October 2014 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] apache2 -DFOREGROUND blocks access to Unix Domain socket
by Michael Ströder 05 Nov '14

05 Nov '14

HI! Sorry, I'm pretty new to systemd issues. I have a FastCGI process invoked by Apache's mod_fcgid which runs just fine since years. It opens a LDAPI (LDAP over IPC) connection which also used to work just fine. But not with the startup via systemd (openSUSE 13.1). The process can open normal LDAP connections via TCP but not to a Unix Domain Socket. Yes, I've checked all ownership/permissions and there's no AppArmor or SELinux active. I've tracked down this to: When starting like this it does not work: /usr/sbin/start_apache2 -DSYSTEMD -DFOREGROUND -k start But leaving away -DFOREGROUND it does work: /usr/sbin/start_apache2 -DSYSTEMD -k start Unfortunately naively hunking out -DFOREGROUND from /usr/lib/systemd/system/apache2.service does also not work. Any clue? Many thanks in advance. Ciao, Michael.

2 1

[opensuse-security] Bug in wget: CVE-2014-4877
by Sverre Moe 30 Oct '14

30 Oct '14

A new version of wget is out, 1.16 http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html * Noteworthy changes in Wget 1.16 ** No longer create local symbolic links by default. Closes CVE-2014-4877. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4877 https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-1… OpenSUSE 13.1 uses wget-1.14 Last changes: Thu May 2 17:50:50 UTC 2013 https://build.opensuse.org/package/show/openSUSE:13.1/wget OpenSUSE 13.2 uses wget-1.15 Last changes: Sun Jan 19 22:02:25 UTC 2014 https://build.opensuse.org/package/show/openSUSE:13.2/wget When will we see a fix for wget on OpenSUSE? I also use some SLES and have not seen any indication that SUSE is on this either. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 2

[opensuse-security] Will there be update to OpenSSL 0.9.8zc, 1.0.0o and 1.01.j?
by George Dimitrov 24 Oct '14

24 Oct '14

Hi, The last fixes in OpenSSL come around 1 week ago. Will there be updated version available for SLES? Thanks, George --george -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] AW: [security-announce] SUSE-SU-2014:1247-1: important: Security update for bash
by hans.paffrath＠stadt-koeln.de 16 Oct '14

16 Oct '14

Hallo, this security update für bash was also available for SLES10SP4 without LTSS. After the installation of this patch, it was no longer possible to create at Jobs. Now SuSE fixed this "bug", and I found a new at for SLES11SP3 and SLES10SP4 LTSS from October 15. Will this patch be available for SLES10SP4 without LTSS too? Greetings Hans Paffrath Stadt Köln - Der Oberbürgermeister Amt für Informationsverarbeitung Willy-Brandt-Platz 3 50679 Köln Telefon: 0221/221-26085 Telefax: 0221/221-22845 E-Mail: hans.paffrath(a)stadt-koeln.de Internet: www.stadt-koeln.de -----Ursprüngliche Nachricht----- Von: opensuse-security(a)opensuse.org [mailto:opensuse-security@opensuse.org] Gesendet: Sonntag, 28. September 2014 19:05 An: opensuse-security-announce(a)opensuse.org Betreff: [security-announce] SUSE-SU-2014:1247-1: important: Security update for bash SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1247-1 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bash-9780 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bash-9780 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bash-9780 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-bash-9781 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-bash-9782 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bash-9780 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): readline-devel-5.2-147.22.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): readline-devel-32bit-5.2-147.22.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): libreadline5-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): bash-3.2-147.22.1 bash-doc-3.2-147.22.1 libreadline5-5.2-147.22.1 readline-doc-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libreadline5-32bit-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): bash-3.2-147.22.1 bash-doc-3.2-147.22.1 libreadline5-5.2-147.22.1 readline-doc-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libreadline5-32bit-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): bash-x86-3.2-147.22.1 libreadline5-x86-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): bash-3.2-147.14.22.1 bash-doc-3.2-147.14.22.1 libreadline5-5.2-147.14.22.1 readline-doc-5.2-147.14.22.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libreadline5-32bit-5.2-147.14.22.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): bash-3.2-147.14.22.1 bash-doc-3.2-147.14.22.1 libreadline5-5.2-147.14.22.1 readline-doc-5.2-147.14.22.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): libreadline5-32bit-5.2-147.14.22.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): bash-3.1-24.34.1 readline-5.1-24.34.1 readline-devel-5.1-24.34.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): readline-32bit-5.1-24.34.1 readline-devel-32bit-5.1-24.34.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bash-3.1-24.34.1 readline-5.1-24.34.1 readline-devel-5.1-24.34.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): readline-32bit-5.1-24.34.1 readline-devel-32bit-5.1-24.34.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): bash-3.2-147.22.1 bash-doc-3.2-147.22.1 libreadline5-5.2-147.22.1 readline-doc-5.2-147.22.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libreadline5-32bit-5.2-147.22.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 http://download.suse.com/patch/finder/?keywords=01d7685e480d31be1641e845919… http://download.suse.com/patch/finder/?keywords=1143502d673561f6e5895393ba9… http://download.suse.com/patch/finder/?keywords=7c3a2e9a2aa61a2702de17e1ed7… http://download.suse.com/patch/finder/?keywords=b6868a6fc575e34338a7d5fd749… http://download.suse.com/patch/finder/?keywords=d6f3fbe6b7cd7f9bd580be31dd2… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] Re: [security-announce] SUSE-SU-2014:1247-1: important: Security update for bash
by Wilfred van Velzen 08 Oct '14

08 Oct '14

What about releasing this patch for the NON LTSS versions as well? Considering the severity of this bug...! On Sun, Sep 28, 2014 at 7:05 PM, <opensuse-security(a)opensuse.org> wrote: > SUSE Security Update: Security update for bash > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2014:1247-1 > Rating: important > References: #898346 #898603 #898604 > Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 > > Affected Products: > SUSE Linux Enterprise Software Development Kit 11 SP3 > SUSE Linux Enterprise Server 11 SP3 for VMware > SUSE Linux Enterprise Server 11 SP3 > SUSE Linux Enterprise Server 11 SP2 LTSS > SUSE Linux Enterprise Server 11 SP1 LTSS > SUSE Linux Enterprise Server 10 SP4 LTSS > SUSE Linux Enterprise Server 10 SP3 LTSS > SUSE Linux Enterprise Desktop 11 SP3 > ______________________________________________________________________________ > > An update that fixes three vulnerabilities is now available. > > Description: > > > The command-line shell 'bash' evaluates environment variables, which > allows the injection of characters and might be used to access files on > the system in some circumstances (CVE-2014-7169). > > Please note that this issue is different from a previously fixed > vulnerability tracked under CVE-2014-6271 and is less serious due to the > special, non-default system configuration that is needed to create an > exploitable situation. > > To remove further exploitation potential we now limit the > function-in-environment variable to variables prefixed with BASH_FUNC_. > This hardening feature is work in progress and might be improved in later > updates. > > Additionally, two other security issues have been fixed: > > * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. > * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. > > Security Issues: > > * CVE-2014-7169 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> > * CVE-2014-7186 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> > * CVE-2014-7187 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Linux Enterprise Software Development Kit 11 SP3: > > zypper in -t patch sdksp3-bash-9780 > > - SUSE Linux Enterprise Server 11 SP3 for VMware: > > zypper in -t patch slessp3-bash-9780 > > - SUSE Linux Enterprise Server 11 SP3: > > zypper in -t patch slessp3-bash-9780 > > - SUSE Linux Enterprise Server 11 SP2 LTSS: > > zypper in -t patch slessp2-bash-9781 > > - SUSE Linux Enterprise Server 11 SP1 LTSS: > > zypper in -t patch slessp1-bash-9782 > > - SUSE Linux Enterprise Desktop 11 SP3: > > zypper in -t patch sledsp3-bash-9780 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): > > readline-devel-5.2-147.22.1 > > - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): > > readline-devel-32bit-5.2-147.22.1 > > - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): > > libreadline5-5.2-147.22.1 > > - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): > > bash-3.2-147.22.1 > bash-doc-3.2-147.22.1 > libreadline5-5.2-147.22.1 > readline-doc-5.2-147.22.1 > > - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): > > libreadline5-32bit-5.2-147.22.1 > > - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): > > bash-3.2-147.22.1 > bash-doc-3.2-147.22.1 > libreadline5-5.2-147.22.1 > readline-doc-5.2-147.22.1 > > - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): > > libreadline5-32bit-5.2-147.22.1 > > - SUSE Linux Enterprise Server 11 SP3 (ia64): > > bash-x86-3.2-147.22.1 > libreadline5-x86-5.2-147.22.1 > > - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): > > bash-3.2-147.14.22.1 > bash-doc-3.2-147.14.22.1 > libreadline5-5.2-147.14.22.1 > readline-doc-5.2-147.14.22.1 > > - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): > > libreadline5-32bit-5.2-147.14.22.1 > > - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): > > bash-3.2-147.14.22.1 > bash-doc-3.2-147.14.22.1 > libreadline5-5.2-147.14.22.1 > readline-doc-5.2-147.14.22.1 > > - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): > > libreadline5-32bit-5.2-147.14.22.1 > > - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): > > bash-3.1-24.34.1 > readline-5.1-24.34.1 > readline-devel-5.1-24.34.1 > > - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): > > readline-32bit-5.1-24.34.1 > readline-devel-32bit-5.1-24.34.1 > > - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): > > bash-3.1-24.34.1 > readline-5.1-24.34.1 > readline-devel-5.1-24.34.1 > > - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): > > readline-32bit-5.1-24.34.1 > readline-devel-32bit-5.1-24.34.1 > > - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): > > bash-3.2-147.22.1 > bash-doc-3.2-147.22.1 > libreadline5-5.2-147.22.1 > readline-doc-5.2-147.22.1 > > - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): > > libreadline5-32bit-5.2-147.22.1 > > > References: > > http://support.novell.com/security/cve/CVE-2014-7169.html > http://support.novell.com/security/cve/CVE-2014-7186.html > http://support.novell.com/security/cve/CVE-2014-7187.html > https://bugzilla.suse.com/show_bug.cgi?id=898346 > https://bugzilla.suse.com/show_bug.cgi?id=898603 > https://bugzilla.suse.com/show_bug.cgi?id=898604 > http://download.suse.com/patch/finder/?keywords=01d7685e480d31be1641e845919… > http://download.suse.com/patch/finder/?keywords=1143502d673561f6e5895393ba9… > http://download.suse.com/patch/finder/?keywords=7c3a2e9a2aa61a2702de17e1ed7… > http://download.suse.com/patch/finder/?keywords=b6868a6fc575e34338a7d5fd749… > http://download.suse.com/patch/finder/?keywords=d6f3fbe6b7cd7f9bd580be31dd2… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- Met vriendelijke groet / Best regards, Wilfred van Velzen -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

6 7

[opensuse-security] AA confining bash
by pinguin74 03 Oct '14

03 Oct '14

With regard to the lates Bash Shock, I wonder does it make sense to confine Bash with AppArmor after all? I think to create a dedicated profile solely for Bash does not make sense, because in general you want to be able to access everything with Bash, right? If an app wants to access Bash I envoke /bin/bash with the ix parameter, this way Bash inherits the app´s profile. Is this the only best way to confine Bash? Or does a dedicated profile make sense? Thanks

3 4

[opensuse-security] 袁欢
by Otxek 02 Oct '14

02 Oct '14

1每日饮豆浆一次，久服可使哮喘减轻。

1 0

[opensuse-security] High quality translation services from Etrans for German,Spanish,French,Chinese,Japanese,Korean,Thai,Indonesian,Malay,Tagalog,Vietnamese...
by Asian languages expert - Etrans Co.,Ltd 01 Oct '14

01 Oct '14

Dear Client, This is John from Etrans Co.,Ltd. We are a China/Hong Kong based localization company. We have quite many professional translators for Chinese, Japanese, Korean, Thai, Vietnamese, Tagalog, Malay, Indonesian etc.(German to SC, TC and JP) Especially for CCJK, many big translation companies are very like to work with us. Our rates are competitive and we will make sure to use our TOP professional translators in order to guarantee the quality every time. Our DTP team is also powerful. There are about 10 DTPers. Our usual rate is $6 per page.(Quark, InDesign....) Sincerely look forward to the cooperation. Best regards, John Zheng 2014/10/1 23:46:26

1 0

[opensuse-security] Additional security patches for bash in 11.4 Evergreen?
by Andrew Chace 01 Oct '14

01 Oct '14

Hello, I read the recent announcement regarding the end of maintenance for openSUSE 11.4 Evergreen. I really appreciate the patches for openSUSE-SU-2014:1238-1 (CVE-2014-6271) that were issued just after this announcement was made. My question is as follows: Are there any plans to issue patches for related CVEs that were posted shortly after CVE-2014-6271 (for example, 6277, 6278, 7169, 7186, and 7187)? Thanks, -Andrew -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 2