sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [Bug 3041] New: z-rejected: setiathome borked with buffer overflow

From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [Bug 3041] New: z-rejected: setiathome borked with buffer overflow
Date: Mon, 7 Apr 2003 02:15:34 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=3041

Summary: z-rejected: setiathome borked with buffer overflow
Product: Security
Version: unspecified
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Security Issue
AssignedTo: sm-security AT lists.ibiblio.org
ReportedBy: seth AT tautology.org
CC: eric AT sandall.us,josebernardo1 AT yahoo.com

http://slashdot.org/comments.pl?sid=59820&cid=5673436
http://setiathome.berkeley.edu/version308.html

I was going to update it, but I don't use this and wouldn't know how to test
it
as the version we have is 3.03 and this is 3.08 (don't know if there are any
special differences).

The first url above has links to slowlaris and linhooks versions. The spell
also seemed to want i386 version, and the link above is i686, are we just
defaulting to 386 (awefully slow...)?

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 7 03:01:22 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id D5FF4200A5
for <sm-security AT lists.ibiblio.org>;
Mon, 7 Apr 2003 03:01:21 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3771LA14400;
Mon, 7 Apr 2003 03:01:21 -0400
Date: Mon, 7 Apr 2003 03:01:21 -0400
Message-Id: <200304070701.h3771LA14400 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security]
[Bug 3041] z-rejected: setiathome borked with buffer overflow
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Apr 2003 07:01:22 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3041

eric AT sandall.us changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 7 03:55:07 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 8586720030
for <sm-security AT lists.ibiblio.org>;
Mon, 7 Apr 2003 03:55:07 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h377t7S22068;
Mon, 7 Apr 2003 03:55:07 -0400
Date: Mon, 7 Apr 2003 03:55:07 -0400
Message-Id: <200304070755.h377t7S22068 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security]
[Bug 3041] z-rejected: setiathome borked with buffer overflow
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Apr 2003 07:55:08 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3041

------- Additional Comments From josebernardo1 AT yahoo.com 2003-04-07 03:55
-------
Well, yesterday after the /. announcement, the linux version was still 3.03,
and
the bug doesn't seem to be critical, but if you can find the new version for
linux, go ahead and update it.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 7 04:20:16 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 9519320030
for <sm-security AT lists.ibiblio.org>;
Mon, 7 Apr 2003 04:20:16 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h378KGS26006;
Mon, 7 Apr 2003 04:20:16 -0400
Date: Mon, 7 Apr 2003 04:20:16 -0400
Message-Id: <200304070820.h378KGS26006 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security]
[Bug 3041] z-rejected: setiathome borked with buffer overflow
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Apr 2003 08:20:16 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3041

------- Additional Comments From josebernardo1 AT yahoo.com 2003-04-07 04:20
-------
Anyway, it's simple to test the new version, you just need to run the
installed
executable, I'll download it today if it is already available and I'll test
it.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 7 18:54:23 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 947FC200CC
for <sm-security AT lists.ibiblio.org>;
Mon, 7 Apr 2003 18:54:23 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h37MsN503747;
Mon, 7 Apr 2003 18:54:23 -0400
Date: Mon, 7 Apr 2003 18:54:23 -0400
Message-Id: <200304072254.h37MsN503747 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: CC
Subject: [SM-Security] [Bug 3045] There is a samba version update . . .
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Apr 2003 22:54:23 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3045

seth AT tautology.org changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |sm-
| |security AT lists.ibiblio.org

------- Additional Comments From seth AT tautology.org 2003-04-07 18:54 -------
This is a security update. Rycee is testing. I'll make the commits when he
is
done testing.

Should post a note to news.sourcemage.org

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
>From nobody AT divahouse.metalab.unc.edu Tue Apr 8 07:18:06 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 4026720073
for <sm-security AT lists.ibiblio.org>;
Tue, 8 Apr 2003 07:18:06 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h38BI6i30686;
Tue, 8 Apr 2003 07:18:06 -0400
Date: Tue, 8 Apr 2003 07:18:06 -0400
Message-Id: <200304081118.h38BI6i30686 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: CC
Subject: [SM-Security] [Bug 3045] There is a samba version update . . .
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Apr 2003 11:18:06 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3045

seth AT tautology.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED

------- Additional Comments From seth AT tautology.org 2003-04-08 07:18 -------
all fixed.

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
>From nobody AT divahouse.metalab.unc.edu Tue Apr 8 16:42:07 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id BDDA82007F
for <sm-security AT lists.ibiblio.org>;
Tue, 8 Apr 2003 16:42:06 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h38Kg6o10623;
Tue, 8 Apr 2003 16:42:06 -0400
Date: Tue, 8 Apr 2003 16:42:06 -0400
Message-Id: <200304082042.h38Kg6o10623 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security]
[Bug 3041] z-rejected: setiathome borked with buffer overflow
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Apr 2003 20:42:07 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3041

------- Additional Comments From seth AT tautology.org 2003-04-08 16:42 -------
I searched around...

686) ARK=i686-pc-linux-gnu ;
PREPARE_MD5=01d05178bd22c36b2e411dd12f23661a ;;

that's the only one available (for PREPEARE script)

Obviously this isn't serious otherwise they would release versions that would
work on our system. Since this isn't statically-built I don't even know if it
will work, and we leave out all the 386 people, sparc, and ppc. I'd say not
to
update until they actually release more versions, else we'll break half the
installs, at very minimum a 386 version. Perhaps a SECURITY file would be a
good addition instead notifying people if they try to cast it? that
something's
up and the setiathome people are slow to rebuild stuff?

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Wed Apr 9 05:03:48 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 49AD32007A
for <sm-security AT lists.ibiblio.org>;
Wed, 9 Apr 2003 05:03:48 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3993m911549;
Wed, 9 Apr 2003 05:03:48 -0400
Date: Wed, 9 Apr 2003 05:03:48 -0400
Message-Id: <200304090903.h3993m911549 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security]
[Bug 3041] z-rejected: setiathome borked with buffer overflow
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Apr 2003 09:03:48 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3041

------- Additional Comments From josebernardo1 AT yahoo.com 2003-04-09 05:03
-------
Do we have support for a SECURITY file? Time to re-check the wiki... :)

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Sun Apr 13 04:36:17 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 524C82001E
for <sm-security AT lists.ibiblio.org>;
Sun, 13 Apr 2003 04:36:16 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3D8aGX22464;
Sun, 13 Apr 2003 04:36:16 -0400
Date: Sun, 13 Apr 2003 04:36:16 -0400
Message-Id: <200304130836.h3D8aGX22464 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] New: apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Apr 2003 08:36:17 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

Summary: apache2 upgrade, 2.0.44 -> 2.0.45
Product: Security
Version: unspecified
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Security Issue
AssignedTo: sm-security AT lists.ibiblio.org
ReportedBy: robin-bugs.sourcemage AT kallisti.2y.net

Security update for apache 2.x to fix among other things a DoS vuln. See:
http://www.apache.org/dist/httpd/Announcement2.html

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Sun Apr 13 12:56:15 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 12FA420005
for <sm-security AT lists.ibiblio.org>;
Sun, 13 Apr 2003 12:56:15 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3DGuFY10055;
Sun, 13 Apr 2003 12:56:15 -0400
Date: Sun, 13 Apr 2003 12:56:15 -0400
Message-Id: <200304131656.h3DGuFY10055 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Apr 2003 16:56:15 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

------- Additional Comments From sergey AT sourcemage.org 2003-04-13 12:56
-------
It's 2.0.45 as of 2003-04-02...

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Sun Apr 13 18:54:05 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 3F5AF20005
for <sm-security AT lists.ibiblio.org>;
Sun, 13 Apr 2003 18:54:05 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3DMs4M32578;
Sun, 13 Apr 2003 18:54:04 -0400
Date: Sun, 13 Apr 2003 18:54:04 -0400
Message-Id: <200304132254.h3DMs4M32578 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Apr 2003 22:54:05 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

------- Additional Comments From robin-bugs.sourcemage AT kallisti.2y.net
2003-04-13 18:54 -------
strange. Maybe my last update didn't work quite right...trying again.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 14 04:50:33 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id BE18B2002B
for <sm-security AT lists.ibiblio.org>;
Mon, 14 Apr 2003 04:50:32 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3E8oWC20210;
Mon, 14 Apr 2003 04:50:32 -0400
Date: Mon, 14 Apr 2003 04:50:32 -0400
Message-Id: <200304140850.h3E8oWC20210 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Apr 2003 08:50:33 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

------- Additional Comments From robin-bugs.sourcemage AT kallisti.2y.net
2003-04-14 04:50 -------
updated again:
robin@kallisti:~$ gaze version apache2
Section Spell Grimoire Version Installed Version
------- ----- ---------------- -----------------
http apache2 2.0.44 2.0.44

Checked test.tar.bz2 and it reflects this.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 14 10:51:28 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id EB7492008A
for <sm-security AT lists.ibiblio.org>;
Mon, 14 Apr 2003 10:51:24 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3EEpNQ29670;
Mon, 14 Apr 2003 10:51:23 -0400
Date: Mon, 14 Apr 2003 10:51:23 -0400
Message-Id: <200304141451.h3EEpNQ29670 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Apr 2003 14:51:28 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

------- Additional Comments From sergey AT sourcemage.org 2003-04-14 10:51
-------
I was talking about development grimoire. Sorry.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Mon Apr 14 19:02:15 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 2C39820019
for <sm-security AT lists.ibiblio.org>;
Mon, 14 Apr 2003 19:02:15 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3EN2Eu28129;
Mon, 14 Apr 2003 19:02:15 -0400
Date: Mon, 14 Apr 2003 19:02:15 -0400
Message-Id: <200304142302.h3EN2Eu28129 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Apr 2003 23:02:15 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

------- Additional Comments From robin-bugs.sourcemage AT kallisti.2y.net
2003-04-14 19:02 -------
Oops, I shoulda said. Anyway, maybe this is something that should be pushed to
test asap, given it's a sexurity fix.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Tue Apr 15 12:19:16 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 25A102009A
for <sm-security AT lists.ibiblio.org>;
Tue, 15 Apr 2003 12:19:16 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3FGJGI14410;
Tue, 15 Apr 2003 12:19:16 -0400
Date: Tue, 15 Apr 2003 12:19:16 -0400
Message-Id: <200304151619.h3FGJGI14410 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3105] apache2 upgrade, 2.0.44 -> 2.0.45
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Apr 2003 16:19:16 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3105

seth AT tautology.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED

------- Additional Comments From seth AT tautology.org 2003-04-15 12:19 -------
now in test and stable.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Thu Apr 17 13:42:32 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id B47F420049
for <sm-security AT lists.ibiblio.org>;
Thu, 17 Apr 2003 13:42:32 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3HHgWh03395;
Thu, 17 Apr 2003 13:42:32 -0400
Date: Thu, 17 Apr 2003 13:42:32 -0400
Message-Id: <200304171742.h3HHgWh03395 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3154] New: snort vulns upgrade to 2.0
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2003 17:42:33 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3154

Summary: snort vulns upgrade to 2.0
Product: Security
Version: unspecified
Platform: Other
URL: http://www.snort.org/advisories/snort-2003-04-16-1.txt
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Security Issue
AssignedTo: sm-security AT lists.ibiblio.org
ReportedBy: seth AT tautology.org
CC: rycee AT home.se

http://www.snort.org/advisories/snort-2003-04-16-1.txt

/me is upgrading it.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Thu Apr 17 13:43:58 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 93A832008E
for <sm-security AT lists.ibiblio.org>;
Thu, 17 Apr 2003 13:43:58 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3HHhwU03697;
Thu, 17 Apr 2003 13:43:58 -0400
Date: Thu, 17 Apr 2003 13:43:58 -0400
Message-Id: <200304171743.h3HHhwU03697 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3154] snort vulns upgrade to 2.0
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2003 17:43:58 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3154

------- Additional Comments From seth AT tautology.org 2003-04-17 13:43 -------
Disable affected preprocessor modules

Sites that are unable to immediately upgrade affected Snort sensors
may prevent exploitation of this vulnerability by commenting out the
affected preprocessor modules in the "snort.conf" configuration file.

To prevent exploitation of VU#139129, comment out the following line:

preprocessor stream4_reassemble

To prevent exploitation of VU#916785, comment out the following line:

preprocessor rpc_decode: 111 32771

After commenting out the affected modules, send a SIGHUP signal to the
affected Snort process to update the configuration. Note that
disabling these modules may have adverse affects on a sensor's ability
to correctly process RPC record fragments and TCP packet fragments. In
particular, disabling the "stream4" preprocessor module will prevent
the Snort sensor from detecting a variety of IDS evasion attacks.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Thu Apr 17 13:44:46 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 4A6B120099
for <sm-security AT lists.ibiblio.org>;
Thu, 17 Apr 2003 13:44:46 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3HHikQ03860;
Thu, 17 Apr 2003 13:44:46 -0400
Date: Thu, 17 Apr 2003 13:44:46 -0400
Message-Id: <200304171744.h3HHikQ03860 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3154] snort vulns upgrade to 2.0
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2003 17:44:46 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3154

------- Additional Comments From seth AT tautology.org 2003-04-17 13:44 -------
http://www.cert.org/advisories/CA-2003-13.html

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Thu Apr 17 14:02:16 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 0DAAA2006A
for <sm-security AT lists.ibiblio.org>;
Thu, 17 Apr 2003 14:02:16 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3HI2FZ07794;
Thu, 17 Apr 2003 14:02:15 -0400
Date: Thu, 17 Apr 2003 14:02:15 -0400
Message-Id: <200304171802.h3HI2FZ07794 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3154] snort vulns upgrade to 2.0
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2003 18:02:16 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3154

seth AT tautology.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED

------- Additional Comments From seth AT tautology.org 2003-04-17 14:02 -------
devel, test, stable updated. Now posting to news.sourcemage.org.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Thu Apr 17 15:20:57 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 246672002C
for <sm-security AT lists.ibiblio.org>;
Thu, 17 Apr 2003 15:20:56 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3HJKuv23404;
Thu, 17 Apr 2003 15:20:56 -0400
Date: Thu, 17 Apr 2003 15:20:56 -0400
Message-Id: <200304171920.h3HJKuv23404 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: AssignedTo
Subject: [SM-Security] [Bug 3154] snort vulns upgrade to 2.0
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2003 19:20:57 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3154

------- Additional Comments From rycee AT home.se 2003-04-17 15:20 -------
Nice work Seth.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
>From nobody AT divahouse.metalab.unc.edu Fri Apr 18 06:59:08 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 1480B20090
for <sm-security AT lists.ibiblio.org>;
Fri, 18 Apr 2003 06:59:08 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3IAx8q05782;
Fri, 18 Apr 2003 06:59:08 -0400
Date: Fri, 18 Apr 2003 06:59:08 -0400
Message-Id: <200304181059.h3IAx8q05782 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: CC
Subject: [SM-Security] [Bug 3161] New: unpack md5 fixes for
non-tar-rpm-zip-files/patchfiles
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Apr 2003 10:59:08 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3161

Summary: unpack md5 fixes for non-tar-rpm-zip-files/patchfiles
Product: Sorcery
Version: Devel
Platform: Other
URL: http://smgl.positivism.org/bin/misc/libgrimoire2.patch.b
z2
OS/Version: other
Status: NEW
Severity: blocker
Priority: P5
Component: subroutines
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: seth AT tautology.org
CC: sm-security AT lists.ibiblio.org

With these fixes one can now "clean" a patchfile in PRE_BUILD by simply faking
an unpack() on it. All non-tarball, zip, rpm files don't get expandedor
anything, they get dropped to /dev/null (but the fixes make it so that it at
least checks the md5 correctly, as currently it passes a good return value on
anything non-tar-zip-rpm -- bad behaviore imho). One could probably make it
"pipe" its uncompressed output with some creative fifos, but I'll settle for
this. It could also be made to save the output instead of to /dev/null, to a
location in the root of the build directory with the name of the
$SOURCE.unpacked or stripped of .bz2 or .gz at the end. The /dev/null
behavior
is fine with me, however.

as in:
==>
default_pre_build &&
unpack $SOURCE2 ${MD5[1]} &&
[bzcat|zcat|cat] $SOURCE_CACHE/$SOURCE2 | patch -p1
<== (I tested it with compressed and uncompressed patches.)

We have about 90 instances where I can add this to PRE_BUILDS and make the
grimoire 100% secure.

Another reason I chose unpack to run it through is so that my auditing
routines
don't need any modification (orthogonality).

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
>From nobody AT divahouse.metalab.unc.edu Sun Apr 20 10:11:02 2003
Return-Path: <nobody AT divahouse.metalab.unc.edu>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from divahouse.metalab.unc.edu (divahouse.metalab.unc.edu
[152.2.210.35])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id BC5CF2001B
for <sm-security AT lists.ibiblio.org>;
Sun, 20 Apr 2003 10:11:01 -0400 (EDT)
Received: (from nobody@localhost)
by divahouse.metalab.unc.edu (8.11.6/8.11.6) id h3KEB1f22563;
Sun, 20 Apr 2003 10:11:01 -0400
Date: Sun, 20 Apr 2003 10:11:01 -0400
Message-Id: <200304201411.h3KEB1f22563 AT divahouse.metalab.unc.edu>
From: bugzilla-daemon AT metalab.unc.edu
To: sm-security AT lists.ibiblio.org
X-Bugzilla-Reason: CC
Subject: [SM-Security]
[Bug 3161] unpack md5 fixes for non-tar-rpm-zip-files/patchfiles
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Apr 2003 14:11:02 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=3161

mlubrano AT sourcemage.org changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |mlubrano AT sourcemage.org

------- Additional Comments From mlubrano AT sourcemage.org 2003-04-20 10:11
-------
I use this:
uncompress $SOURCE_CACHE/$SOURCE `guess_compressor $SOURCE_CACHE/$SOURCE`
${MD5[0]} > ./$NAME || [
-e ./$NAME ]

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
>From seth AT tautology.org Tue Apr 22 16:00:23 2003
Return-Path: <seth AT tautology.org>
Delivered-To: sm-security AT lists.ibiblio.org
Received: from smgl.positivism.org (irc.positivism.org [65.102.47.196])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id D994A20019
for <sm-security AT lists.ibiblio.org>;
Tue, 22 Apr 2003 16:00:22 -0400 (EDT)
Received: from tautology.org
(evrtwa1-ar13-4-33-070-190.evrtwa1.dsl-verizon.net [4.33.70.190])
by smgl.positivism.org (8.12.9/8.12.9) with ESMTP id h3MK0H4b017021;
Tue, 22 Apr 2003 20:00:18 GMT
Received: from tautology.org (tautology.org [127.0.0.1])
by tautology.org (8.12.9/8.12.9) with ESMTP id h3MK0H6l061270;
Tue, 22 Apr 2003 13:00:17 -0700 (PDT)
(envelope-from seth AT tautology.org)
Received: from localhost (seth@localhost)
by tautology.org (8.12.9/8.12.9/Submit) with ESMTP id h3MK0GpQ061267;
Tue, 22 Apr 2003 13:00:17 -0700 (PDT)
Date: Tue, 22 Apr 2003 13:00:07 -0700 (PDT)
From: Seth Woolley <seth AT tautology.org>
To: snakebyte / Eric Sesterhenn <snakebyte AT gmx.de>
In-Reply-To: <20030422215040.49293d5b.snakebyte AT gmx.de>
Message-ID: <20030422125615.I49392-100000 AT tautology.org>
References: <20030422215040.49293d5b.snakebyte AT gmx.de>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: sm-security AT lists.ibiblio.org
Subject: [SM-Security] Re: Chroot stuff for SMGL
X-BeenThere: sm-security AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security bugs are reported here via bugzilla
<sm-security.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-security>
List-Post: <mailto:sm-security AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-security>,
<mailto:sm-security-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2003 20:00:23 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

wow, great.... just looked at it myself.

I'll see what the rest of the team thinks. :)

Seth

On Tue, 22 Apr 2003, snakebyte / Eric Sesterhenn wrote:

> Hi,
>
> I finally got around to submitting this. In case you want to take a look
> at it: http://bugs.sourcemage.org/show_bug.cgi?id=3199
>
> cu Eric / snakebyte
>
> --
> www.againsttcpa.com -- 1984 might be true, just 30 years later
> www.snake-basket.de -- just my stuff
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+pZ9Q7fQ833vqzH0RAsZWAJ9ymMfej3L15FQ935vCRjwPTA6u9QCfSpeq
qtOCB4fP4ZTtXVRal1NQzVY=
=Q/MS
-----END PGP SIGNATURE-----

[SM-Security] [Bug 3041] New: z-rejected: setiathome borked with buffer overflow, bugzilla-daemon, 04/07/2003