June 2012 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] RE: [security-announce] SUSE-SU-2012:0782-1: important: Security update for finch, libpurple and pidgin
by tedrb＠wellsfargo.com 22 Jun '12

22 Jun '12

These are all instant messaging packages; pidgin is a client, libpurple is a set of libraries that speak many protocols, and finch is a set of simple scripts to use libpurple directly. (In spite of the name, I doubt libPURPLE decodes Japanese diplomatic messages.) We wouldn't install these; for us, N/A. Ted Rodriguez-Bell Enterprise Virtualization, z/VM and z/Linux, Wells Fargo (415) 477-6891 office (415) 516-7913 cell 201 3rd St., MAC A0187-050, San Francisco, CA 94103 4155167913(a)vtext.com or http://www.vtext.com text paging (but cell is safer) Company policy requires: This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation. -----Original Message----- From: opensuse-security(a)opensuse.org [mailto:opensuse-security@opensuse.org] Sent: Friday, June 22, 2012 10:09 AM To: opensuse-security-announce(a)opensuse.org Subject: [security-announce] SUSE-SU-2012:0782-1: important: Security update for finch, libpurple and pidgin SUSE Security Update: Security update for finch, libpurple and pidgin ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0782-1 Rating: important References: #752275 #760890 #761155 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Various remote triggerable crashes in pidgin have been fixed: * CVE-2012-1178: In some situations the MSN server sends text that isn't UTF-8 encoded, and Pidgin fails to verify the text's encoding. In some cases this can lead to a crash when attempting to display the text (). * CVE-2012-1178/CVE-2012-2318: Incoming messages with certain characters or character encodings can cause clients to crash. * CVE-2012-2214: A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-finch-6294 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-finch-6294 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-finch-6294 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-finch-6294 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): finch-2.6.6-0.15.1 finch-devel-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-devel-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 pidgin-devel-2.6.6-0.15.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): finch-2.6.6-0.15.1 finch-devel-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-devel-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 pidgin-devel-2.6.6-0.15.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): finch-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 libpurple-meanwhile-2.6.6-0.15.1 libpurple-tcl-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): finch-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 libpurple-meanwhile-2.6.6-0.15.1 libpurple-tcl-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): finch-2.6.6-0.16.1 libpurple-2.6.6-0.16.1 pidgin-2.6.6-0.16.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): finch-2.6.6-0.16.1 finch-devel-2.6.6-0.16.1 libpurple-2.6.6-0.16.1 libpurple-devel-2.6.6-0.16.1 pidgin-2.6.6-0.16.1 pidgin-devel-2.6.6-0.16.1 References: https://bugzilla.novell.com/752275 https://bugzilla.novell.com/760890 https://bugzilla.novell.com/761155 http://download.novell.com/patch/finder/?keywords=1444b130f542f9e056af8af62… http://download.novell.com/patch/finder/?keywords=b0914368d9cc2257e01e528c5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: (BF # 956925) [security-announce] SUSE-SU-2012:0782-1: important: Security update for finch, libpurple and pidgin
by support＠basefarm.no 22 Jun '12

22 Jun '12

Vi har registrert din henvendelse/ärende med følgende saksnummer: 956925 Din henvendelse vil bli behandlet fortløpende og du vil få svar så snart som mulig. Dersom du ønsker å legge til ytterligere kommentarer til henvendelsen din kan du svare på denne e-post meldingen. Du må da beholde subject slik at vi kan knytte kommentaren til den opprinnelige henvendelsen din. VIKTIG: Hvis dette er en hastesak (Prioritet 1 eller 2), vennligst informer oss om dette via telefon. For fremtidige hastesaker, inkluder slik informasjon i subject (f.eks HASTER: ). Du kan også følge opp innsendte saker på http://helpdesk.basefarm.com Du logger deg på med brukernavn og passord du tidligere har fått tilsendt på epost. Vennligst ta vare på saksnummeret dersom du henvender deg til oss, slik at vi kan hjelpe deg så snart som mulig. -- Med vennlig hilsen Basefarm --------------------------------------------------------------------------------------- We have received your request and assigned it the following ticket number: 956925 Your request will be processed shortly and we will reply as soon possible. Please include this number in the subject line if you want to reply to this mail. This will connect your additional comments to the original request. IMPORTANT: If this is an urgent (Priority 1 or 2) matter, please inform us explicitly by telephone. For future urgent requests, include this information in the subject (e.g URGENT). To keep track of your registered tickets, please visit http://helpdesk.basefarm.com and log in with your username and password. Please keep your ticket number for further inquiry. -- Sincerely, Basefarm -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Ditt brukernavn og passord
by support＠basefarm.no 22 Jun '12

22 Jun '12

Du har nå blitt registrert som en bruker av Basefarm Support sitt kundesupportsenter. For å følge opp dine saker går du til http://helpdesk.basefarm.com og logger deg på med følgende brukernavn og passord: Brukernavn: opensuse-security(a)opensuse.org Passord: !1F495F44575F813C13546817105C5D3A5759B4D45 Du kan også kontakte Basefarm Support på telefonnummer +47 4000 4200 Med vennlig hilsen, Basefarm AS --------------------------------------------------------- You are now registered at Basefarm Service Desk. You have the possibility to access your own requests, login at http://helpdesk.basefarm.com using the following username and password: Username: opensuse-security(a)opensuse.org Password: !1F495F44575F813C13546817105C5D3A5759B4D45 You may also contact Basefarm Support on +47 4000 4200 Best regards, Basefarm AS -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] RE: [security-announce] SUSE-SU-2012:0741-2: important: Security update for bind
by tedrb＠wellsfargo.com 15 Jun '12

15 Jun '12

This is the other shoe to the bind update we got yesterday for SP1. If we were using bind it would be running against the LNS DNS servers in caching mode and I hope we can trust them. But fortunately we aren't. So no rush. Ted Rodriguez-Bell Enterprise Virtualization, z/VM and z/Linux, Wells Fargo (415) 477-6891 office (415) 516-7913 cell 201 3rd St., MAC A0187-050, San Francisco, CA 94103 4155167913(a)vtext.com or http://www.vtext.com text paging (but cell is safer) Company policy requires: This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation. -----Original Message----- From: opensuse-security(a)opensuse.org [mailto:opensuse-security@opensuse.org] Sent: Thursday, June 14, 2012 8:08 PM To: opensuse-security-announce(a)opensuse.org Subject: [security-announce] SUSE-SU-2012:0741-2: important: Security update for bind SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0741-2 Rating: important References: #765315 Cross-References: CVE-2012-1667 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The following issue has been fixed: * Records with zero length rdata field could have crashed named or disclose portions of memory to clients (CVE-2012-1667). Security Issue reference: * CVE-2012-1667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1667 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-bind-6382 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-bind-6382 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-bind-6382 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-bind-6382 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.6ESVR7P1]: bind-devel-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64) [New Version: 9.6ESVR7P1]: bind-devel-32bit-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 9.6ESVR7P1]: bind-9.6ESVR7P1-0.5.1 bind-chrootenv-9.6ESVR7P1-0.5.1 bind-doc-9.6ESVR7P1-0.5.1 bind-libs-9.6ESVR7P1-0.5.1 bind-utils-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 9.6ESVR7P1]: bind-libs-32bit-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.6ESVR7P1]: bind-9.6ESVR7P1-0.5.1 bind-chrootenv-9.6ESVR7P1-0.5.1 bind-doc-9.6ESVR7P1-0.5.1 bind-libs-9.6ESVR7P1-0.5.1 bind-utils-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 9.6ESVR7P1]: bind-libs-32bit-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 9.6ESVR7P1]: bind-libs-x86-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 9.6ESVR7P1]: bind-libs-9.6ESVR7P1-0.5.1 bind-utils-9.6ESVR7P1-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 9.6ESVR7P1]: bind-libs-32bit-9.6ESVR7P1-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-1667.html https://bugzilla.novell.com/765315 http://download.novell.com/patch/finder/?keywords=6c613f6b4f6b9ab1c13907a84… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

Re: [opensuse-security] I think it's a virus. While nmbd running some web-sites are redirected or broken
by Gruz 14 Jun '12

14 Jun '12

So if none can help, and I don't meet the problem now, but I'm working on, I suspect, an infected machine, I'm going to make a fresh OpenSuse installation. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

Re: [opensuse-security] I think it's a virus. While nmbd running some web-sites are redirected or broken
by Gruz 14 Jun '12

14 Jun '12

14.06.12 15:00, Dave (Bigfoot) Ellingsberg написав(ла): > If your IPs are static. Then put an entry in your hosts file for the > short name of your other box. DNS will look to hosts first then to > a DNSserver . if you have wins its hosts, wins, DNS -- in that order. Ok, let's discuss it other time. It's not the current problem. I don't want to write manually machine name - ip's pair. But ok, let's move to the problem. Thanks. > Is it perhaps your other box that is answering this boxes wins > queries. Try wireshark or tcpdump to see if your broadcasting wins > requests and see who or what is answering those queries. > I started tcpdump >1.txt and started nmbd. I surfed much and I didn't met the problem. I opened dozens of windows with no result. Only once I saw that fake site and it gone once page reloaded. It seems determined it's been checked. Fantastic? The 1.txt is 6.3M. Can I show it? I tried to examine it and found the suspicious lines: 15:22:29.465461 IP 208.91.196-252.confluence-networks.com.http > 192.168.1.2.53103: Flags [.], seq 15926:17366, ack 4244, win 8576, length 1440 15:22:29.465661 IP 208.91.196-252.confluence-networks.com.http > 192.168.1.2.53103: Flags [P.], seq 17366:17614, ack 4244, win 8576, length 248 15:22:29.465686 IP 192.168.1.2.53103 > 208.91.196-252.confluence-networks.com.http: Flags [.], ack 17614, win 57600, length 0 15:22:29.472782 IP 192.168.1.2.53103 > 208.91.196-252.confluence-networks.com.http: Flags [P.], seq 4244:4645, ack 17614, win 57600, length 401 I tried IP 208.91.196.252 and say web-site http://searchmagnified.com/ Before I got a popup link when opening pravda.com.ua (I wrote it to marcus) Now the popup have been changed... Before it was redirecting to youtube, not here http://searchmagnified.com/popunder?domain=pravda.com.ua&fp=pmvqGYevDXgwMXe… So it's tied somehow. Any suggestion? -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

Re: [opensuse-security] I think it's a virus. While nmbd running some web-sites are redirected or broken
by Gruz 14 Jun '12

14 Jun '12

14.06.12 14:40, Dave (Bigfoot) Ellingsberg написав(ла): > What are the contents of your lmhosts file? > > Bigfoot. linux-7dyq:/mnt/sda2/home/gruz # cat /etc/samba/lmhosts # This file provides the same function that the lmhosts file does for # Windows. It's another way to map netbios names to ip addresses. # # See section 'name resolve order' in the manual page of smb.conf for # more information. 127.0.0.1 localhost linux-7dyq:/mnt/sda2/home/gruz # -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

Re: [opensuse-security] I think it's a virus. While nmbd running some web-sites are redirected or broken
by Gruz 14 Jun '12

14 Jun '12

13.06.12 18:11, Gruz написав(ла): I've realised I replied to Marcus only, so I show the messages to the maillist as they may be useful. > 13.06.12 17:46, Marcus Meissner написав(ла): > >>> 1. repos: >> >> .... quite a number :/ >> >>> 2. post #2 >>> linux-7dyq:/ # rpm -q --verify samba >> >> rpm -V samba-client >> >> too please. >> > > linux-7dyq:~ # rpm -V samba-client > 5S.T..... c /etc/samba/smb.conf > linux-7dyq:~ # > > >>> linux-7dyq:/ # >>> Empty result. >>> >>> 3. I use an ADSL modem whis is also my router (DHCP server) and two >>> linux PCs behind it. Nothing more. No specific configuration. Where is >>> the nmbd configuration? So I can show it. >> >> The content of: >> >> /etc/nsswitch.conf > > http://paste.opensuse.org/83269821 > > wind is added by me in line 33, as far as I remember. Everything else is > default. > >> >> would point the nameservices to WinS if incorrectly configured. >> >> The nmb logfile is in /var/log/samba/log.nmbd ... check if there >> is something funny in there. >> >> Ciao, Marcus > > I've enabled the daemon, surfed a little to meet the problme (several > fisrt minutes that pravda.com.ua work ok) and met that redirect again. > Here is the log for this time. Beginning from the previous stop. > > ==== > > [2012/06/13 00:34:57, 0] nmbd/nmbd.c:66(terminate) > Got SIGTERM: going down... > [2012/06/13 18:01:27, 0] nmbd/nmbd.c:860(main) > nmbd version 3.6.3-34.12.1-2797-SUSE-SL12.1-x86_64 started. > Copyright Andrew Tridgell and the Samba Team 1992-2011 > [2012/06/13 18:01:28, 0] nmbd/asyncdns.c:157(start_async_dns) > started asyncdns process 25674 > [2012/06/13 18:01:51, 0] > nmbd/nmbd_become_lmb.c:397(become_local_master_stage2) > ***** > > Samba name server GRUZ is now a local master browser for workgroup > WORKGROUP on subnet 192.168.1.2 > > ***** > [2012/06/13 18:01:51, 0] > nmbd/nmbd_browsesync.c:351(find_domain_master_name_query_fail) > find_domain_master_name_query_fail: > Unable to find the Domain Master Browser name WORKGROUP<1b> for the > workgroup WORKGROUP. > Unable to sync browse lists in this workgroup. > [2012/06/13 18:08:40, 0] nmbd/nmbd.c:66(terminate) > Got SIGTERM: going down... > > === > > That is strange > Unable to find the Domain Master Browser name WORKGROUP<1b> for the > workgroup WORKGROUP. > > What is that <1b>? -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 4

Re: [opensuse-security] I think it's a virus. While nmbd running some web-sites are redirected or broken
by Gruz 13 Jun '12

13 Jun '12

13.06.12 18:31, Gruz написав(ла): > 13.06.12 18:23, Marcus Meissner написав(ла): >> On Wed, Jun 13, 2012 at 06:20:09PM +0300, Gruz wrote: >>> 13.06.12 18:13, Marcus Meissner написав(ла): >>>> >>>> 33. hosts: files mdns4_minimal [NOTFOUND=return] wins dns >>>> >>>> >>>> This "wins" entry is doing name resolutions via nmbd before DNS is >>>> done, >>>> so you see hangs while nmbd is running. >>> >>> I did this because of a manual to allow see netbios names. Though I have >>> not windows comupters, but I like to ssh to the other machine by it's >>> name, not by ip address. >>> >>>>> >>>>> That is strange >>>>> Unable to find the Domain Master Browser name WORKGROUP<1b> for the >>>>> workgroup WORKGROUP. >>>>> >>>>> What is that<1b>? >>>> >>>> The $ sign. WORKGROUP$ is I think a common Microsoft name. >>>> >>>> Do you have a Domain Master Browser in your network? If not, then you >>>> should >>>> not point the name resolution at it. >>>> >>>> Ciao, Marcus >>> >>> I don't have. Anyway, this was working in such a way much time. So even >>> if I have wrong configuration it should not redirect me or broke any >>> web-sites, correct? >> >> I do not know how this should work or why it worked before... >> >> No idea how samba works here ... >> >> Ciao, Marcus > > I've removed the wins from the line while running nmb and meeting the > redirect. This doesn't help. Still redirecting. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

Re: [opensuse-security] I think it's a virus. While nmbd running some web-sites are redirected or broken
by Gruz 13 Jun '12

13 Jun '12

13.06.12 18:13, Marcus Meissner написав(ла): > On Wed, Jun 13, 2012 at 06:11:48PM +0300, Gruz wrote: >>> >>> /etc/nsswitch.conf >> >> http://paste.opensuse.org/83269821 >> >> wind is added by me in line 33, as far as I remember. Everything else is >> default. > > 33. hosts: files mdns4_minimal [NOTFOUND=return] wins dns > > > This "wins" entry is doing name resolutions via nmbd before DNS is done, > so you see hangs while nmbd is running. > >> [2012/06/13 18:01:51, 0] >> nmbd/nmbd_browsesync.c:351(find_domain_master_name_query_fail) >> find_domain_master_name_query_fail: >> Unable to find the Domain Master Browser name WORKGROUP<1b> for the >> workgroup WORKGROUP. >> Unable to sync browse lists in this workgroup. >> [2012/06/13 18:08:40, 0] nmbd/nmbd.c:66(terminate) >> Got SIGTERM: going down... >> >> === >> >> That is strange >> Unable to find the Domain Master Browser name WORKGROUP<1b> for the >> workgroup WORKGROUP. >> >> What is that<1b>? > > The $ sign. WORKGROUP$ is I think a common Microsoft name. > > Do you have a Domain Master Browser in your network? If not, then you should > not point the name resolution at it. > > Ciao, Marcus -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0