Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-26 Thread Mikhail Sobolev
Hi Andrew On Wed, Oct 25, 2006 at 10:44:23PM +0100, Andrew Flegg wrote: From a technical PoV, IT 2005 and IT 2006 have been completely different, though: lots of minor releases to fix bugs in the former; nothing like that with the latter - but there's Sardine instead. That's a very good point:

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-26 Thread Andrew Flegg
On 10/26/06, Mikhail Sobolev [EMAIL PROTECTED] wrote: On Wed, Oct 25, 2006 at 10:44:23PM +0100, Andrew Flegg wrote: From a technical PoV, IT 2005 and IT 2006 have been completely different, though: lots of minor releases to fix bugs in the former; nothing like that with the latter - but

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-26 Thread Mikhail Sobolev
On Thu, Oct 26, 2006 at 06:20:02PM +0100, Andrew Flegg wrote: On 10/26/06, Mikhail Sobolev [EMAIL PROTECTED] wrote: On Wed, Oct 25, 2006 at 10:44:23PM +0100, Andrew Flegg wrote: From a technical PoV, IT 2005 and IT 2006 have been completely different, though: lots of minor releases to fix

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-26 Thread Andrew Flegg
On 10/26/06, Mikhail Sobolev [EMAIL PROTECTED] wrote: [snip interesting points about bugfix releases] On Thu, Oct 26, 2006 at 06:20:02PM +0100, Andrew Flegg wrote: [snip the rest, I think we can probably put that safely to bed] Pity. :-/ Well, if you insist: IMHO, I think the people

[maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Marius Vollmer
Hi, this is embarrassing: there is a buffer overflow in the Application Manager that is triggered when dealing with package icons that are larger than 2048 bytes after base64 decoding. The overflow happens when there is a repository in /etc/apt/sources.list that contains such a icon in one of

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Andrew Flegg
On 10/25/06, Marius Vollmer [EMAIL PROTECTED] wrote: this is embarrassing: there is a buffer overflow in the Application Manager that is triggered when dealing with package icons that are larger than 2048 bytes after base64 decoding. Oops. Thanks for the disclosure. The bug is present in

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Ian
Ola, This now brings the question of an end-user roadmap back to the fore with a vengenance. To put it bluntly, how long is Nokia going to leave end users vulnerable to possible attacks? When *is* the next maintenance release of IT 2006? maybe its more helpful to ask if there is anything we

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Andrew Flegg
On 10/25/06, David Weinehall [EMAIL PROTECTED] wrote: [snip] You know, IMO (not official Nokia policy) this isn't exactly a high risk security issue. To exploit, you need to install a package from an external, non-trusted source. Once you start installing non-trusted 3rd party

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread David Weinehall
On ons, 2006-10-25 at 16:30 +0100, ext Andrew Flegg wrote: On 10/25/06, David Weinehall [EMAIL PROTECTED] wrote: [snip] You know, IMO (not official Nokia policy) this isn't exactly a high risk security issue. To exploit, you need to install a package from an external, non-trusted

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Koen Kooi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Weinehall schreef: On ons, 2006-10-25 at 16:24 +0100, ext Andrew Flegg wrote: On 10/25/06, Ian [EMAIL PROTECTED] wrote: maybe its more helpful to ask if there is anything we (the community) can do to help get it out of the door?? ... That

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Andrew Flegg
On 10/25/06, David Weinehall [EMAIL PROTECTED] wrote: On ons, 2006-10-25 at 16:24 +0100, ext Andrew Flegg wrote: On 10/25/06, Ian [EMAIL PROTECTED] wrote: maybe its more helpful to ask if there is anything we (the community) can do to help get it out of the door?? ... That presupposes

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Marius Vollmer
ext David Weinehall [EMAIL PROTECTED] writes: On ons, 2006-10-25 at 16:24 +0100, ext Andrew Flegg wrote: On 10/25/06, Ian [EMAIL PROTECTED] wrote: maybe its more helpful to ask if there is anything we (the community) can do to help get it out of the door?? ... That presupposes there

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread David Weinehall
On ons, 2006-10-25 at 17:44 +0200, ext Koen Kooi wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Weinehall schreef: On ons, 2006-10-25 at 16:24 +0100, ext Andrew Flegg wrote: On 10/25/06, Ian [EMAIL PROTECTED] wrote: maybe its more helpful to ask if there is anything we (the

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread George Farris
On Wed, 2006-25-10 at 18:57 +0300, David Weinehall wrote: Most of the quirks have been twisted out now; it's almost functional, and our legal department is checking it at the moment. This has got to be the saddest statement of our society, the fact that the legal department has to check on it.

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread George Farris
On Wed, 2006-25-10 at 19:54 +0300, David Weinehall wrote: On ons, 2006-10-25 at 09:39 -0700, ext George Farris wrote: On Wed, 2006-25-10 at 18:57 +0300, David Weinehall wrote: Most of the quirks have been twisted out now; it's almost functional, and our legal department is checking it at

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Mikhail Sobolev
On Wed, Oct 25, 2006 at 04:49:09PM +0100, Andrew Flegg wrote: If Nokia's plans now solely consist of yearly releases (with no word as to whether or not they cost money), the community'll probably want to start thinking about forking whatever's present so that we're not dependent on occasional,

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Ian
Ola, Either way, some professionalism would be nice. It's certainly a matter of definition :) Please do define it and we'll see if it's possible to follow your definition... From http://en.wikipedia.org/wiki/Professional A professional provides a service in exchange for payment in accordance

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Mikhail Sobolev
On Wed, Oct 25, 2006 at 03:43:34PM -0500, Ian wrote: Either way, some professionalism would be nice. It's certainly a matter of definition :) Please do define it and we'll see if it's possible to follow your definition... From http://en.wikipedia.org/wiki/Professional A professional

Re: [maemo-developers] IMPORTANT: vulnerability in Application Manager, please check your repositories

2006-10-25 Thread Andrew Flegg
On 10/25/06, Mikhail Sobolev [EMAIL PROTECTED] wrote: On Wed, Oct 25, 2006 at 04:49:09PM +0100, Andrew Flegg wrote: If Nokia's plans now solely consist of yearly releases (with no word as to whether or not they cost money), the community'll probably want to start thinking about forking