August 2014 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] AA profiles world readable!?
by pinguin74 30 Aug '14

30 Aug '14

Hi there, do AppArmor profiles really need to be world readable? Would it hurt to set them to 640 or even 600? Why should user processes need to read AA profiles? If they don´t need, they shouldn´t in the first place IMHO. I mean, doesn´t only AA (=root) need to read them? Thanks

3 3

[opensuse-security] Confining Java applications
by pinguin74 30 Aug '14

30 Aug '14

How do you best confine Java applications using AppArmor? Can you just confine the Java interpreter itself or can you confine the Java *.jar package? I think this is similar to shell scripts? Shell scripts consist of individual application calls that render just confining the interpreter useless I guess? So, how to handle Java applications? And what is the target for aa-genprof in that setting? The Java interpreter, the *.jar package or both, like aa-genprof "/usr/bin/java foo,jar"? Thanks

2 2

[opensuse-security] glibc vulneranbility
by James Rome 30 Aug '14

30 Aug '14

Is 13.1 vulnerable to the glibc vulnerability: http://seclists.org/fulldisclosure/2014/Aug/69 http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-ed… https://access.redhat.com/solutions/1176253 If so, when is a patch coming? Do all the compiled programs using glibc have to be recompiled? -- James A. Rome http://jamesrome.net -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 2

[opensuse-security] What does Firefox want from kernel modules?
by pinguin74 29 Aug '14

29 Aug '14

Firefox wants to read /etc/modules.d/ and desperately wants access to modprobe and /sys/module/drm/initstate. For what reason? What kernel features would Firefox actively demand and enable? So far FF works without these permissions very well and I don´t want to grant them, but am curious why these requests occur.... Thanks

2 2

[opensuse-security] Proper AppArmor profiles
by pinguin74 25 Aug '14

25 Aug '14

Hi there, do you know a good source for working, proper AppArmor profiles? I am especially looking for a good Firefox and Thunderbird profile. Thanks -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 11

[opensuse-security] Apparmor aa-genprof broken?
by pinguin74 20 Aug '14

20 Aug '14

Ok, decided to open new thread.... I tried to create a new profile for VLC. I invoked aa-genprof /usr/bin/vlc and played around with VLC. But, when I press enter or (S)can in aa-genprof, nothing happens, a merely empty profile gets created. But, var log messages is full with DENIED messages, thus AppArmor detects how VLC accesses stuff. But aa-genprof seem to be unable to detect these things, it does not work. Then I tried to put the profile into complain mode and again played with VLC. Afterwards tried with aa-logprof to parse for AA messages. Again, it does not work. After I all, neither aa-genprof, nor aa-logprof creates profiles on my machine. I´m on openSUSE 13.1. Any hints on that? I really don´t want to create profiles completely manually....

3 3

[opensuse-security] apparmor DENIED despite rule
by pinguin74 20 Aug '14

20 Aug '14

Hello, I get messages like type=AVC msg=audit(1408524808.350:451575): apparmor="DENIED" operation="open" profile="/usr/bin/vlc" name="/usr/share/icons/oxygen/index.theme" pid=11244 comm="vlc" requested_mask="r" denied_mask="r" fsuid=500 ouid=0 Though I have set this rule: /usr/share/icons/**/ rk, I wonder, why does this rule not work? Similar things happen with other thins. Thanks

4 6

[opensuse-security] RE: [security-announce] openSUSE-SU-2014:0976-1: important: MozillaThunderbird: Update to 24.7.0
by Miller, William Toby 14 Aug '14

14 Aug '14

See below. Does this apply to us? Toby Miller | ISO | Enterprise Services (ES) Unisys | 50 W. Washington St | LL12 | 630-391-2345 | 312-983-0232 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers. -----Original Message----- From: opensuse-security(a)opensuse.org [mailto:opensuse-security@opensuse.org] Sent: Monday, August 11, 2014 3:05 AM To: opensuse-security-announce(a)opensuse.org Subject: [security-announce] openSUSE-SU-2014:0976-1: important: MozillaThunderbird: Update to 24.7.0 openSUSE Security Update: MozillaThunderbird: Update to 24.7.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0976-1 Rating: important References: #887746 Cross-References: CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 24.7.0 (bnc#887746) * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images A standalone enigmail 1.7 package that was previously built as part of MozillaThunderbird was added. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-487 - openSUSE 12.3: zypper in -t patch openSUSE-2014-487 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-24.7.0-70.27.1 MozillaThunderbird-buildsymbols-24.7.0-70.27.1 MozillaThunderbird-debuginfo-24.7.0-70.27.1 MozillaThunderbird-debugsource-24.7.0-70.27.1 MozillaThunderbird-devel-24.7.0-70.27.1 MozillaThunderbird-translations-common-24.7.0-70.27.1 MozillaThunderbird-translations-other-24.7.0-70.27.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-24.7.0-61.55.1 MozillaThunderbird-buildsymbols-24.7.0-61.55.1 MozillaThunderbird-debuginfo-24.7.0-61.55.1 MozillaThunderbird-debugsource-24.7.0-61.55.1 MozillaThunderbird-devel-24.7.0-61.55.1 MozillaThunderbird-translations-common-24.7.0-61.55.1 MozillaThunderbird-translations-other-24.7.0-61.55.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 References: http://support.novell.com/security/cve/CVE-2014-1544.html http://support.novell.com/security/cve/CVE-2014-1547.html http://support.novell.com/security/cve/CVE-2014-1548.html http://support.novell.com/security/cve/CVE-2014-1555.html http://support.novell.com/security/cve/CVE-2014-1556.html http://support.novell.com/security/cve/CVE-2014-1557.html https://bugzilla.novell.com/887746 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

4 3

[opensuse-security] I am with beloved we one!
by Maria 12 Aug '14

12 Aug '14

Hello, My name is Maria http://snjfssofh.hints.me Profiles:435817673 I am a feminine and cute woman with blond hair and blue eyes. I'd be happy to meet a handsome man, who wishes to create a real relations leading to marriage,who is dreaming about home and family. Friends know me as friendly, sympathetic person, who is always ready to listen and to support. I am hopeless dreamer and I live by soul, I like to be myself. I want to be with a man who wants to build a strong relationship and who can care of his beloved woman. I hope that, we'll necessarily find each other... Goodbye, Maria. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] 随地有春
by zhaoruxwsb＠sohu.com 02 Aug '14

02 Aug '14

ncntprp 代电开话发 l 票 8 验 8 证 9 后 8 付 5 款 6 保 5 真 8 刘 6 经 7 理 acqhb N��r��y隊Z)z{.��r��/��˛��m�)z{.��+�:�{Zr�az�'z��j)h��Ǭy˫�ܾ� ޮ�^�ˬz��

1 0