April 2013 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Apache >2.2.2 Darkleech
by Philippe Vogel 04 Apr '13

04 Apr '13

Hello List, are there any solutions detecting darkleech on domains w/o root access (below links only show up root solutions)? http://blog.sucuri.net/2013/01/server-side-iframe-injections-via-apache-mod… http://blog.sucuri.net/2013/02/web-server-compromise-debian-distro-identify… Regards Philippe -- Vertraulichkeitshinweis: Diese E-Mail (inkl. etwaiger angehängter Dateien) kann vertrauliche Informationen beinhalten und ist nur für die Personen oder das Unternehmen bestimmt, an welche es tatsächlich gerichtet ist und darf von Dritten nicht gelesen, kopiert, verbreitet oder anderweitig genutzt werden. Wenn Sie diese E-Mail unbeabsichtigt erhalten haben, informieren Sie bitte den Sender und löschen Sie alle erhaltenen Inhalte unverzüglich. Vielen Dank. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: [security-announce] openSUSE-SU-2013:0624-1: important: NRPE metacharacter filtering omission
by Wojciech Lisiewicz 04 Apr '13

04 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 04.04.2013 um 18:04 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: NRPE metacharacter filtering omission > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2013:0624-1 > Rating: important > References: #807241 > Cross-References: CVE-2013-1362 > Affected Products: > openSUSE 11.4 > ______________________________________________________________________________ > > An update that fixes one vulnerability is now available. > > Description: > > NRPE (the Nagios Remote Plug-In Executor) allows the > passing of $() to plugins/scripts which, if run under bash, > will execute that shell command under a subprocess and pass > the output as a parameter to the called script. Using this, > it is possible to get called scripts, such as check_http, > to execute arbitrary commands under the uid that > NRPE/nagios is running as (typically, 'nagios'). > > With this update NRPE will deny remote requests > containing a bash command substitution. > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 11.4: > > zypper in -t patch 2013-55 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 11.4 (i586 x86_64): > > nagios-nrpe-2.12-25.2 > nagios-nrpe-debuginfo-2.12-25.2 > nagios-nrpe-debugsource-2.12-25.2 > nagios-nrpe-doc-2.12-25.2 > nagios-plugins-nrpe-2.12-25.2 > nagios-plugins-nrpe-debuginfo-2.12-25.2 > > > References: > > http://support.novell.com/security/cve/CVE-2013-1362.html > https://bugzilla.novell.com/807241 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: [security-announce] openSUSE-SU-2013:0621-1: important: NRPE metacharacter filtering omission
by Wojciech Lisiewicz 04 Apr '13

04 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 04.04.2013 um 17:05 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: NRPE metacharacter filtering omission > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2013:0621-1 > Rating: important > References: #807241 > Cross-References: CVE-2013-1362 > Affected Products: > openSUSE 12.2 > openSUSE 12.1 > ______________________________________________________________________________ > > An update that fixes one vulnerability is now available. > > Description: > > NRPE (the Nagios Remote Plug-In Executor) allows the > passing of $() to plugins/scripts which, if run under bash, > will execute that shell command under a subprocess and pass > the output as a parameter to the called script. Using this, > it is possible to get called scripts, such as check_http, > to execute arbitrary commands under the uid that > NRPE/nagios is running as (typically, 'nagios'). > > With this update NRPE will deny remote requests containing > a bash command substitution. > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 12.2: > > zypper in -t patch openSUSE-2013-301 > > - openSUSE 12.1: > > zypper in -t patch openSUSE-2013-301 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 12.2 (i586 x86_64): > > nagios-nrpe-2.12-30.9.1 > nagios-nrpe-debuginfo-2.12-30.9.1 > nagios-nrpe-debugsource-2.12-30.9.1 > nagios-nrpe-doc-2.12-30.9.1 > nagios-plugins-nrpe-2.12-30.9.1 > nagios-plugins-nrpe-debuginfo-2.12-30.9.1 > > - openSUSE 12.1 (i586 x86_64): > > nagios-nrpe-2.12-27.7.1 > nagios-nrpe-debuginfo-2.12-27.7.1 > nagios-nrpe-debugsource-2.12-27.7.1 > nagios-nrpe-doc-2.12-27.7.1 > nagios-plugins-nrpe-2.12-27.7.1 > nagios-plugins-nrpe-debuginfo-2.12-27.7.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-1362.html > https://bugzilla.novell.com/807241 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: [security-announce] SUSE-SU-2013:0618-1: important: Security update for puppet
by Wojciech Lisiewicz 03 Apr '13

03 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 03.04.2013 um 23:07 schrieb opensuse-security(a)opensuse.org: > SUSE Security Update: Security update for puppet > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2013:0618-1 > Rating: important > References: #809839 > Cross-References: CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 > CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 > CVE-2013-2275 > Affected Products: > SUSE Linux Enterprise Server 11 SP2 for VMware > SUSE Linux Enterprise Server 11 SP2 > SUSE Linux Enterprise Desktop 11 SP2 > ______________________________________________________________________________ > > An update that fixes 7 vulnerabilities is now available. It > includes one version update. > > Description: > > > puppet has been updated to fix 2.6.18 multiple > vulnerabilities and bugs. > > * (#19391) Find the catalog for the specified node name > * Don't assume master supports SSLv2 > * Don't require openssl client to return 0 on failure > * Display SSL messages so we can match our regex > * Don't assume puppetbindir is defined > * Remove unnecessary rubygems require > * Run openssl from windows when trying to downgrade > master > * Separate tests for same CVEs into separate files > * Fix order-dependent test failure in > rest_authconfig_spec > * Always read request body when using Rack > * (#19392) (CVE-2013-1653) Fix acceptance test to catch > unvalidated model on 2.6 > * (#19392) (CVE-2013-1653) Validate indirection model > in save handler > * Acceptance tests for CVEs 2013 (1640, 1652, 1653, > 1654, 2274, 2275) > * (#19531) (CVE-2013-2275) Only allow report save from > the node matching the certname > * (#19391) Backport Request#remote? method > * (#8858) Explicitly set SSL peer verification mode. > * (#8858) Refactor tests to use real HTTP objects > * (#19392) (CVE-2013-1653) Validate instances passed to > indirector > * (#19391) (CVE-2013-1652) Disallow use_node compiler > parameter for remote requests > * (#19151) Reject SSLv2 SSL handshakes and ciphers > * (#14093) Restore access to the filename in the > template > * (#14093) Remove unsafe attributes from TemplateWrapper > > Security Issue references: > > * CVE-2013-2275 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2275 > > * CVE-2013-2274 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2274 > > * CVE-2013-1655 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655 > > * CVE-2013-1654 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1654 > > * CVE-2013-1653 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1653 > > * CVE-2013-1652 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1652 > > * CVE-2013-1640 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1640 > > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Linux Enterprise Server 11 SP2 for VMware: > > zypper in -t patch slessp2-puppet-7526 > > - SUSE Linux Enterprise Server 11 SP2: > > zypper in -t patch slessp2-puppet-7526 > > - SUSE Linux Enterprise Desktop 11 SP2: > > zypper in -t patch sledsp2-puppet-7526 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 2.6.18]: > > puppet-2.6.18-0.4.2 > puppet-server-2.6.18-0.4.2 > > - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.18]: > > puppet-2.6.18-0.4.2 > puppet-server-2.6.18-0.4.2 > > - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 2.6.18]: > > puppet-2.6.18-0.4.2 > > > References: > > http://support.novell.com/security/cve/CVE-2013-1640.html > http://support.novell.com/security/cve/CVE-2013-1652.html > http://support.novell.com/security/cve/CVE-2013-1653.html > http://support.novell.com/security/cve/CVE-2013-1654.html > http://support.novell.com/security/cve/CVE-2013-1655.html > http://support.novell.com/security/cve/CVE-2013-2274.html > http://support.novell.com/security/cve/CVE-2013-2275.html > https://bugzilla.novell.com/809839 > http://download.novell.com/patch/finder/?keywords=bc7ffedd9ace9c95117aaf0ac… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org >

1 0

[opensuse-security] Re: [security-announce] SUSE-SU-2013:0615-1: important: Security update for rubygem-crack
by Wojciech Lisiewicz 03 Apr '13

03 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 03.04.2013 um 20:13 schrieb opensuse-security(a)opensuse.org: > SUSE Security Update: Security update for rubygem-crack > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2013:0615-1 > Rating: important > References: #804721 > Cross-References: CVE-2013-0269 > Affected Products: > SUSE Studio Onsite 1.2 > SUSE Studio Extension for System z 1.2 > ______________________________________________________________________________ > > An update that fixes one vulnerability is now available. > > Description: > > > The Ruby Gem crack has been updated to 0.1.7 and to fix a > security issue: > > * CVE-2013-1800: Multiple xml parsing issues were fixed > that could be used by attackers able to inject XML to cause > denial of service problems. > > Security Issue reference: > > * CVE-2013-0269 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269 > > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Studio Onsite 1.2: > > zypper in -t patch slestso12-rubygem-crack-7530 > > - SUSE Studio Extension for System z 1.2: > > zypper in -t patch slestso12-rubygem-crack-7530 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - SUSE Studio Onsite 1.2 (x86_64): > > rubygem-crack-0.1.7-0.5.4 > > - SUSE Studio Extension for System z 1.2 (s390x): > > rubygem-crack-0.1.7-0.5.4 > > > References: > > http://support.novell.com/security/cve/CVE-2013-0269.html > https://bugzilla.novell.com/804721 > http://download.novell.com/patch/finder/?keywords=db8654d7f66749acf4c49dd5a… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org >

1 0

[opensuse-security] Re: [security-announce] SUSE-SU-2013:0612-1: important: Security update for rubygem-extlib
by Wojciech Lisiewicz 03 Apr '13

03 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 03.04.2013 um 20:10 schrieb opensuse-security(a)opensuse.org: > SUSE Security Update: Security update for rubygem-extlib > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2013:0612-1 > Rating: important > References: #804719 > Cross-References: CVE-2013-0269 > Affected Products: > SUSE Cloud 1.0 > ______________________________________________________________________________ > > An update that fixes one vulnerability is now available. > > Description: > > > The Extlib Ruby Gem has been updated to fix a Denial of > Service vulnerability in XML (CVE-2013-1802) > > Security Issue references: > > * CVE-2013-0269 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269 > > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Cloud 1.0: > > zypper in -t patch sleclo10sp2-rubygem-extlib-7498 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - SUSE Cloud 1.0 (x86_64): > > rubygem-extlib-0.9.15-0.9.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-0269.html > https://bugzilla.novell.com/804719 > http://download.novell.com/patch/finder/?keywords=e1291d45bc0b7f1bc2197ac8c… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org >

1 0

[opensuse-security] Re: [security-announce] SUSE-SU-2013:0606-1: important: Security update for Ruby on Rails
by Wojciech Lisiewicz 03 Apr '13

03 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 03.04.2013 um 20:06 schrieb opensuse-security(a)opensuse.org: > SUSE Security Update: Security update for Ruby on Rails > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2013:0606-1 > Rating: important > References: #796712 #797449 #797452 #800320 #803336 #803339 > > Cross-References: CVE-2012-5664 CVE-2013-0155 CVE-2013-0156 > CVE-2013-0276 CVE-2013-0333 > Affected Products: > WebYaST 1.2 > SUSE Studio Standard Edition 1.2 > SUSE Studio Onsite 1.2 > SUSE Studio Extension for System z 1.2 > ______________________________________________________________________________ > > An update that solves 5 vulnerabilities and has one errata > is now available. It includes one version update. > > Description: > > > The Ruby on Rails stack has been updated to 2.3.17 to fix > various security issues and bugs. > > The rails gems were updated to fix: > > * Unsafe Query Generation Risk in Ruby on Rails > (CVE-2013-0155) > * Multiple vulnerabilities in parameter parsing in > Action Pack (CVE-2013-0156) > * SQL Injection Vulnerability in Active Record > (CVE-2012-5664) > * rails: Vulnerability in JSON Parser in Ruby on Rails > 3.0 and 2.3 (CVE-2013-0333) > * activerecord: Circumvention of attr_protected > (CVE-2013-0276) > * activerecord: Serialized Attributes YAML > Vulnerability with Rails 2.3 and 3.0 (CVE-2013-0277) > > Security Issue references: > > * CVE-2012-5664 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5664 > > * CVE-2013-0155 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0155 > > * CVE-2013-0156 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156 > > * CVE-2013-0333 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0333 > > * CVE-2013-0276 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0276 > > * CVE-2013-0276 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0276 > > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - WebYaST 1.2: > > zypper in -t patch slewyst12-rubygem-actionmailer-2_3-7364 > > - SUSE Studio Standard Edition 1.2: > > zypper in -t patch sleslms12-rubygem-actionmailer-2_3-7364 > > - SUSE Studio Onsite 1.2: > > zypper in -t patch slestso12-rubygem-actionmailer-2_3-7364 > > - SUSE Studio Extension for System z 1.2: > > zypper in -t patch slestso12-rubygem-actionmailer-2_3-7364 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.17]: > > rubygem-actionmailer-2_3-2.3.17-0.6.1 > rubygem-actionpack-2_3-2.3.17-0.6.1 > rubygem-activerecord-2_3-2.3.17-0.6.1 > rubygem-activeresource-2_3-2.3.17-0.6.1 > rubygem-activesupport-2_3-2.3.17-0.6.1 > rubygem-rails-2_3-2.3.17-0.6.2 > > - SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 2.3.17]: > > rubygem-actionmailer-2_3-2.3.17-0.6.1 > rubygem-actionpack-2_3-2.3.17-0.6.1 > rubygem-activerecord-2_3-2.3.17-0.6.1 > rubygem-activeresource-2_3-2.3.17-0.6.1 > rubygem-activesupport-2_3-2.3.17-0.6.1 > rubygem-rails-2_3-2.3.17-0.6.2 > > - SUSE Studio Standard Edition 1.2 (noarch) [New Version: 2.3.17]: > > rubygem-rails-2.3.17-0.4.6.1 > > - SUSE Studio Onsite 1.2 (x86_64) [New Version: 2.3.17]: > > rubygem-actionmailer-2_3-2.3.17-0.6.1 > rubygem-actionpack-2_3-2.3.17-0.6.1 > rubygem-activerecord-2_3-2.3.17-0.6.1 > rubygem-activeresource-2_3-2.3.17-0.6.1 > rubygem-activesupport-2_3-2.3.17-0.6.1 > rubygem-rails-2_3-2.3.17-0.6.2 > > - SUSE Studio Extension for System z 1.2 (s390x) [New Version: 2.3.17]: > > rubygem-actionmailer-2_3-2.3.17-0.6.1 > rubygem-actionpack-2_3-2.3.17-0.6.1 > rubygem-activerecord-2_3-2.3.17-0.6.1 > rubygem-activeresource-2_3-2.3.17-0.6.1 > rubygem-activesupport-2_3-2.3.17-0.6.1 > rubygem-rails-2_3-2.3.17-0.6.2 > > > References: > > http://support.novell.com/security/cve/CVE-2012-5664.html > http://support.novell.com/security/cve/CVE-2013-0155.html > http://support.novell.com/security/cve/CVE-2013-0156.html > http://support.novell.com/security/cve/CVE-2013-0276.html > http://support.novell.com/security/cve/CVE-2013-0333.html > https://bugzilla.novell.com/796712 > https://bugzilla.novell.com/797449 > https://bugzilla.novell.com/797452 > https://bugzilla.novell.com/800320 > https://bugzilla.novell.com/803336 > https://bugzilla.novell.com/803339 > http://download.novell.com/patch/finder/?keywords=dfb687aafb848ceb562a7f371… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org >

1 0