sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] Re: PERFORCE change 13065 for review (another anomaly in Plone)

From: Seth Woolley <seth AT tautology.org>
To: sm-security AT lists.ibiblio.org, sergey_lipnevich <sergeyli AT pisem.net>
Cc: Jon Svendsen <jon-sven AT frisurf.no>, Vladimir Vydra <vydra AT fria.fri.utc.sk>, Unet <burududu AT hotpop.com>, robby_verkuylen <rob AT verkuylen.net>, Eric Womack <eric AT sourcemage.com>, Glenn Shannon <petshop AT cox.net>, Robin Cook <rcook AT wyrms.net>, Adam Clark <adamsgl AT dhbit.ca>, Jeffrey Schmidt <jschmidt AT fnal.gov>, Zoran Constantinescu <zoran AT idi.ntnu.no>
Subject: [SM-Security] Re: PERFORCE change 13065 for review (another anomaly in Plone)
Date: Sat, 21 Jun 2003 15:04:08 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sergey,

Guess what ... They did it again!

http://smgl.positivism.org/CMFPlone1.0.3.tar.gz

ls -l from the tarball:
drwxrwxr-x 10 503 503 1448 Jun 15 22:13 CMFPlone
drwxrwxr-x 7 503 503 712 Jun 15 22:13 DCWorkflow
drwxr-xr-x 6 503 503 952 Jun 15 22:13 Formulator
drwxrwxr-x 2 503 503 1000 Jun 15 22:13 i18n

They changed the source _right_ after you submitted the change this time.

The new md5 is 9323283f0800ee982d8ddd6402d3fb40 for me from a download
date of Jun 20 07:50 PDT.

I'm not going to update this md5 in perforce until I see a diff of the
two tarballs -- they could be rooted or something and every release gets
modified, at this rate.

Can you send me the file? or you can download it again and diff the
different ones. I'll cede to your judgement on this. It's just starting
to make me paranoid. ;)

Seth

On Sun, 15 Jun 2003, sergey_lipnevich wrote:

> Change 13065 by sergey_lipnevich@office-dev on 2003/06/15 05:59:03
>
> Upgrade to 1.0.3 and fixes
>
> Affected files ...
>
> ... //sgl/devel/grimoire/collab/Plone/BUILD#2 edit
> ... //sgl/devel/grimoire/collab/Plone/DEPENDS#2 edit
> ... //sgl/devel/grimoire/collab/Plone/DETAILS#3 edit
> ... //sgl/devel/grimoire/collab/Plone/HISTORY#3 edit
>
> Differences ...
>
> ==== //sgl/devel/grimoire/collab/Plone/BUILD#2 (xtext) ====
>
> 3c3,4
> < prepare_install
> ---
> > prepare_install &&
> > cp -r * /usr/lib/zope/Products/
>
> ==== //sgl/devel/grimoire/collab/Plone/DEPENDS#2 (xtext) ====
>
> 1a2
> > depends CMF &&
>
> ==== //sgl/devel/grimoire/collab/Plone/DETAILS#3 (xtext) ====
>
> 2c2
> < VERSION=1.0.2
> ---
> > VERSION=1.0.3
> 4c4
> < MD5[0]='2f612afb7c2fe56c38658863279f1c23'
> ---
> > MD5[0]='a2bce3367b84d4ae3b12aba0eb6f5db2'
>
> ==== //sgl/devel/grimoire/collab/Plone/HISTORY#3 (text) ====
>
> 0a1,4
> > 2003-06-13 Sergey Lipnevich <sergey AT sourcemage.org>
> > Complete the BUILD file -- install Plone into /usr/lib/zope/Products.
> > Add dependency on CMF.
> >
> 2,3c6,7
> <
> < Modified DETAILS to fix md5 for SOURCE.
> ---
> > Modified DETAILS to fix md5 for SOURCE.
> > [SL] My file has a different checksum, interesting...
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+9NZh7fQ833vqzH0RAo2GAJ0feM8vqAlaMqwgFghZMcC8W37VygCcCNbw
TyFwxzj4SOTYa649LCXrK2U=
=2P3T
-----END PGP SIGNATURE-----

[SM-Security] Re: PERFORCE change 13065 for review (another anomaly in Plone), Seth Woolley, 06/21/2003
- [SM-Security] Re: PERFORCE change 13065 for review (another anomaly in Plone), Sergey A. Lipnevich, 06/24/2003