July 2014 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Software Updater never asks for password
by James Rome 31 Jul '14

31 Jul '14

The Plasma Software Update desktop tool on 13.1 never asks for a password when it updates everything. Isn't this a security violation? -- James A. Rome jamesrome(a)gmail.com http://jamesrome.net -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 4

[opensuse-security] AWAY: Re: [security-announce] openSUSE-SU-2014:0953-2: important: ppc64-diag: fix for tmp races and information disclosure
by markus＠palominosys.com 31 Jul '14

31 Jul '14

I am out of the office until Aug 8 and will only have sporadic access to email until then. For any urgent matter, please contact Aaron Metler at aaron(a)palominosys.com or 416 964 7333, ext 133. For all other inquiries, contact Rachel Lapp at rachel.lapp(a)palominosys.com or ext 227. Have a great day! Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] AWAY: Re: [security-announce] openSUSE-SU-2014:0950-1: important: Mozilla updates 07/2014
by markus＠palominosys.com 30 Jul '14

30 Jul '14

I am out of the office until Aug 8 and will only have sporadic access to email until then. For any urgent matter, please contact Aaron Metler at aaron(a)palominosys.com or 416 964 7333, ext 133. For all other inquiries, contact Rachel Lapp at rachel.lapp(a)palominosys.com or ext 227. Have a great day! Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] AWAY: Re: [security-announce] SUSE-SU-2014:0928-1: important: Security update for ppc64-diag
by markus＠palominosys.com 23 Jul '14

23 Jul '14

I am out of the office until Aug 8 and will only have sporadic access to email until then. For any urgent matter, please contact Aaron Metler at aaron(a)palominosys.com or 416 964 7333, ext 133. For all other inquiries, contact Rachel Lapp at rachel.lapp(a)palominosys.com or ext 227. Have a great day! Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Encryption password fail on install > internationalisation <
by Mark Ballard 22 Jul '14

22 Jul '14

Hello Two problems related to security and internationalisation have arisen while attempting to install opensuse: one major, one merely obstructive. Both problems occur when setting the encryption password. 1. The major problem concerns the keyboard layout. The opensuse installer very helpfully asks which international keyboard layout it should use during install. It does this before asking for the user to set their passphrases. So the user gets to formulate their password in their chosen international keyboard layout - most likely the keyboard layout they are actually using: e.g. UK keyboard layout. But when install is complete, in my instance at least, the computer goes to a command screen and says, before prompting for the just given password to open the encrypted disk: "Note: only US keyboard layout is supported". The result is a failed install unless you happen to be in the US. Perhaps the problem has not occured in other countries where language differences have focused more attention on internationlisation? It is nigh on impossible to enter your encryption password using a US layout on a UK keyboard unless you use a password drawn from a limited and therefore less secure set of characters; and only then if you happen to know what characters are actually valid in both keyboard layouts, and where they are. I had a quick look. I'm not even sure it's actually possible to map characters chosen from a UK keyboard layout into a US keymap and then back onto a UK keyboard layout again without losing some. At least not for a regular person who is simply trying to put their password in at the prompt. Maybe not for anyone but Lou Gerstner himself. if this problem cannot be corrected, it would at least save the people time and frustration to tell them which characters are valid or not when they create their password, and to remove the offer of a non-US keyboard during install. I'm sure people would be happy not to choose invalid characters if they were told what they were. 2. The other problem is that the password itself recognises limited punctuation characters in whatever character set. Characters it does not recognise are recognised routinely by other password prompts. Some other password prompts fail to recognise characters that the opensuse password prompt does. Some password prompts have no limitations for a given standard keyboard layout. The result is that it becomes difficult to create a password system - i.e. a method for choosing complex passwords for different situations that can be remembered - because your system falls down as soon as you come across a password screen that disallows certain characters your system relies on. This actually happens pretty regularly. And the rules about what is a valid character or not seem always to be different. That doesn't make it right. If only the base system could assure no limitations. Hope this helps. mb. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] Re: [security-announce] openSUSE-SU-2014:0903-1: critical: flash-player
by Oliver Frohn 16 Jul '14

16 Jul '14

Am 16.07.2014 um 12:04 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: flash-player > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2014:0903-1 > Rating: critical > References: #886472 > Cross-References: CVE-2014-0537 CVE-2014-0539 CVE-2014-4671 > > Affected Products: > openSUSE 13.1:NonFree > openSUSE 12.3:NonFree > ______________________________________________________________________________ > > An update that fixes three vulnerabilities is now available. > > Description: > > - Security update to 11.2.202.394 (bnc#886472): > * APSB14-17, CVE-2014-0537, CVE-2014-0539, CVE-2014-4671 > - License update (LICENSE -> Flash%20Player_14.0.pdf). > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 13.1:NonFree: > > zypper in -t patch openSUSE-2014-460 > > - openSUSE 12.3:NonFree: > > zypper in -t patch openSUSE-2014-460 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 13.1:NonFree (i586 x86_64): > > flash-player-11.2.202.394-58.1 > flash-player-gnome-11.2.202.394-58.1 > flash-player-kde4-11.2.202.394-58.1 > > - openSUSE 12.3:NonFree (i586 x86_64): > > flash-player-11.2.202.394-2.84.1 > flash-player-gnome-11.2.202.394-2.84.1 > flash-player-kde4-11.2.202.394-2.84.1 > > > References: > > http://support.novell.com/security/cve/CVE-2014-0537.html > http://support.novell.com/security/cve/CVE-2014-0539.html > http://support.novell.com/security/cve/CVE-2014-4671.html > https://bugzilla.novell.com/886472 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

Re: [opensuse-security] Inserting Boot Passphrase to decrypt hard drive
by Keith Roberts 08 Jul '14

08 Jul '14

Thanks Chris and Dave for your replies. I’ll check these out soon. Kind Regards, Keith On 8 Jul 2014, at 14:01, 686f6c6d <686f6c6d(a)googlemail.com> wrote: > You could script it a bit with https://github.com/sibson/vncdotool > > > -- > Kind regards > Christopher 'm4z' Holm / 686f6c6d > > "We must respect the other fellow's religion, but only in the sense > and to the extent that we respect his theory that his wife is > beautiful and his children smart." --H. L. Mencken > -- > To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org > To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Inserting Boot Passphrase to decrypt hard drive
by Keith Roberts 08 Jul '14

08 Jul '14

Greetings all. At work we have a set of VM’s that are all using encryption on their hard drive images. The current way to insert the decryption key is by using vncviewer which can be quite time consuming and error prone as we have to manually type the passphrase into the vncviewer, because copy and paste is not working on my iMac. Is there a better way you know of please how to insert the passphrase to allow the VM to boot up normally. We have discussed a separate boot partition that is not encrypted, but this is not a viable alternative. TIA Keith Roberts -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 2

[opensuse-security] Re: openSUSE-SU-2014:0856-1: important: kernel: security and bugfix release
by splatflys 02 Jul '14

02 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Could I get Subscribed from this list, as there is nothing in headers? or on the bottom? on How to Subscriber Nothing! I keep asking and get no help in replay's On 01/07/14 20:04, opensuse-security(a)opensuse.org wrote: > openSUSE Security Update: kernel: security and bugfix release > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2014:0856-1 > Rating: important > References: #869563 #870173 #870576 #871561 #873374 #876102 > #878274 #880892 > Cross-References: CVE-2013-7339 CVE-2014-0055 CVE-2014-0077 > CVE-2014-2678 CVE-2014-2851 CVE-2014-3122 > CVE-2014-3153 > Affected Products: > openSUSE 12.3 > ______________________________________________________________________________ > > An update that solves 7 vulnerabilities and has one errata > is now available. > > Description: > > > The Linux kernel was updated to fix security issues and bugs: > > Security issues fixed: CVE-2014-3153: The futex_requeue function in > kernel/futex.c in the Linux kernel did not ensure that calls have two > different futex addresses, which allowed local users to gain privileges > via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter > modification. > > CVE-2014-0077: drivers/vhost/net.c in the Linux kernel, when mergeable > buffers are disabled, did not properly validate packet lengths, which > allowed guest OS users to cause a denial of service (memory corruption and > host OS crash) or possibly gain privileges on the host OS via crafted > packets, related to the handle_rx and get_rx_bufs functions. > > CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the > vhost-net subsystem in the Linux kernel package did not properly handle > vhost_get_vq_desc errors, which allowed guest OS users to cause a denial > of service (host OS crash) via unspecified vectors. > > CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the > Linux kernel allowed local users to cause a denial of service (NULL > pointer dereference and system crash) or possibly have unspecified other > impact via a bind system call for an RDS socket on a system that lacks RDS > transports. > > CVE-2013-7339: The rds_ib_laddr_check function in net/rds/ib.c in the > Linux kernel allowed local users to cause a denial of service (NULL > pointer dereference and system crash) or possibly have unspecified other > impact via a bind system call for an RDS socket on a system that lacks RDS > transports. > > CVE-2014-2851: Integer overflow in the ping_init_sock function in > net/ipv4/ping.c in the Linux kernel allowed local users to cause a denial > of service (use-after-free and system crash) or possibly gain privileges > via a crafted application that leverages an improperly managed reference > counter. > > CVE-2014-3122: The try_to_unmap_cluster function in mm/rmap.c in the Linux > kernel did not properly consider which pages must be locked, which allowed > local users to cause a denial of service (system crash) by triggering a > memory-usage pattern that requires removal of page-table mappings. > > Bugs fixed: > - memcg: deprecate memory.force_empty knob (bnc#878274). > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 12.3: > > zypper in -t patch openSUSE-2014-451 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 12.3 (i586 x86_64): > > kernel-default-3.7.10-1.36.1 > kernel-default-base-3.7.10-1.36.1 > kernel-default-base-debuginfo-3.7.10-1.36.1 > kernel-default-debuginfo-3.7.10-1.36.1 > kernel-default-debugsource-3.7.10-1.36.1 > kernel-default-devel-3.7.10-1.36.1 > kernel-default-devel-debuginfo-3.7.10-1.36.1 > kernel-syms-3.7.10-1.36.1 > > - openSUSE 12.3 (i686 x86_64): > > kernel-debug-3.7.10-1.36.1 > kernel-debug-base-3.7.10-1.36.1 > kernel-debug-base-debuginfo-3.7.10-1.36.1 > kernel-debug-debuginfo-3.7.10-1.36.1 > kernel-debug-debugsource-3.7.10-1.36.1 > kernel-debug-devel-3.7.10-1.36.1 > kernel-debug-devel-debuginfo-3.7.10-1.36.1 > kernel-desktop-3.7.10-1.36.1 > kernel-desktop-base-3.7.10-1.36.1 > kernel-desktop-base-debuginfo-3.7.10-1.36.1 > kernel-desktop-debuginfo-3.7.10-1.36.1 > kernel-desktop-debugsource-3.7.10-1.36.1 > kernel-desktop-devel-3.7.10-1.36.1 > kernel-desktop-devel-debuginfo-3.7.10-1.36.1 > kernel-ec2-3.7.10-1.36.1 > kernel-ec2-base-3.7.10-1.36.1 > kernel-ec2-base-debuginfo-3.7.10-1.36.1 > kernel-ec2-debuginfo-3.7.10-1.36.1 > kernel-ec2-debugsource-3.7.10-1.36.1 > kernel-ec2-devel-3.7.10-1.36.1 > kernel-ec2-devel-debuginfo-3.7.10-1.36.1 > kernel-trace-3.7.10-1.36.1 > kernel-trace-base-3.7.10-1.36.1 > kernel-trace-base-debuginfo-3.7.10-1.36.1 > kernel-trace-debuginfo-3.7.10-1.36.1 > kernel-trace-debugsource-3.7.10-1.36.1 > kernel-trace-devel-3.7.10-1.36.1 > kernel-trace-devel-debuginfo-3.7.10-1.36.1 > kernel-vanilla-3.7.10-1.36.1 > kernel-vanilla-debuginfo-3.7.10-1.36.1 > kernel-vanilla-debugsource-3.7.10-1.36.1 > kernel-vanilla-devel-3.7.10-1.36.1 > kernel-vanilla-devel-debuginfo-3.7.10-1.36.1 > kernel-xen-3.7.10-1.36.1 > kernel-xen-base-3.7.10-1.36.1 > kernel-xen-base-debuginfo-3.7.10-1.36.1 > kernel-xen-debuginfo-3.7.10-1.36.1 > kernel-xen-debugsource-3.7.10-1.36.1 > kernel-xen-devel-3.7.10-1.36.1 > kernel-xen-devel-debuginfo-3.7.10-1.36.1 > > - openSUSE 12.3 (noarch): > > kernel-devel-3.7.10-1.36.1 > kernel-docs-3.7.10-1.36.2 > kernel-source-3.7.10-1.36.1 > kernel-source-vanilla-3.7.10-1.36.1 > > - openSUSE 12.3 (i686): > > kernel-pae-3.7.10-1.36.1 > kernel-pae-base-3.7.10-1.36.1 > kernel-pae-base-debuginfo-3.7.10-1.36.1 > kernel-pae-debuginfo-3.7.10-1.36.1 > kernel-pae-debugsource-3.7.10-1.36.1 > kernel-pae-devel-3.7.10-1.36.1 > kernel-pae-devel-debuginfo-3.7.10-1.36.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-7339.html > http://support.novell.com/security/cve/CVE-2014-0055.html > http://support.novell.com/security/cve/CVE-2014-0077.html > http://support.novell.com/security/cve/CVE-2014-2678.html > http://support.novell.com/security/cve/CVE-2014-2851.html > http://support.novell.com/security/cve/CVE-2014-3122.html > http://support.novell.com/security/cve/CVE-2014-3153.html > https://bugzilla.novell.com/869563 > https://bugzilla.novell.com/870173 > https://bugzilla.novell.com/870576 > https://bugzilla.novell.com/871561 > https://bugzilla.novell.com/873374 > https://bugzilla.novell.com/876102 > https://bugzilla.novell.com/878274 > https://bugzilla.novell.com/880892 > > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTs3wRAAoJEAIlXR9XEAejjGUH/A72RMaOle/KkZ+JSGDeCesC MwpLDLz5LSxdj4nKp/Y2j2eZgzxwMyxhtEyjiSLzP6jmZe6LBqslqsq5dS1j7ynY uUvGeInRX7+zJ1beAtFZQfTwhacHist2kxE3b0BaYcsaJFJoeXkwckDnM+4Of7yy srfcy5Q8kppiS2F00yiDC62PxOGl32UoNx5civoAzwiAlH65OB1dJphc8dLxOxzd 7rrJWfDiw3CFs74Y7EbieY2H7rJBWc6khjCXUn6KCbfiMpaRaMV+kwVIxgao/dk3 eM851+otzxUdL8WzTTBqwMrFFz4WHEdhiPnTGS+SMksfnbRCWSlr4LIdK6Bm10Y= =LwlR -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

4 3