Category:
- C/C++
Category:
Category:
+------------------------------------------------------------------------+ | EnGarde Secure Linux Security Advisory July 02, 2002 | | http://www.engardelinux.org/ ESA-20020702-016 | | | | Package: openssh | | Summary: several vulnerabilities in the OpenSSH daemon. | +------------------------------------------------------------------------+ EnGarde Secure Linux is a secure distribution of Linux that features improved access control, host and network intrusion detection, Web based secure remote management, complete e-commerce using AllCommerce, and integrated open source security tools. OVERVIEW - -------- ISS and the OpenBSD team found several vulnerabilities in the OpenSSH secure shell daemon as outlined by the OpenSSH advisory [1] and the ISS advisory [2]. Guardian Digital issued ESA-20020625-015 on June 25, 2002, upgrading all users to version 3.3p1 which introduced privilege separation (and mitigates some of the risk introduced by these vulnerabilities). This update brings the current version up to 3.4p1 and properly fixes the known bugs, along with a potential class of new bugs (as mentioned in the OpenSSH advisory). [1] http://www.openssh.org/txt/preauth.adv [2] http://www.openssh.org/txt/iss.adv SOLUTION - -------- Users of the EnGarde Professional edition can use the Guardian Digital Secure Network to update their systems automatically. EnGarde Community users should upgrade to the most recent version as outlined in this advisory. Updates may be obtained from: ftp://ftp.engardelinux.org/pub/engarde/stable/updates/http://ftp.engardelinux.org/pub/engarde/stable/updates/ Before upgrading the package, the machine must either: a) be booted into a "standard" kernel; or b) have LIDS disabled. To disable LIDS, execute the command: # /sbin/lidsadm -S -- -LIDS_GLOBAL To install the updated package, execute the command: # rpm -Uvh files You must now update the LIDS configuration by executing the command: # /usr/sbin/config_lids.pl To re-enable LIDS (if it was disabled), execute the command: # /sbin/lidsadm -S -- +LIDS_GLOBAL To verify the signatures of the updated packages, execute the command: # rpm -Kv files UPDATED PACKAGES - ---------------- These updated packages are for EnGarde Secure Linux Community Edition. Source Packages: SRPMS/openssh-3.4p1-1.0.22.src.rpm MD5 Sum: 1fbec8b1e3269abf0d27d34e4902b045 Binary Packages: i386/openssh-3.4p1-1.0.22.i386.rpm MD5 Sum: 8eb4a1d6c34f6754e5857eecd82fd5cb i386/openssh-clients-3.4p1-1.0.22.i386.rpm MD5 Sum: 9110b0b12a6345959da021b75f3eb1d9 i386/openssh-server-3.4p1-1.0.22.i386.rpm MD5 Sum: 7790b373ca78f2870b2d55f1bda6735e i686/openssh-3.4p1-1.0.22.i686.rpm MD5 Sum: 28e2d5ef72e1a5440538a95cd94f3b34 i686/openssh-clients-3.4p1-1.0.22.i686.rpm MD5 Sum: 553fb5b433f73db0811e1b0082fd5e29 i686/openssh-server-3.4p1-1.0.22.i686.rpm MD5 Sum: aad48cf9fab8427a1a811f46f78259dc REFERENCES - ---------- Guardian Digital's public key: http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY OpenSSH's Official Web Site: http://www.openssh.org/ Security Contact: security@guardiandigital.com EnGarde Advisories: http://www.engardelinux.org/advisories.html - -------------------------------------------------------------------------- $Id: ESA-20020702-016-openssh,v 1.1 2002/07/02 08:58:43 rwm Exp $ - -------------------------------------------------------------------------- Author: Ryan W. Maple <ryan@guardiandigital.com> Copyright 2002, Guardian Digital, Inc. +------------------------------------------------------------------------+ | EnGarde Secure Linux Security Advisory July 02, 2002 | | http://www.engardelinux.org/ ESA-20020702-017 | | | | Package: mod_ssl | | Summary: off-by-one in mod_ssl's configuration directive handling | +------------------------------------------------------------------------+ EnGarde Secure Linux is a secure distribution of Linux that features improved access control, host and network intrusion detection, Web based secure remote management, complete e-commerce using AllCommerce, and integrated open source security tools. OVERVIEW - -------- Frank Denis (j@pureftpd.org) discovered an off-by-one error in mod_ssl's handling of older configuration directives (the rewrite_command hook). As such a malicious user, using a specially-crafted .htaccess file, may be able to DoS the child (Apache) processes or execute arbitrary commands as the webd user. This update upgrades mod_ssl to 2.8.10, fixing this problem and other bugs. SOLUTION - -------- Users of the EnGarde Professional edition can use the Guardian Digital Secure Network to update their systems automatically. EnGarde Community users should upgrade to the most recent version as outlined in this advisory. Updates may be obtained from: ftp://ftp.engardelinux.org/pub/engarde/stable/updates/http://ftp.engardelinux.org/pub/engarde/stable/updates/ Before upgrading the package, the machine must either: a) be booted into a "standard" kernel; or b) have LIDS disabled. To disable LIDS, execute the command: # /sbin/lidsadm -S -- -LIDS_GLOBAL To install the updated package, execute the command: # rpm -Uvh files You must now update the LIDS configuration by executing the command: # /usr/sbin/config_lids.pl To re-enable LIDS (if it was disabled), execute the command: # /sbin/lidsadm -S -- +LIDS_GLOBAL To verify the signatures of the updated packages, execute the command: # rpm -Kv files UPDATED PACKAGES - ---------------- These updated packages are for EnGarde Secure Linux Community Edition. Source Packages: SRPMS/apache-1.3.26-1.0.31.src.rpm MD5 Sum: 2deec12206289498b8199e6ad89b19ec Binary Packages: i386/apache-1.3.26-1.0.31.i386.rpm MD5 Sum: f0f56d536c6133c25291cc11dec602a9 i686/apache-1.3.26-1.0.31.i686.rpm MD5 Sum: 32fb239c93491476a8f172f1526c9159 REFERENCES - ---------- Guardian Digital's public key: http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY mod_ssl's Official Web Site: http://www.modssl.org/ Security Contact: security@guardiandigital.com EnGarde Advisories: http://www.engardelinux.org/advisories.html - -------------------------------------------------------------------------- $Id: ESA-20020702-017-apache,v 1.2 2002/07/02 14:01:17 rwm Exp $ - -------------------------------------------------------------------------- Author: Ryan W. Maple <ryan@guardiandigital.com> Copyright 2002, Guardian Digital, Inc. ------------------------------------------------------------------------ To unsubscribe email engarde-security-request@engardelinux.org with "unsubscribe" in the subject of the message. Copyright(c) 2001 Guardian Digital, Inc. EnGardeLinux.org ------------------------------------------------------------------------
Category:
- ------------------------------------------------------------------------ Debian Security Advisory DSA-135-1 security@debian.orghttp://www.debian.org/security/ Robert van der Meulen July 2, 2002 - ------------------------------------------------------------------------ Package : libapache-mod-ssl Problem type : buffer overflow / DoS Debian-specific: no The libapache-mod-ssl package provides SSL capability to the apache webserver. Recently, a problem has been found in the handling of .htaccess files, allowing arbitrary code execution as the web server user (regardless of ExecCGI / suexec settings), DoS attacks (killing off apache children), and allowing someone to take control of apache child processes - all trough specially crafted .htaccess files. More information about this vulnerability can be found at http://online.securityfocus.com/bid/5084 This has been fixed in the libapache-mod-ssl_2.4.10-1.3.9-1potato2 package (for potato), and the libapache-mod-ssl_2.8.9-2 package (for woody) . We recommend you upgrade as soon as possible. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.2 alias potato - --------------------------------- Potato was released for alpha, arm, i386, m68k, powerpc and sparc. Packages for m68k are not available at this moment. Source archives: http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2.dsc MD5 checksum: 5b2cb207ba8214f52ffbc28836dd8dc4 http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2.diff.gz MD5 checksum: 29eef2b3307f00d92eb425ac669dabec http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9.orig.tar.gz MD5 checksum: cb0f2e07065438396f0d5df403dd2c16 Architecture independent packages: http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl-doc_2.4.10-1.3.9-1potato2_all.deb MD5 checksum: ebd8154f614e646b3a12980c8db606b6 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2_alpha.deb MD5 checksum: a3d73598e692b9c0bb945a52a00a363c arm architecture (ARM) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2_arm.deb MD5 checksum: 11e1085504430cacadd0255a0743b80a i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2_i386.deb MD5 checksum: a1fd7d6a7ef3506ee0f94e56735d3d08 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2_powerpc.deb MD5 checksum: 0f01742c2a77f2728baea4e1e9ad7ff0 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.4.10-1.3.9-1potato2_sparc.deb MD5 checksum: 4982a209adc93acbf50a650a3569d217 These packages will be moved into the stable distribution on its next revision. Debian GNU/Linux 3.0 alias woody - -------------------------------- Woody will be released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc. Packages for ia64 and hppa are not available for the moment. Source archives: http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.dsc MD5 checksum: 7cce5c97bd3cf35c8782d54a25138165 http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.diff.gz MD5 checksum: fc9f20e6d3bece6f0d3bad067c61d56a Architecture independent packages: http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl-doc_2.8.9-2_all.deb MD5 checksum: 541257e99c523141625f5fc43fb3dec4 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_alpha.deb MD5 checksum: 712e406d8be713047f3e46bbf58269a5 arm architecture (ARM) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_arm.deb MD5 checksum: 8ce3d4d45f45423a6c6b7d795c319d33 i386 architecture (intel ia32) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_i386.deb MD5 checksum: 06733dc49c228230e5713f34eae7f8b0 m68k architecture http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_m68k.deb MD5 checksum: e5a8518aac6d08bb5e9cc50195d336e3 mips architecture http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_mips.deb MD5 checksum: dde883d6ee72f3b29fc324d9cb497670 mipsel architecture http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_mipsel.deb MD5 checksum: a80756857248358c7973a5b0fb9372e2 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_powerpc.deb MD5 checksum: 715876a54ddddf1e17e4c2ec9d2f5eea s390 architecture (S390) http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2_s390.deb MD5 checksum: 1a31f564ceba0ca82d9892d023caffd0 - -- - ---------------------------------------------------------------------------- apt-get: deb http://security.debian.org/ stable/updates main dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org
Category:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : apache
SUMMARY : off-by-one mod_ssl buffer overflow
DATE : 2002-07-02 11:21:00
ID : CLA-2002:504
RELEVANT
RELEASES : 6.0, 7.0, 8
- -------------------------------------------------------------------------
DESCRIPTION
Apache[1] is the most popular webserver in use today. "mod_ssl"[2] is
an Apache module which enables the use of encrypted connections
("https://") to the web server and provides a set of crypto and
authentication related functions.
This module is not part of the apache distribution, but is bundled
and enabled by default in the Conectiva Linux Apache packages.
An off-by-one buffer overflow vulnerability exists in the code which
handles entries in .htaccess files in mod_ssl <= 2.8.9. It was
discovered[3] by Frank DENIS (Jedi/Sector One) <j@pureftpd.org>.
The htaccess mechanism is disabled by default in Conectiva Linux and
can be controled by the "AllowOverride" variable in the apache
configuration file. It is useful to allow non privileged users to
customize the configuration of their sites.
An attacker who can manipulate the contents of the .htaccess file can
potentially cause a DoS or even execute arbitrary commands in the
httpd service context, which is run by an unprivileged user
(typically "www" or "nobody").
SOLUTION
It is recommended that all apache users upgrade their packages.
IMPORTANT: the apache server has to be restarted after upgrading the
packages. To do this, please execute, as root:
# service httpd stop
(wait a few seconds and check with "ps ax|grep httpd" if there are
any httpd processes running. On a busy webserver this could take a
little longer.)
and:
# service httpd start
REFERENCES:
1. http://httpd.apache.org
2. http://www.modssl.org
3. http://online.securityfocus.com/archive/1/279074
DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.26-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.26-1U70_5cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-devel-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-doc-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/apache-1.3.26-1U8_2cl.src.rpm
ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades of RPM packages:
- add the following line to /etc/apt/sources.list if it is not there yet
(you may also use linuxconf to do this):
rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates
(replace 6.0 with the correct version number if you are not running CL6.0)
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE9Ibct42jd0JmAcZARAm0xAJwMVSMYNfk6mn0zgp1gxGg1RH1dNQCfdJid
i4D9iIggPrqiUJwDG7X4O4o=
=msXR
-----END PGP SIGNATURE-----
Category:
Even before the GBLUG’s first meeting, the group was generating attention and some controversy. In differentiating GBLUG from others — including a half dozen between Baltimore, Maryland, and northern Virginia — Harrison has suggested many LUGs are too techno-geeky focused for most new users.
“You’re the person we’re trying to reach out to,” Harrison told the retiree. “Often LUGs are too technical for new users, and somebody has to sell Linux to the world, since there’s no marketing arm of Linux like there is a marketing arm of Microsoft.”
Harrison even encountered a bit of debate at the meeting when he suggested that Linux is an operating system for people who like computers, while people who think of their computers the same way they think of their blenders should probably stick to Windows. One audience member suggested that would limit the rate of Linux adoption.
But Harrison said Linux will turn people who think of computers as just another appliance into computer zealots. “Linux changes everything,” he said. “Linux changes people’s attitudes about the hardware. We will make computer lovers where there were computer users.”
Ten people showed up to the GBLUG kick off, most looking like typical geeks — all male in T-shirts, jeans and one or two long, gray beards. Harrison, a former local Jaycees president, looked more business casual in Tux polo and khakis, even though he’s a PC technician by day. His spiel did have the flavor of a chamber of commerce veteran pitching his city to a prospective membership.
Harrison told those attending the first meeting that he’s received more than a dozen emails from across the country expressing interest in this new approach to a LUG. “They want to see if this little experiment works,” he said. “If it works, we can start a fire across the country.”
Several of the people attending the first meeting said the idea of evangelizing Linux appealed more to them than the themes for other LUGs they’d attended. One said another area LUG seemed more about bickering than learning about Linux. “It was more an excuse for some type of match people wanted,” he said. “This sounded a lot more interesting.”
Others said they were interested in teaching new users and working with organizations like schools.
Harrison said later he was quite happy with the turnout for the first meeting. He figured there were about 60 avid Linux users in the immediate Glen Burnie area. “I thought to myself, ‘if I get one, I won’t be embarrassed — I won’t be talking to myself in an empty room. If I get five, I’ll be real happy, and if I get 10, I’ll be ecstatic.’ I realized it was going to be slow and lonely at first, but it turns out it isn’t going to be as lonely as I thought.”
Harrison’s first order of business is to schedule booths at a handful of festivals and community activities this summer or fall. He brought a handful of Linux-related software on disks to the first meeting, including a couple of games and the current versions of Mandrake and Red Hat.
While Harrison’s immediate goal for the group is to convert regular computer users to Linux and support them so they won’t get confused and backslide, he’s also interested in preaching Linux to people in power. “We’re uniquely postured geographically,” he told the audience. “I think part of Linux advocacy in the future will be to take our case to the people in D.C.”
GBLUG’s next meeting is July 31 at 7:30 p.m. at the North County Public Library, 1010 Eastway in Glen Burnie.
Category:
Sweet. But now what should you do? After the initial fun, you may be wondering what you can actually do with a machine you don’t know how to use, and for which you think no third-party software exists. This article teaches you how to install software on the Zaurus and presents some killer applications you should know about.”
Category:
There are attendees from several large scientific software companies and speakers from Mozilla and the W3C.
Mathforge.net blogged the event live.”