10

Hi everybody, today I noticed the following with my 11.2 installations: I have cron jobs with: zypper --quiet up -y -t patch --skip-interactive All updates except the latest kernel package were applied. That's OK, but there is no information in the e-mail cron sends regarding the suppressed kernel update. Normally the --quiet option is needed for me to keep the mail readable, but when I test "zypper up" without --quiet I get the following mail: ################################################# Retrieving repository 'Packman Repository' metadata [.done] Building repository 'Packman Repository' cache [....done] Loading repository data... Reading installed packages... Warning: 'kernel-3175' is interactive, skipping. ^^^^^^^^^^^^^^^^^^^^^^^^^^ Resolving package dependencies... Nothing to do. ################################################# Here we habe the warning I was waiting for. Is this what the programmer wanted to implement? Do I really have to omit the --quiet option? Something else I am missing? BTW: the "default" cron script /etc/cron.d/yast2-online-update (which points to /usr/lib/YaST2/bin/online_update) has the same behaviour. Joe -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] bzip2 vulnerability CVE-2010-0405
by Andy Spiers 25 Sep '10

25 Sep '10

Hi, I'm just trying to compile the latest version of ClamAV (0.96.3) and the configure script checks for the presence of a vulnerability (CVE-2010-0405) in the bzip2 library. The check they use seems to indicate that my SLES 10 SP3 mail servers are in some way vulnerable because it ends up in an infinite loop consuming 100% CPU. The configure script works fine on my machines that run debian lenny, where the bzip2 packages received a recent security update to fix this problem. More info here: Debian security update: http://security-tracker.debian.org/tracker/CVE-2010-0405 Discussion of the vulnerability: http://xorl.wordpress.com/2010/09/21/cve-2010-0405-bzip2-integer-overflow/ Does anybody know if Novell consider this a vulnerability and are they planning on releasing an update to bzip2 to fix it? I'd rather stick with the official published RPM versions of the bzip2 libraries and not have to replace them manually. Thanks, Andy Spiers -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 2