January 2001 - openSUSE Users - openSUSE Mailing Lists

RE: [SLE] new system advise
by Seth Payne 04 Jan '01

04 Jan '01

The first thing I would so is download the binaries for the newest version of Star Office at openoffice.org. Version 6 is A LOT faster than previous versions and is not such a memory hog. In my opinion, you can't go wrong with either an athlon (although I have heard some rumors of problems) or a pentium III. I would certainly stay away from the pentium 4 for now. Seth -----Original Message----- From: Donald G. Knecht [mailto:msspal@gbso.net] Sent: Thursday, January 04, 2001 9:05 PM To: 'suse-linux-e(a)suse.com' Subject: [SLE] new system advise hey i see this question asked a lot but since i wasn't doing an upgrade at the time i really didn't pay much attention, i need to build a new i386 home office workstation, OS of course would be SuSE-Linux, now what to buy? i use a p200 currently, and usually do most of my work in staroffice, gimp, and netscrap,(no apache, servers or networking for that matter) the first two get really slow, gimp, usually when a lot of images are open or really big, staroffice just seems to be slow always.....i currently have a voodoo3 and 128mb ram which has helped, but now i can afford a faster processor/system. advise, thoughts, and ideas welcome specifically, what are the pros/cons of Athlon, Duron vs. Celeron, Pentium II, III TIA, don -- proud Linux user since kernel 1.1.54 icq#42235604 -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq

1 0

gimp
by ajtiM 04 Jan '01

04 Jan '01

Is there or will be Gimp 1.2 rpm's on SuSE ftp server or it waiting for new SuSE 7.? ? Thanks. Mitja

2 1

OVERFLOW in Shockwave Flash plugin for web browsers. Afffects ALL platforms
by Jerry Kreps 04 Jan '01

04 Jan '01

Date: Fri, 29 Dec 2000 18:25:57 -0000 From: "Krawetz, Neal" <nealk(a)VERINET.COM> Subject: Shockwave Flash buffer overflow To: BUGTRAQ(a)SECURITYFOCUS.COM I have identified a buffer overflow condition in the Shockwave Flash plugin for web browsers. Although this is "yet another buffer overrun", Macromedia's web page claims that 90% of all web browsers have the plugins installed. Since this overflow can be used to run arbitrary code, it impacts 90% of all "web" enabled systems. ===== Area of affect: All SWF plugins on all platforms. I have validated it with the Shockwave Flash plugins versions 2 through 8. I have validated it on Windows 95, 98, NT, MacOS 9, Solaris 2.6 and 2.7, and RedHat Linux 6.0. I have validated it using Netscape (4.04, 4.7) and Internet Explorer. The buffer overflows are consistent per platform, but vary between plaforms. (Or in english: A corrupt SWF may crash Netscape on Windows 95, but only screw up the graphics under Linux. This SWF will always crash Netscape on Win95 the same way and it will always screw up the Linux graphics the same way. A different corrupt SWF file could crash the browser on all platforms.) ===== Root cause: (Keep in mind -- I have not actually seen the source code for the plugins -- I have only determined this from the symptoms.) Bounds checking is not being performed on the SWF data. The SWF file is in the format: tag length data tag length data ... Where "tag" tells what action to perform and "length" is the size of the data for the tag. ("data" is the data for the tag.) For example: Define_Picture "40 bytes" data_for_the_picture Some tags have more complex data formats, where data contains: subtag sublength subdata subtag sublength subdata "0" The "0" means "end of data". So, the entire tag looks like: tag length (subtag1 sublength1 subdata1 subtag2 sublength2 subdata2 "0") Sample tags with complex data are Define_Sprite (tag 39) and Do_Action (tag 12). If the "0" is missing, or appears beyond "length" bytes, then a buffer overflow occurs. Or in other words: If the lengths or sublengths are wrong, then the shockwave flash plugin will overflow. ===== Impact of risk: The buffer overflow can be used to execute arbitrary code stored in the SWF file. "Bad" arbitrary code causes the plugin to crash the browser. "Good" arbitrary code can execute a program on the browser's computer. This can be used to propogate a virus, worm, or do other harmful tasks. It is possible to write a single SWF file that contains platform-specific overflow/opcodes for multiple systems (Solaris, Linux, Windows, Irix, etc.). ===== Worst case: I'll leave this for you to decide. I believe a multi-platform (Windows/Unix) self-modifying virus is possible. ("Self-modifying" would be hard part.) ===== What can you do: 1. Hope that Macromedia corrects the problem. Download the corrected version when/if it becomes available. 2. The anti-virus vendors can write modules to check the bounds on SWF files from web pages. (If data should be null terminated, validate that there is a null. For some tags (like tag 83), make sure there are two nulls in the data. Make sure there are no illegal tags.) 3. Hope the issue is addressed before someone writes something nasty. Until then, disable (remove) the Shockwave Flash plugin. ===== Reporting history: (I am including this in case someone decides to sue me.) Early July 2000: - Identified the defect. July 25, 2000: - Reported defect to Macromedia (call number TWL2000072500018060) July 26, 2000: - Reported the defect to CERT, NIPC, and CIAC. July 30, 2000: - Contact from "Chris" at Macromedia asking for more information. I provided details. August 2000: - Talked with "Chris" from CERT at Usenix Security conference. He called it a "sleeper" and said he would look into it. (I know... There were two guys named "Chris from CERT" -- this was the dark-haired guy.) [As an aside, isn't there some risk about everybody being named "Chris"?] December 15, 2000: - No advisories or notice from Macromedia, CERT, NIPC, or CIAC. - Macromeda has, during this time, released updates to Shockwave Flash and these are still vulnerable. (Evidence that they are not invesitigating or addressing the issue.) - Decided to post to BugTraq. - By dumb luck, met a guy at a party who knew a guy who was the sister of a "senior manager" at Macromedia. Decided to hold off posting. December 18, 2000: - Made contact with the manager's brother. Left phone message for sister at Macromedia. December 19, 2000: - Provided details of exploit to Macromedia. Also provided sample SWF files that perform buffer overflows on various platforms. December 20, 2000: - Received the same reply from Macromedia that I did on July 30. (It has been forwarded to the engineers for investigation.) - Decided to give them one week to respond before posting to Bugtraq. December 29, 2000: - Post to Bugtraq. (In hindsight, I should have done this back in August.) ------------------------------------------------------- -- Scientific theories, according to Sir Karl Popper, can be "falsified," or proven wrong, by experiment. Unscientific theories -Marxist dialectical history and Freudian psychology were Popper's favorites- are formed in such a way that they cannot be falsified by data.

1 0

Fw: Re: [SLE] Simple masquerading setup
by quintaq＠yahoo.co.uk 04 Jan '01

04 Jan '01

Begin forwarded message: Date: Thu, 4 Jan 2001 16:08:32 +0000 From: quintaq(a)yahoo.co.uk To: Alfredo Figueroa <afigueroa(a)expressmail.net> Subject: Re: [SLE] Simple masquerading setup On Wed, 3 Jan 2001 21:46:01 -0600 Alfredo Figueroa <afigueroa(a)expressmail.net> wrote: > Geoff: > you need make yours custon script .... Alfredo, Thank you very much indeed. I made the script exactly as you suggested and it works perfectly. :) Geoff _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

Scanners Please
by Gary 04 Jan '01

04 Jan '01

I am in need of a scanner. What works, and if anyone uses USB, would like to know what everyone is using - USB or not. Please. The SuSE database is quite old. -- Best regards, Gary Today's thought: Chaos, panic, pandemonium - my work here is done.

2 2

Printer problem.
by Fred A. Miller 04 Jan '01

04 Jan '01

'Have a problem I can't seem to resolve. I'm trying to get a new Lexmarkz52 up and running, which is all "OK," however, I'm getting an error that a connection to the lpr daemon is refused? Anyone with an idea how to fix this problem that SHOULDN'T be a problem? Thanks! Fred -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

2 1

Suse 7.0's fdisk and Sony VAIO install
by Shane Rogers 04 Jan '01

04 Jan '01

I'm trying to get Suse 7.0 Professional installed on my Sony VAIO laptop (PCG-818 I think - I'm not around it at the moment) and come upon a problem during creating the disk partitions. Yast fails to make any new partitions because fdisk cannot properly see the hard drive. When I change to another console and manually run fdisk, it tells me that I have too many partitions (16, with a maximum of 8). When I print out the partition table, it only shows 4 partitions - and none of them are what is actually on the drive. I can install Debian 2.2r2 and Suse 6.4 (and older) just fine and even tried to upgrade from 6.4 to 7.0 - but once again fdisk fails. I've not ever had a problem with this laptop and have run Suse on it since 5.1. If any more information is needed I can send it. Thanks. -- Shane Rogers .-------------------------. Coordinator of Network Systems - P.I.T.T. | Linux, | Pittsburg State University, Pittsburg KS | one less thing | srogers(a)pittstate.edu | to worry about. | swrogers(a)chanute-ks.com ._________________________.

1 0

package search
by Purple Shirt 04 Jan '01

04 Jan '01

It's great that SuSE lists the packages on the website and what they contain. I wish there was one thing though. Can you add a search feature for the packages and their contents? I am missing program 'rz' on my system. I usually have it installed. I don't know which package it is in. I wish we could search all packages for the string 'rz' and easily find what package 'rz' is in. mk _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

2 1

Vacation updated
by Sean Rima 04 Jan '01

04 Jan '01

Originally to: All I have updated the beta version of Vacation with a patch from Michael Sweet. Over to Micael for a description :) : "Basically, if the vacation program is run more than once at the same time (a pretty common thing with sendmail) then the gdbm_open() call will fail with EAGAIN (because the database is opened in exclusive mode)." I have just sent the source to Sourceforge so the cvs-tarball will be updated sometime this evening. http://cvs.sourceforge.net/cvstarballs/vacation-cvsroot.tar.gz As a side note, I continue to make various RPM packages for 6.3. 7.0 will come along side soon (ie as soon as I finish painting the house) Sean -- GNUPG ID 92B9D0CF | Fidonet: 2:263/950 ICQ: 679813 | Homepage: http://www.tcob1.net Linux User: #124682 | My last power cut was 4d, 5h and 19m ago ...Linux: Because rebooting is for adding new hardware. <Gateway Information> Please do not respond direct to this message as the author will not see it This list is gated to a Fidonet Echo by tcob1

1 0

[o.b.] Known Error Messages
by Oliver Ob 04 Jan '01

04 Jan '01

Hi /Lx fans! E: Is there a list available which contains a sort of "known error messages" list and short comments on how to solve these problems? example: /dev/isdn/ctrl "no such device" - means x, do y to solve problem/debug if possible with search function d: Gibts irgendwie eine Liste, die alle bekannten Fehlermeldungen auflistet und dazu in kurzen Worten eine Beschreibung und Problemloesung offeriert? Beispiel: /dev/isdn/ctrl "no such device" - bedeutet x und man sollte y tun, um zu debuggen wenn moeglich mit suchfunktion Oliver

2 1