CERT released their advisory CA-2001-18 which lists a number of
vulnerabilities in various LDAP implementations. based on the
results of the PROTOS LDAPv3 test suite. These tests found one
problem in OpenLDAP, a free LDAP implementation that is shipped
as part of Debian GNU/Linux 2.2

-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory DSA-068-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
August  9, 2001
- ------------------------------------------------------------------------


Package        : openldap
Problem type   : remote DoS
Debian-specific: no

CERT released their advisory CA-2001-18 which lists a number of
vulnerabilities in various LDAP implementations. based on the 
results of the PROTOS LDAPv3 test suite. These tests found one
problem in OpenLDAP, a free LDAP implementation that is shipped
as part of Debian GNU/Linux 2.2.

The problem is that slapd did not handle packets with an invalid
BER length of length fields and would crash if it received those.
An attacked can use this to mount a denial of service attack
remotely.

This problem has been fixed in version 1.2.11-1, and we recommend
that you upgrade your slapd package immediately.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

  Source archives:
    http://security.debian.org/dists/stable/updates/main/source/openldap_1.2.12-1.dsc
      MD5 checksum: b504c90a83025dc6a916187ddabf792a
    http://security.debian.org/dists/stable/updates/main/source/openldap_1.2.12-1.tar.gz
      MD5 checksum: 651c7995d73e4450568f8c43b556b38d

  Architecture independent archives:
    http://security.debian.org/dists/stable/updates/main/binary-all/ldap-rfc_1.2.12-1_all.deb
      MD5 checksum: be2f6eb1965dc7b34149bc6518f74e58
    http://security.debian.org/dists/stable/updates/main/binary-all/libopenldap-runtime_1.2.12-1_all.deb
      MD5 checksum: 6f1031e6e83f2fbb70a01084add8a1db

  ARM architecture:
    http://security.debian.org/dists/stable/updates/main/binary-arm/libopenldap-dev_1.2.12-1_arm.deb
      MD5 checksum: dbcfe982fe36fb41ac27f3c3f06423b8
    http://security.debian.org/dists/stable/updates/main/binary-arm/libopenldap1_1.2.12-1_arm.deb
      MD5 checksum: d1fca5f66dbffd5240049f5b15960e6a
    http://security.debian.org/dists/stable/updates/main/binary-arm/openldap-gateways_1.2.12-1_arm.deb
      MD5 checksum: c20e3f096ec42a553b4d3b999aff4676
    http://security.debian.org/dists/stable/updates/main/binary-arm/openldap-utils_1.2.12-1_arm.deb
      MD5 checksum: aff72b6641b7b3fad9875104b0684bbe
    http://security.debian.org/dists/stable/updates/main/binary-arm/openldapd_1.2.12-1_arm.deb
      MD5 checksum: 6127f3c0fc228daedbb511f9310d3ce7

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/main/binary-alpha/libopenldap-dev_1.2.12-1_alpha.deb
      MD5 checksum: 6109c93d8c9c6dd35d6d0ec97126277ahttp://security.debian.org/dists/stable/updates/main/binary-alpha/libopenldap1_1.2.12-1_alpha.deb
      MD5 checksum: f9de7d3a6fae1e7480ac38693cc54620
    http://security.debian.org/dists/stable/updates/main/binary-alpha/openldap-gateways_1.2.12-1_alpha.deb
      MD5 checksum: 01f7970379df0e81324f3c0f23d42693
    http://security.debian.org/dists/stable/updates/main/binary-alpha/openldap-utils_1.2.12-1_alpha.deb
      MD5 checksum: d3469131b4b1064abcd0fb1901ff724f
    http://security.debian.org/dists/stable/updates/main/binary-alpha/openldapd_1.2.12-1_alpha.deb
      MD5 checksum: 22bfe11e0129548734ed7d93dc5e981e

  Intel IA-32 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-i386/libopenldap-dev_1.2.12-1_i386.deb
      MD5 checksum: f38364b6f9b3a5089d58a792d0daca0a
    http://security.debian.org/dists/stable/updates/main/binary-i386/libopenldap1_1.2.12-1_i386.deb
      MD5 checksum: 00d96465ef85947015775996b44680b5
    http://security.debian.org/dists/stable/updates/main/binary-i386/openldap-gateways_1.2.12-1_i386.deb
      MD5 checksum: 3fa22bee43b35864d82fdb8e5118aeb5
    http://security.debian.org/dists/stable/updates/main/binary-i386/openldap-utils_1.2.12-1_i386.deb
      MD5 checksum: 0af27bf23ef1310c4f74f574ce11b1af
    http://security.debian.org/dists/stable/updates/main/binary-i386/openldapd_1.2.12-1_i386.deb
      MD5 checksum: fdf3b4c4fd3180470741128d06374c1e

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-m68k/libopenldap-dev_1.2.12-1_m68k.deb
      MD5 checksum: 8aed132786db3d12f611f0a3afc5a6c2
    http://security.debian.org/dists/stable/updates/main/binary-m68k/libopenldap1_1.2.12-1_m68k.deb
      MD5 checksum: b58d824141a544a3e1df5fe02ae96274
    http://security.debian.org/dists/stable/updates/main/binary-m68k/openldap-gateways_1.2.12-1_m68k.deb
      MD5 checksum: de25fa556977ad1fb5d474c6b5029427
    http://security.debian.org/dists/stable/updates/main/binary-m68k/openldap-utils_1.2.12-1_m68k.deb
      MD5 checksum: bba46b697ab1e70803f1527284344b3f
    http://security.debian.org/dists/stable/updates/main/binary-m68k/openldapd_1.2.12-1_m68k.deb
      MD5 checksum: 8bc7e0c915a28ebaab589ed5fa4dd601

  PowerPC architecture:
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/libopenldap-dev_1.2.12-1_powerpc.deb
      MD5 checksum: 30cf58da153851a7393df83f5765e8eb
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/libopenldap1_1.2.12-1_powerpc.deb
      MD5 checksum: 9c8a2df3a2e5dbead38ce04fa82a307f
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/openldap-gateways_1.2.12-1_powerpc.deb
      MD5 checksum: 64859231a0e753b774ab6142977a8940
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/openldap-utils_1.2.12-1_powerpc.deb
      MD5 checksum: ed8d8f3309111ce8181db4bd4ce83960
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/openldapd_1.2.12-1_powerpc.deb
      MD5 checksum: 5a1bbd5a875db731ecc0d3abc8707ad9

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/main/binary-sparc/libopenldap-dev_1.2.12-1_sparc.deb
      MD5 checksum: c9f0dbbe70c2b9922fa327ed77a60933
    http://security.debian.org/dists/stable/updates/main/binary-sparc/libopenldap1_1.2.12-1_sparc.deb
      MD5 checksum: c54dd0d7370ba9aec444e91ddab76d51
    http://security.debian.org/dists/stable/updates/main/binary-sparc/openldap-gateways_1.2.12-1_sparc.deb
      MD5 checksum: bf37a70edf4962d98ad4ca72d9c45a5d
    http://security.debian.org/dists/stable/updates/main/binary-sparc/openldap-utils_1.2.12-1_sparc.deb
      MD5 checksum: aed5adf8a7b4ce89c4b693591190f1d1
    http://security.debian.org/dists/stable/updates/main/binary-sparc/openldapd_1.2.12-1_sparc.deb
      MD5 checksum: 5373ae34853af6ae6d746574d3c1a9ec


  These packages will be moved into the stable distribution on its next
  revision.

For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

- -- 
- ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBO3LSk6jZR/ntlUftAQGuqgL/R0JT646vRcAF/OOZ4vsV5DwfacNHvHZl
gJyN5ZNLeJi0RGMvN9//ACgQaspsK+MnSLi6XBqNkDooDZwS27ppWShtTQDgmnHD
wWe+GyQ37/dcdGvc2Ob1TFuuCuXnRDdO
=hKEv
-----END PGP SIGNATURE-----

Interactive Week: “System vulnerabilities – holes through which intruders may crawl inside
your servers – are cropping up at a rate of six or seven per day, a pace
that strains the resources of most system administrators, security
experts say.”

“Richard DeGrandpre wrote “Digitopia” as a warning about the false
promises of the wired world. Then it was published as an electronic
book, and all his predictions came true.

“Digitopia,” issued by Random House in March, was never reviewed or promoted or, it seems,
downloaded. “My book is just dead,” said DeGrandpre, a psychologist.

So are just about everyone else’s e-books. The publishing world’s attempts to turn electronic fiction
and non-fiction into a lucrative revenue stream have yielded only a trickle of customers.” Read more at the Chicago Tribune

Frank Cohen writes “Load tests Web applications and SOAP-based Web Services for performance and scalability. Load 2.0 Beta 1 is now available for free download at www.pushtotest.com. Load features an XML-based scripting language and test objects. Load script enables you to write intelligent test suites. The test objects handle common test functions, such as logging-in, reading through Web pages and calling Web Services. Load runs any number of test suites concurrently to check for performance and scalability. Load is distributed under an Apache-style license. For Load and a support community try www.pushtotest.com.

– By Grant Gross –

After a long period of silence, it’s time again to check on LinuxOne, that Linux company that many in Open Source community like to accuse of trying to cash in on the Linux IPO craze of 1999. The company seems to have disappeared even farther into the woodwork than previously noted.

LinuxOne (not to be confused with a Korean company that at last report was calling itself NuxOne to avoid confusion) launched in March 1999, filed for an IPO, then promptly disappeared. At last report, LinuxOne was merging with a Baltimore, Md., white box manufacturer, Micromatix.net, but that deal is apparently long dead. A search at Google and Hotbot turns up no merger news since the an October 2000 press release announcing the intended merger.

So it’s a slow August news day, and I figure I’ll poke around a little more to see if anything’s turned up since our last report. Since the first NewsForge story, I’ve exchanged email with Rick Collette, LinuxOne’s v.p. of software engineering for short time, and asked him if he’s heard anything new.

Collette, founder of the DeepLinux project and now an engineer with the Redmond Linux, has a lot of second-hand information about LinuxOne, but also observed a lot in his four months with the company in early 2000.

Collette says LinuxOne lured him to Silicon Valley with promises it intended to market a product. “Two weeks after I arrived, the CTO quits,” he says. “I’m
moved up from senior software engineer to v.p. of software engineering (I
have no idea WHY… I was happy as a code monkey).

“They turned down every product I came up with, from a games installer for Linux … to embedded OSes, to console designs. I thought my ideas and designs must have been really bad, turns out, they aren’t trying to sell ANYTHING. The sales staff was getting all frustrated, the marketing people loved what I kept bringing them, but
when the CEO presented them to the founder, he would say no. The rest
of the engineering staff had been working on getting Linux working on a
Fujitsu Siemens settop box. Nine months they worked with no results.”

Others in the company, which had about 30 employees when Collette first started, were working on a top-secret remote USB project that he says most geek kids could create with information on the Internet. LinuxOne had another company create a plastic box, and LinuxOne was pitching its remote USB product to customers using the empty case, Collette says.

The company, he says, was spending $30,000 a month. “We didn’t have $30,000 worth of anything,” he says. “We borrowed most of the equipment to do development on.”

Collette says when he questioned why the company wasn’t trying to create a product, he was fired.

Collette doesn’t include his LinuxOne experience on his resume, but he’s still sad that LinuxOne actually had a working product, LinuxOne Lite, a small version of Linux designed to run beside Windows without partitioning. “That was a really good product,” he says. “It worked on systems nobody else could get [similar products] to work on. It could’ve given us a springboard.”

No one from LinuxOne was available to comment on Collette’s version of events or the proposed merger with Micromatix.net. Emails to LinuxOne’s info addresses weren’t returned, and no one answers the phone at LinuxOne’s California phone number.

Micromatix.net CEO Timothy Jewell doesn’t return a phone message, and Michael J. Morrison, a Nevada lawyer that was representing LinuxOne in the merger, hasn’t returned an email or a phone message.

Collette says he sees LinuxOne founder Wun Chiou’s wife around Mountain View, Calif., checking on the several properties the couple manages there. But Collette says he hasn’t seen Chiou himself for several months.

“The Embedded Linux Journal has announced that the first
round of their ‘NIC contest’ is over, and NIC systems are
being sent to the twenty lucky finalists. This second annual
design contest is based on projects using the New Internet
Computer (NIC) as a platform. Projects range from the
serious, to the silly, to the sublime.” The news is from LinuxDevices.com.

From TheStandard.com: “Judges from the Ninth Circuit Court of
Appeals in San Francisco are protesting
the use of software within the federal
court system that monitors Internet use
on employee computers — including
those of its judges.”

Wired.com reports that Russian programmer Dmitry Sklyarov, accused of violating the U.S. DMCA by bypassing security in Adobe Systems’ eBooks, wouldn’t be charged back in Russia because what he did isn’t illegal there.

From Ananova.com: “Two teenagers discovered the world’s first internet bench could be used
to make free international calls and gave Microsoft boss Bill Gates a call.”

Anonymous Reader writes, “This year’s LinuxWorld Conference & Expo includes keynotes by Shane Robison, CTO and senior vice president of Compaq; Larry Lessig, Professor of Law at Stanford University and author of Code and Other Laws of Cyberspace; and Matthew Szulik, president and CEO of Red Hat, Inc. Ed Leonard, Head of Technology, DreamWorks Animation, will give a Feature Presentation titled, ;Linux for the Production Pipeline.’ The event will address how DreamWorks is implementing Linux in its feature film production.

To avoid standing in line, don’t forget to pre-register for the event on the LinuxWorld Conference & Expo Web site. Media registration is available at http://www.linuxworldexpo.com/media.shtml.”