May 2010 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] php5 update for 10.2 breaks gallery
by Stefan Seyfried 01 Jun '10

01 Jun '10

Hi, just to let everyone know: the 5.3.2 update breaks my gallery2 installation thoroughly, it's segfaulting all the time. Downgrading to 5.3.1 from the update repo fixes it. -- Stefan Seyfried "Any ideas, John?" "Well, surrounding them's out." -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 4

[opensuse-security] FW_ALLOW_INCOMING_HIGHPORTS_TCP and SuSEfirewall2
by Malte Gell 26 May '10

26 May '10

Hi there, in SuSEfirewall2 there is a comment that FW_ALLOW_INCOMING_HIGHPORTS_TCP is now deprecated... I need this option set to "yes" on my server to be able to use my network scanner. If this option becomes obsolete, how the heck do I allow incoming high ports in the future? Finally, why are high ports blocked? Does this makes sense to block more than privileged ports? Regards Malte -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

4 4

Re: [opensuse-security] YOU command
by Greg Byrd 25 May '10

25 May '10

Here is a snippet of info from Novell I believe you're looking for. Good Luck! Greg http://www.novell.com/coolsolutions/trench/16345.html ________________________________ From: Rainer Sokoll <rainer(a)sokoll.com> To: opensuse-security(a)opensuse.org Sent: Tue, May 25, 2010 1:41:58 AM Subject: Re: [opensuse-security] YOU command On Tue, May 25, 2010 at 09:36:46AM +0200, Max teegee wrote: > What puzzles me is A) why does "which you" return nothing, and B) if I > invoke csh and try "you", it returns "command not found". > > Is it an add-on to bash for the online updates or so? "alias you" (in a running bash) will give you a light ;-) Rainer -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] SUSE Security Summary Report: SUSE-SR:2010:012
by Thomas Biege 25 May '10

25 May '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2010:012 Date: Tue, 25 May 2010 12:00:00 +0000 Cross-References: CVE-2009-0547, CVE-2009-0587, CVE-2009-2625 CVE-2009-3525, CVE-2009-3555, CVE-2009-3560 CVE-2009-3720, CVE-2010-0205, CVE-2010-0397 CVE-2010-0421, CVE-2010-0739, CVE-2010-0788 CVE-2010-0790, CVE-2010-0791, CVE-2010-0827 CVE-2010-0829, CVE-2010-1152, CVE-2010-1440 Content of this advisory: 1) Solved Security Vulnerabilities: - evolution-data-server - python/libpython2_6-1_0 - mozilla-nss - memcached - texlive/te_ams - mono/bytefx-data-mysql - libpng-devel - apache2-mod_php5 - ncpfs - pango - libcmpiutil 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - evolution-data-server - evolution considered S/MIME signatures to be valid even for modified mails (CVE-2009-0547: CVSS v2 Base Score: 5.0) - specially crafted base64 encoded messages could cause a heap buffer overflow (CVE-2009-0587: CVSS v2 Base Score: 7.5) - a POP3 server sending overly long lines could crash evolution Affected Products: SLE10-SP3, SLE11, openSUSE 11.0 - python/libpython2_6-1_0 This update of python has a copy of libxmlrpc that is vulnerable to denial of service bugs that can occur while processing malformed XML input. - CVE-2009-2625: CVSS v2 Base Score: 5.0: Permissions, Privileges, and Access Control (CWE-264) - CVE-2009-3720: CVSS v2 Base Score: 5.0: Insufficient Information - CVE-2009-3560: CVSS v2 Base Score: 5.0: Buffer Errors (CWE-119) Affected Products: SLES9, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - mozilla-nss Mozilla NSS was updated to version 3.12.6. This fixes all currently known issues in mozilla-nss, and also implements the new TLS/SSL renegotiation handling (CVE-2009-3555: CVSS v2 Base Score: 4.3). Affected Products: SLE10-SP2, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - memcached Remote attackers that are allowed to connect to memcached could crash memcached by sending invalid input (CVE-2010-1152: CVSS v2 Base Score: 5.0). Affected Products: SLE11 - texlive/te_ams Specially crafted dvi files could cause buffer overflows in dvips and dvipng: - CVE-2010-0827: CVSS v2 Base Score: 6.8: Numeric Errors (CWE-189) - CVE-2010-0829: CVSS v2 Base Score: 4.3: Buffer Errors (CWE-119) - CVE-2010-0739: CVSS v2 Base Score: 6.8: Numeric Errors (CWE-189) - CVE-2010-1440: CVSS v2 Base Score: 6.8: Numeric Errors (CWE-189) Affected Products: SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - mono/bytefx-data-mysql Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross- site-scripting (XSS) attacks. (CVE-2010-1459) Affected Products: SLE11 - libpng-devel A denial of service issue was fixed that could occur while decompressing a highly compressed huge ancillary chunk by using libpng (CVE-2010-0205: CVSS v2 Base Score: 5.0). Affected Products: SLES9, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - apache2-mod_php5 Incomplete XML RPC requests could crash the php interpreter (CVE-2010-0397: CVSS v2 Base Score: 4.3). PHP was updated to version 5.3.2 to fix the problem. Affected Products: openSUSE 11.1, 11.2 - ncpfs This update fixes three security issues in ncpfs: - fixed a information leakage on mount (CVE-2010-0790: CVSS v2 Base Score: 3.3) - fixed a mtab locking problem (CVE-2010-0791: CVSS v2 Base Score: 3.3) - fixed a race condition in ncpfs mounts (CVE-2010-0788: CVSS v2 Base Score: 1.7) Affected Products: SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - pango Specially crafted font files could cause a memory corruption in pango. Attackers could potentially exploit that to execute arbitrary code (CVE-2010-0421: CVSS v2 Base Score: 4.3) Affected Products: SLES9 - libcmpiutil Collective Xen/201004 Update, containing the following security patch: - xen pygrub vulnerability (CVE-2009-3525: CVSS v2 Base Score: 6.2) Affected Products: SLE11 ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. opensuse-security-announce(a)opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe(a)opensuse.org>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBS/uc+Xey5gA9JdPZAQLqmgf/QH0QldG7WgJEppNgyibL2qy1bnAHaep8 6kcFquQ/ojAMK73i/sbkOLpg3jfgenLdr8CB74IfqlqyaruLHG1NCcAMfVrbfX3M OwMFo8Sm975RQXoCHYw05rWyiO8qVXUuvzAzl/Rbh447LZyMNnvkoKHNtLmIMrWA uNYWZGhdRmfIVX3Kp3TI5010kS+aYW4Cu1TPOPV64PyRnoi2uNopvEt6mLAZGxTe bfR+C+6Z6/u5h/szFqV9LP/gvBd9pgbVItw4G9m2Km51r8P3X8nKttlLq2GpK8jK McgmO0xNDx6w6XKpCOtGobfp5L1N8oVok3G7trVxr55emes72hsPnQ== =OCaG -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] YOU command
by Max teegee 25 May '10

25 May '10

Hi list, Hi Marcus, I have stumbled upon the "you" command, which seems to work in bash, but for which "which you" returns nothing. It prompts for a password, seemingly invoking su, since if nothing is entered it returns "su: incorrect password". What puzzles me is A) why does "which you" return nothing, and B) if I invoke csh and try "you", it returns "command not found". Is it an add-on to bash for the online updates or so? Thanks in advance! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] SUSE Security Summary Report: SUSE-SR:2010:011
by Thomas Biege 10 May '10

10 May '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2010:011 Date: Mon, 10 May 2010 14:00:00 +0000 Cross-References: CVE-2008-7247, CVE-2009-0547, CVE-2009-1955 CVE-2009-2412, CVE-2009-2625, CVE-2009-3297 CVE-2009-3555, CVE-2009-3560, CVE-2009-3720 CVE-2009-3995, CVE-2009-3996, CVE-2009-4019 CVE-2009-4028, CVE-2009-4030, CVE-2010-0082 CVE-2010-0084, CVE-2010-0085, CVE-2010-0088 CVE-2010-0091, CVE-2010-0092, CVE-2010-0093 CVE-2010-0094, CVE-2010-0095, CVE-2010-0205 CVE-2010-0624, CVE-2010-0745, CVE-2010-0789 CVE-2010-0837, CVE-2010-0838, CVE-2010-0840 CVE-2010-0845, CVE-2010-0847, CVE-2010-0848 CVE-2010-1155, CVE-2010-1156, CVE-2010-1192 CVE-2010-1194, CVE-2010-1431, CVE-2010-1613 CVE-2010-1614, CVE-2010-1615, CVE-2010-1616 CVE-2010-1617, CVE-2010-1618, CVE-2010-1619 Content of this advisory: 1) Solved Security Vulnerabilities: - dovecot12 - cacti - java-1_6_0-openjdk - irssi - tar - fuse - apache2 - libmysqlclient-devel - cpio - moodle - libmikmod - libicecore - evolution-data-server - libpng/libpng-devel - libesmtp 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - dovecot12 Huge mail headers could cause dovecot to consume excessive amounts of CPU cycles. (CVE-2010-0745) Affected Products: openSUSE 11.2 - cacti Missing input sanitation in the template export feature allowed for SQL injection attacks (CVE-2010-1431). Affected Products: openSUSE 11.0 - java-1_6_0-openjdk java-1_6_0-openjdk version 1.7.3 fixes serveral security issues: - CVE-2010-0837: JAR 'unpack200' must verify input parameters - CVE-2010-0845: No ClassCastException for HashAttributeSet constructors if run with -Xcomp - CVE-2010-0838: CMM readMabCurveData Buffer Overflow Vulnerability - CVE-2010-0082: Loader-constraint table allows arrays instead of only the base-classes - CVE-2010-0095: Subclasses of InetAddress may incorrectly interpret network addresses - CVE-2010-0085: File TOCTOU deserialization vulnerability - CVE-2010-0091: Unsigned applet can retrieve the dragged information before drop action occurs - CVE-2010-0088: Inflater/Deflater clone issues - CVE-2010-0084: Policy/PolicyFile leak dynamic ProtectionDomains. - CVE-2010-0092: AtomicReferenceArray causes SIGSEGV->SEGV_MAPERR error - CVE-2010-0094: Deserialization of RMIConnectionImpl objects should enforce stricter checks - CVE-2010-0093: System.arraycopy unable to reference elements beyond Integer.MAX_VALUE bytes - CVE-2010-0840: Applet Trusted Methods Chaining Privilege Escalation Vulnerability - CVE-2010-0848: AWT Library Invalid Index Vulnerability - CVE-2010-0847: ImagingLib arbitrary code execution vulnerability - CVE-2009-3555: TLS: MITM attacks via session renegotiation Affected Products: openSUSE 11.0, 11.1, 11.2 - irssi irssi did not check the identity information of a remote hosts's certi- ficate. Attackers could exploit that for a man-in-the-middle attack (CVE-2010-1155). irssi could crash if someone changed nick while the victim was leaving the channel (CVE-2010-1156). Affected Products: openSUSE 11.0, 11.1, 11.2 - tar A malicious remote tape server could cause a buffer overflow in tar. In order to exploit that an attacker would have to trick the victim to extract a file that causes tar to open a connection to the rmt server (CVE-2010-0624). It's advisable to always use tar's --force-local local option to avoid such tricks. Affected Products: SLES9, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - fuse This update adds additional improvements to avoid a race condition in fusermount that allowed users to umount any filesystem (related to CVE-2009-3297). Thanks to Al Viro who found it. Additionally a race condition in fusermount was fixed that allowed non- privileged users to umount any file system (CVE-2010-0789). Note: this is a re-release of the previous update with a better patch. SLE10-SP2, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - apache2 Integer overflows in libapr could potentially be exploited to execute arbitrary code (CVE-2009-2412). Specially crafted XML documents cause apache to consume large amounts of memory (CVE-2009-1955). Affected Products: SLES9 - libmysqlclient-devel This update fixes several security issues in mysql: - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030) Affected Products: SLE10-SP2, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - cpio This update fixes a heap-based buffer overflow flaw that can happen while expanding specially-crafted archive files (CVE-2010-0624). It also contains changes for: - fixed Dat160 Tape Drive density information (bnc#415166) - fixed cpio issues with file sizes >= 2^32 - fixed handling eof and eod marks (bnc#371077) Affected Products: SLES9, SLE10-SP3, SLE11 - moodle Moodle version 1.9.8 fixes several security issues including cross-site-scripting (XSS) and SQL injection bugs (CVE-2010-1613, CVE-2010-1614, CVE-2010-1615, CVE-2010-1616, CVE-2010-1617 CVE-2010-1618, CVE-2010-1619). Affected Products: openSUSE 11.0, 11.1 - libmikmod Specially crafted "Impulse Tracker" and "Ultratracker" files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod (CVE-2009-3995, CVE-2009-3996). Affected Products: SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - libicecore This update of libxmlrpc is not vulnerable to denial of service bugs that can occur while processing malformed XML input. - CVE-2009-2625: CVSS v2 Base Score: 5.0 - CVE-2009-3720: CVSS v2 Base Score: 5.0 - CVE-2009-3560: CVSS v2 Base Score: 5.0 Affected Products: SLE10-SP2, SLE10-SP3, SLE11 - evolution-data-server evolution considered S/MIME signatures to be valid even for modified mails (CVE-2009-0547). Affected Products: SLE11, openSUSE 11.0 - libpng/libpng-devel Fix for a denial-of-service failure that can occur while decompressing a highly compressed huge ancillary chunk has been fixed in libpng (CVE-2010-0205). Affected Products: SLES9, SLE10-SP3 - libesmtp libesmtp did not properly handle wildcards and embedded null characters in the Common Name of X.509 certificates (CVE-2010-1192, CVE-2010-1194). Affected Products: SLE11, openSUSE 11.0, 11.1, 11.2 ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and included at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. opensuse-security-announce(a)opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe(a)opensuse.org>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBS+f9G3ey5gA9JdPZAQKSZgf/ZUjSdUZ0Hez8IbjU31lfv1qo0VtuwXwO rGJzMg00TOMr5T0mU9kY47HoGTAhSSiStKA3pPtLF9w3dMtygjkPRfKbv8nR5DQz DwJscVrTpE8auX+4I0brOe68Kzt1Sb1tthcjuyO9m+fcQI8jsjZ/pijvjdO0hUMd 77HhIjY9h4bODVMvjHAmpojbObZKTJ9GbGJuIGUO3PAlDpicLLryNvHPF4Hu5ntK cVTBNonm3LE7cdb0MIDPGO/QVfFfXhh5nQ77c8EHMnYuifi9AimYKuEdVSFLKEya ijSY+94arTe4UoVSmrYBrgbBQquHTOnhAn0L3M86x4wy1jLoGm8erA== =LMqw -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] undo security updates
by Susan Dittmar 06 May '10

06 May '10

Dear folks, my internet search skill seems to have abandonned me today. So I turn to you for hints on where to find information. What I need is a way to ensure I can undo any openSUSE 11.2 security update in case it spoils something. In the last years now and then security updates rendered parts of our system unusable. Most of those problems stemmed from custom-made applications that relied on certain architecture which had changed between versions and no longer held true after the update. While of course the openSUSE team cannot be held responsible for things they do not even know about, it leaves me very wary of any updates. Thus my question about any mechanisms to make sure I can undo updates. Thanks in advance for any pointers, Susan Dittmar -- Susan Dittmar, CIO - CCD and CMOS devices EURECA Messtechnik GmbH for science, space and military Eupenerstr. 150 customized and standard parts 50933 Köln Germany - lenses and optical filters phone: +49 (0)221 / 43082 - 390 - thermoelectric devices fax: +49 (0)221 / 43082 - 394 email: S.Dittmar(a)eureca.de - consulting services Handelsreg. Eintrag / Register entry : HRB 28609 Amtsgericht Köln USt.-IdNr. / VAT number : DE 186 063 293 Steuernummer / tax number : 223 / 5805 / 2511 Geschäftsführung / Management : J. Beckers, K. Sengebusch Diese Mitteilung erfolgt vertraulich und nur zur Kenntnisnahme durch die hierfür vorgesehenen Personen. Sollten Sie die Mitteilung irrtümlich erhalten haben, ist jede Weitergabe, Kopie oder Nutzung des Inhalts unzulässig. Bitte benachrichtigen Sie in diesem Fall den Absender und löschen Sie diese Nachricht und alle Anhänge dazu unverzüglich. This message is confidential and intended only for the exclusive use by particular persons. If you have received it by mistake, any review, copying, use or dissemination in whole or in part is strictly prohibited. Please notify the sender and delete this message and all its attachments from your system. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

5 4