Hi, John schrieb:

From: Reto Inversini To: suse-security@suse.com Date: Wednesday, July 27, 2005, 11:02:54 PM Subject: [suse-security] apache2 patch

Wednesday, July 27, 2005, 11:02:54 PM, you wrote:

...

John wrote:

...

...

hello all

...

Hi John

...

...

I noticed that /usr/sbin/httpd2-prefork has new timestamp (22/jul) but the same size (in bytes) with the older one.

...

AFAIK the patch was just a small one, the vulnerability is a off-by-one error in mod_ssl. What exactly has changed can be found here:

...

http://svn.apache.org/viewcvs.cgi/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?rev=179781&view=diff&r1=179781&r2=179780&p1=httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c&p2=/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c

...

...

Can anyone explain to me what does this mean? How the patch has fit in that binary and the size remains the same?

...

If you want to be totally sure, if you have got the changed binary in your chroot environment calculate an md5 hash over the old and the new file, the md5sums should differ.

...

Regards Reto

Ok, i saw that piece of code. But how the binary be the same

YOU downloaded the apache2-prefork*.rpm and apache2-*.rpm

The above rpms installed at once. So the old binaries must have been overwriten but they have the same size excactly.

Can jou imagine, that an "Decrement and jump if zero" and an "Jump if zero" in assembler might be the same size. So refering to the Patch i can really imagine, that the File Size might be the same. But i guess, there would be 2 Bytes different in the Binary.

md5sum outputs the hash of the file size I will then receive the same hash for the old and the new binary httpd2-prefork, won't i?

Definitly not. Check out RFC 1321. Greetings Dirk

-- xcldsc TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Richard Hofbauer kaufm. Geschäftsleitung: Rosa Igl -------------------------------------------------------- Nachricht von: Dirk.Schreiner@tria.de Nachricht an: isofroni@cc.uoi.gr, suse-security@suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

Hi, Philippe Vogel schrieb:

Hi!

Dirk Schreiner schrieb:

...

...

"Decrement and jump if zero" and an "Jump if zero" in assembler might be the same size.

So refering to the Patch i can really imagine, that the File Size might be the same. But i guess, there would be 2 Bytes different in the Binary.

So this means a patch would be 2bytes long + adress-information? So why such big update-files?

No it means it _could_ be. But as i do not have the both binaries handy, i really cannot tell. Big Update Files: I guess it is far more easy to deliver a new File, checkout the md5sum, as YOU is doing, and then move the File over the old File, which is as you know an atomic operation, than delivering a patch, copying the old File, editing the old File, and then checking the md5sum, and afterwards moving. But if you really want to know, you`ll have to ask the Novell Guys. Dirk

Philippe

--

Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift!

Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt!

-- xcldsc TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Richard Hofbauer kaufm. Geschäftsleitung: Rosa Igl -------------------------------------------------------- Nachricht von: Dirk.Schreiner@tria.de Nachricht an: suse-security@suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

Hi all - Interesting conversation. Is it possible to do a binary grep on the two files, and see exactly where the difference is? my 2c Keith Roberts http://www.karsites.net/ On Thu, 28 Jul 2005, Lars Ellenberg wrote:

about 70k of them is rpm header payload (file list, changelog data, info etc.) so you get about 4k of actual delta payload, and the binary to be patched is about 350k.

Hi, John schrieb:

From: suse@karsites.net To: suse-security@suse.com Date: Thursday, July 28, 2005, 1:16:00 PM Subject: [suse-security] apache2 patch

Thursday, July 28, 2005, 1:16:00 PM, you wrote:

...

Hi all - Interesting conversation.

...

Is it possible to do a binary grep on the two files, and see exactly where the difference is?

...

my 2c

...

Keith Roberts

...

http://www.karsites.net/

...

On Thu, 28 Jul 2005, Lars Ellenberg wrote:

...

...

about 70k of them is rpm header payload (file list, changelog data, info etc.) so you get about 4k of actual delta payload, and the binary to be patched is about 350k.

here are my tries

monster:~ # md5sum -b /chroot/usr/sbin/httpd2-prefork 759ca3e33e02b451feb7fafc2644da4b */chroot/usr/sbin/httpd2-prefork monster:~ # md5sum -b /usr/sbin/httpd2-prefork 38cd81e70e16a60474b8a2c2e2be872d */usr/sbin/httpd2-prefork monster:~ # ll /usr/sbin/httpd2-prefork -rwxr-xr-x 1 root root 440615 Jul 22 22:47 /usr/sbin/httpd2-prefork monster:~ # ll /chroot/usr/sbin/httpd2-prefork -rwxr-xr-x 1 root root 440615 Feb 27 21:18 /chroot/usr/sbin/httpd2-prefork

http://sourceforge.net/projects/biew/ Dirk -- xcldsc TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Richard Hofbauer kaufm. Geschäftsleitung: Rosa Igl -------------------------------------------------------- Nachricht von: Dirk.Schreiner@tria.de Nachricht an: isofroni@cc.uoi.gr, suse-security@suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

...

Is it possible to do a binary grep on the two files, and see exactly where the difference is?

http://sourceforge.net/projects/biew/

--> Or use "hexedit" to create two ASCII hexdumps of the binaries and then ordinary diff to find the offset which differs. Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech@iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50