[Bug 1121526] Re: False positives on trojans (Trojan.Agent-132354)

2013-02-16 Thread Seth Arnold
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1121526 Title: False positives on trojans (Trojan.Agent-132354)

[Bug 1104049] Re: /usr/sbin/apachectl privilege escalation

2013-03-04 Thread Seth Arnold
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in Ubuntu. https://bugs.launchpad.net/bugs/1104049 Title: /usr/sbin/apachectl privilege escalation To

[Bug 1152163] Re: package libapr1 1.4.6-3 failed to install/upgrade: error writing to 'standard output': Success

2013-03-07 Thread Seth Arnold
** Information type changed from Private Security to Public Security ** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apr in Ubuntu. https://bugs.launchpad.net/bugs/1152163

[Bug 1115053] Re: Multiple open vulnerabilities in tomcat7 in 12.04 and 11.10

2013-03-15 Thread Seth Arnold
Thanks Christian. I updated the timestamp in the changelog, otherwise looked good to me. Thanks, this was a beast. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to tomcat7 in Ubuntu. https://bugs.launchpad.net/bugs/1115053 Title:

[Bug 1157332] [NEW] /etc/dnsmasq.d-available/lxc circular link

2013-03-19 Thread Seth Arnold
Public bug reported: In today's Raring apt-get dist-upgrade: Setting up lxc (0.9.0~rc1-0ubuntu1) ... Installing new version of config file /etc/apparmor.d/lxc/lxc-default-with-nesting ... dpkg: warning: lxc: config file '/etc/dnsmasq.d-available/lxc' is a circular link (=

[Bug 1160108] [NEW] twisted ERROR: Unhandled Error when destroying services

2013-03-25 Thread Seth Arnold
Public bug reported: This trace is from the juju debug-log with the juju ppa on 12.04 LTS, using the local provider. In one terminal: juju destroy-service wordpress juju destroy-service mysql In the juju debug-log in another terminal: 2013-03-25 17:23:17,004 unit:unattended-upgrades/1:

[Bug 1160372] Re: Login is not possible

2013-03-29 Thread Seth Arnold
A pal spotted this bug report and suggests [this] is caused by vsftp switching pid namespaces (audit kernel code prohibits). Hope this helps. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to vsftpd in Ubuntu.

[Bug 1163147] [NEW] can't resolve lan hosts (regression)

2013-04-02 Thread Seth Arnold
Public bug reported: First, apologies for the complicated configuration. I use the 'uvt' front-end to libvirt-managed kvm guest machines. I also have a LAN with a router that does local dynamic DNS configuration with the client-provided dhcp hostnames. I would like to resolve hostnames on my

[Bug 1163147] Re: can't resolve lan hosts (regression)

2013-04-02 Thread Seth Arnold
*** This bug is a duplicate of bug 1126488 *** https://bugs.launchpad.net/bugs/1126488 Robie, this very well might be an abuse of dnsmasq; however, the upstream author discusses a libvirt-managed dnsmasq instance as a perfectly well supported configuration in

[Bug 1163147] Re: can't resolve lan hosts (regression)

2013-04-03 Thread Seth Arnold
Thomas, I'm experiencing this problem on Raring. The uvt version (in the source code) is: script_version=2013021401 I upgraded to Raring completely -- this isn't a frankenmonster :) -- after having successfully working 12.04 LTS and 12.10 configurations. (Obviously, with earlier versions of uvt,

[Bug 509647] Re: [MIR] lxc

2013-04-05 Thread Seth Arnold
based on exec() rather than popen(). - Enable PIE for the binaries. Thanks ** Changed in: lxc (Ubuntu) Assignee: Seth Arnold (seth-arnold) = MIR approval team (ubuntu-mir) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc

[Bug 509647] Re: [MIR] lxc

2013-04-09 Thread Seth Arnold
Urgh. sorry for losing track of this bug. I forgot to subscribe after submitting my comment. I believe your proposed additional check would be sufficient. I _think_ better might be to destroy the lock pointer in the shared structure when freeing the object but before unlocking -- preventing other

[Blueprint servercloud-1305-juju-charmstore-feedback-loops] Add User Feedback loops and Social Networking to Charm Store Charm Pages

2013-04-10 Thread Seth Arnold
Blueprint changed by Seth Arnold: Whiteboard set to: sarnold would like to know roughly how many people have deployed his charms and would like to know roughly how many have upgraded the charm recently -- Add User Feedback loops and Social Networking to Charm Store Charm Pages https

[Bug 1170516] [NEW] mysql 5.5.31, 5.1.69 security update tracking bug

2013-04-18 Thread Seth Arnold
*** This bug is a security vulnerability *** Public security bug reported: See mysql issues here: http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html#AppendixMSQL ** Affects: mysql-5.1 (Ubuntu) Importance: Undecided Status: New ** Affects: mysql-5.5 (Ubuntu)

[Bug 1172981] [NEW] clamav 0.97.8 security update

2013-04-25 Thread Seth Arnold
*** This bug is a security vulnerability *** Public security bug reported: ClamAV has released 0.97.8 to address several security issues: http://blog.clamav.net/2013/04/clamav-0978-has-been-released.html CVEs are not currently assigned. ** Affects: clamav (Ubuntu) Importance: Undecided

[Bug 1172981] Re: clamav 0.97.8 security update

2013-05-01 Thread Seth Arnold
** Description changed: ClamAV has released 0.97.8 to address several security issues: http://blog.clamav.net/2013/04/clamav-0978-has-been-released.html - CVEs are not currently assigned. + CVE-2013-2020 and CVE-2013-2021. ** CVE added: http://www.cve.mitre.org/cgi-

[Bug 1157332] Re: /etc/dnsmasq.d-available/lxc circular link

2013-05-09 Thread Seth Arnold
I tested libvirt-bin on quantal: the current archive version does not properly re-create /etc/dnsmasq.d/libvirt-bin symbolic link when installed, uninstalled, and re-installed. The -proposed version does properly re-create the /etc/dnsmasq.d /libvirt-bin symbolic link. (Ignore the

[Bug 1188630] Re: package nagios3-cgi 3.2.3-3ubuntu1 failed to install/upgrade: subprocess installed pre-removal script returned error exit status 2

2013-06-07 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1188827] Re: User option (-u or --user) is ignored

2013-06-07 Thread Seth Arnold
Have you been able to reproduce this problem using the Ubuntu-provided tftpd-hpa package? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to tftp-hpa in Ubuntu. https://bugs.launchpad.net/bugs/1188827 Title: User option (-u or --user)

[Bug 1192439] Re: update stoped

2013-06-19 Thread Seth Arnold
I see on http://www.clamav.net/lang/en/ daily.cvd ver. 17382 released on 19 Jun 2013 12:41 :0400 (sig count: 1359577) Can you clarify what you mean? Thanks ** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of

[Bug 362427] Re: Public key ssh auth doesn't work with my Encrypted Home Directory

2013-06-27 Thread Seth Arnold
Pieter, the private key is never made available in any form to the sshd server. The server only has access to the public portion of the key in ~/.ssh/authorized_keys. You would probably not want a file on the filesystem to serve as the secret key for your encrypted directory, as that defeats the

[Bug 1197018] Re: bacula-dir.conf does not use random password

2013-07-02 Thread Seth Arnold
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to bacula in Ubuntu. https://bugs.launchpad.net/bugs/1197018 Title: bacula-dir.conf does not use random password To

[Bug 1163147] Re: can't resolve lan hosts (regression)

2013-07-08 Thread Seth Arnold
Thanks Thomas, You need to configure things such that each nameserver listed in resolv.conf can resolve all names you want resolved. This requirement feels impossible to meet; the dnsmasq spawned by libvirt on my laptop knows only the VMs running on my laptop. It is not possible for this

[Bug 1202278] Re: bind9 has no rate limit option

2013-07-18 Thread Seth Arnold
** Changed in: bind9 (Ubuntu) Status: New = Confirmed ** Changed in: bind9 (Ubuntu) Importance: Undecided = Wishlist -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to bind9 in Ubuntu. https://bugs.launchpad.net/bugs/1202278

[Bug 1202278] Re: bind9 has no rate limit option

2013-07-18 Thread Seth Arnold
Indeed, this looks useful. However, performing the rate limiting in the kernel using firewall rules can be more efficient and not require any BIND patches. There are three mechanisms I can think of for performing this rate limiting today, without waiting for updates: - Insert iptables hashlimit

[Bug 1202818] Re: package apache2-bin 2.4.4-6ubuntu3 failed to install/upgrade: intentando sobreescribir `/usr/share/apport/package-hooks/apache2.py', que está también en el paquete apache2-utils 2.4.

2013-07-18 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1061277] Re: ssh ignores ssh_config

2012-10-03 Thread Seth Arnold
There are two config files, /etc/ssh/ssh_config and /etc/ssh/sshd_config, that live in this directory. ssh_config does not respect the AllowUsers configuration option (see ssh_config(5)); sshd_config _does_ respect the AllowUsers configuration option. Please re-check which file you have modified.

[Bug 1070094] Re: package slapd (not installed) failed to install/upgrade: le sous-processus script post-installation installé a retourné une erreur de sortie d'état 1

2012-10-22 Thread Seth Arnold
*** This bug is a duplicate of bug 1070093 *** https://bugs.launchpad.net/bugs/1070093 ** This bug has been marked a duplicate of bug 1070093 package slapd (not installed) failed to install/upgrade: le sous-processus script post-installation installé a retourné une erreur de sortie d'état

[Bug 1178645] Re: tomcat7 needs update to 7.0.40

2013-07-19 Thread Seth Arnold
Tomcat7 in 12.04 LTS is community supported -- H.-Dirk, is your backported package of sufficient quality that the debdiff could be used to provide an update for other precise users? Please see https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for some details. Thanks -- You received this

[Bug 1202278] Re: bind9 has no rate limit option

2013-07-26 Thread Seth Arnold
It might be possible to bring the feature to 12.04 LTS, through one of two mechanisms: The Stable Release Update process https://wiki.ubuntu.com/StableReleaseUpdates is usually used to fix high-impact bugs. I'd be prepared to ask the SRU team to include rate- limiting DNS responses as such an

[Bug 1206784] Re: Ubuntu 12.04 BIND 9.8.1-P1 and CVE-2013-4854

2013-07-31 Thread Seth Arnold
bind9 updates for CVE-2013-4854 were released on 2013-07-29 in USN-1910-1. Please see http://www.ubuntu.com/usn/usn-1910-1/ for more details. Thanks. ** Changed in: bind9 (Ubuntu) Status: New = Fix Released ** Information type changed from Private Security to Public Security ** CVE

[Bug 509647] Re: [MIR] lxc

2013-08-06 Thread Seth Arnold
) Assignee: Seth Arnold (seth-arnold) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/509647 Title: [MIR] lxc To manage notifications about this bug go to: https

[Bug 1197896] Re: [MIR] ruby-safe-yaml, ruby-hashie, ruby-indentation

2013-08-07 Thread Seth Arnold
. Security team ACK for including in main. Thanks ** Changed in: ruby-safe-yaml (Ubuntu) Assignee: Seth Arnold (seth-arnold) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to ruby-safe-yaml in Ubuntu. https

[Bug 509647] Re: [MIR] lxc

2013-08-09 Thread Seth Arnold
Stéphane, thanks for fixing this. Security team ACK for main. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/509647 Title: [MIR] lxc To manage notifications about this bug go to:

[Bug 1210425] Re: Unable to login

2013-08-09 Thread Seth Arnold
Thanks for your comments. This does not appear to be a bug report and we are closing it. We appreciate the difficulties you are facing, but it would make more sense to raise your question in the support tracker. Please visit https://answers.launchpad.net/ubuntu/+addquestion ** Changed in: openssh

[Bug 1222422] Re: package php5-common 5.4.9-4ubuntu2.3 failed to install/upgrade: subprocess installed post-installation script returned error exit status 2

2013-09-09 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1223538] Re: package dbconfig-common 1.8.47+nmu1 failed to install/upgrade: package dbconfig-common is already installed and configured

2013-09-10 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1231991] Re: open-vm-dkms 2011.12.20-562307-0ubuntu1: open-vm-tools kernel module failed to build

2013-09-27 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1232278] Re: package php5-common 5.4.9-4ubuntu2.3 failed to install/upgrade: подпроцесс установлен сценарий post-installation возвратил код ошибки 2

2013-09-27 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1187001] Re: saslauthd[26791]: segfault at 0 ip b71de6f1 sp bfcd2d9c error 4 in libc-2.17.so[b7160000+1ad000]

2013-10-01 Thread Seth Arnold
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cyrus-sasl2 in Ubuntu. https://bugs.launchpad.net/bugs/1187001 Title: saslauthd[26791]: segfault at 0 ip b71de6f1 sp bfcd2d9c

[Bug 1187001] Re: saslauthd[26791]: segfault at 0 ip b71de6f1 sp bfcd2d9c error 4 in libc-2.17.so[b7160000+1ad000]

2013-10-01 Thread Seth Arnold
I think this hasn't been addressed in part because it didn't get a CVE number: http://openwall.com/lists/oss-security/2013/07/12/4 Since the service appears to be restarting without qualm, I can see why it didn't get a CVE, but this does seem less than awesome. Mancha made a lot of patches for

[Bug 1187001] Re: saslauthd[26791]: segfault at 0 ip b71de6f1 sp bfcd2d9c error 4 in libc-2.17.so[b7160000+1ad000]

2013-10-02 Thread Seth Arnold
Are you confident about multi-threading? I don't see any linker commands to link against the threading libraries in our build logs: https://launchpadlibrarian.net/92810645/buildlog_ubuntu-precise-amd64 .cyrus-sasl2_2.1.25.dfsg1-3_BUILDING.txt.gz and I also see extensive use of fork(2) in the

[Bug 1187001] Re: saslauthd[26791]: segfault at 0 ip b71de6f1 sp bfcd2d9c error 4 in libc-2.17.so[b7160000+1ad000]

2013-10-04 Thread Seth Arnold
Mancha, thanks! I'm sorry I overlooked it. (Even worse, I did the triage way back when I forgot about it in the meantime: http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-4122.html ) -- You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 1236171] Re: package postfix 2.9.6-1~12.10.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2013-10-07 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1237265] Re: clamav verified ineffective

2013-10-09 Thread Seth Arnold
We do not ship any virus definitions for clamav, all those are provided by upstream clamav developers. Thanks -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1237265 Title: clamav

[Bug 1237265] Re: clamav verified ineffective

2013-10-09 Thread Seth Arnold
Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it. Submitting the bug about the proper source package is essential. For help see

[Bug 1220950] Re: [MIR] open-vm-tools

2013-10-23 Thread Seth Arnold
sense on all platforms involved. Security team ACK for promoting to main. Thanks ** Changed in: open-vm-tools (Ubuntu) Assignee: Seth Arnold (seth-arnold) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to open-vm

[Bug 981122] Re: Will serve corrupted Packages.gz from time to time

2013-11-21 Thread Seth Arnold
I'm marking this closed, Ubuntu 12.04 LTS and newer packages have lines such as: # always refresh Packages and Release files refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz)$ 0 0% 0 refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh_pattern \/InRelease$ 0 0% 0 If this recurs, please re-open.

[Bug 1261871] Re: Buffer overrun while parsing DCE-RPC packets

2013-12-17 Thread Seth Arnold
** Information type changed from Private Security to Public Security ** Changed in: samba (Ubuntu) Status: New = Incomplete ** Changed in: samba (Ubuntu) Status: Incomplete = Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 1242726] Re: [MIR] php5-common is missing dependency on php5-json

2013-12-20 Thread Seth Arnold
) Assignee: Seth Arnold (seth-arnold) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1242726 Title: [MIR] php5-common is missing dependency on php5-json To manage notifications

[Bug 1264203] Re: package clamav-base 0.97.8+dfsg-1ubuntu4 failed to install/upgrade: subprocess installed post-installation script returned error exit status 128

2013-12-26 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1266381] Re: OpenVPN does not stop IPv6 from leaking data

2014-01-06 Thread Seth Arnold
I don't believe OpenVPN makes any effort to prevent communications through other configured networks; it is designed to allow creating a virtual private network, not provide a mechanism to tunnel all other traffic off the system out of an untrusted network. I do not know if there are any drop-in

[Bug 1267647] Re: Screen doesn't lock on resume

2014-01-09 Thread Seth Arnold
*** This bug is a duplicate of bug 49579 *** https://bugs.launchpad.net/bugs/49579 Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 49579, so it is being marked as such. This is a

[Bug 1268077] Re: open-vm-dkms 2011.12.20-562307-0ubuntu1: open-vm-tools kernel module failed to build

2014-01-10 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1276714] Re: package openssh-server 1:6.2p2-6ubuntu0.1 failed to install/upgrade: Unterprozess installiertes post-installation-Skript gab den Fehlerwert 1 zurück

2014-02-05 Thread Seth Arnold
Thanks, I suspect you can fix your issue by deleting /etc/subgid.lock, dpkg --purge openssh-server nfs-kernel-server, then re-install the openssh- server and nfs-kernel-server. Can you attach your related /var/log/syslog and /var/log/syslog.1 (or other files)? I'm curious how the subgid.lock

[Bug 1276938] Re: Inconsistent agent behaviour with ssh on the desktop

2014-02-06 Thread Seth Arnold
This reminds me of https://bugs.launchpad.net/ubuntu/+source/gnome- keyring/+bug/1271591 -- I'm not confident that it is a duplicate -- but the symptoms feel very similar. Thanks -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh

[Bug 1254034] Re: txlongpoll.yaml contains password but is world readable

2014-02-13 Thread Seth Arnold
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to maas in Ubuntu. https://bugs.launchpad.net/bugs/1254034 Title: txlongpoll.yaml contains password but is world

[Bug 591128] [NEW] sensord cannot RRD log with multiple chips

2010-06-08 Thread Seth Arnold
Public bug reported: Binary package hint: lm-sensors I cannot create an RRD database with my lm-sensors sensord: Jun 8 00:34:27 haig sensord: Creating round robin database Jun 8 00:34:27 haig sensord: Error creating RRD file: /var/log/sensord.rrd: Duplicate DS name: temp1 This bug has been

[Bug 595789] [NEW] after resuming from suspend, sensors -s is required

2010-06-17 Thread Seth Arnold
Public bug reported: Binary package hint: lm-sensors I wrote some limits for my sensors into an /etc/sensors.d/ file, but I need to reset the limits with sensors -s after resuming from sleep. I'm not sure why the limit information is lost after suspending, but working around it by running

[Bug 595789] Re: after resuming from suspend, sensors -s is required

2010-06-17 Thread Seth Arnold
** Patch added: /etc/pm/sleep.d/10_lm-sensors http://launchpadlibrarian.net/50524075/10_lm-sensors -- after resuming from suspend, sensors -s is required https://bugs.launchpad.net/bugs/595789 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 511743] [NEW] typo in ntpdate manpage (patch included)

2010-01-23 Thread Seth Arnold
Public bug reported: Binary package hint: ntp Small (harmless) typo in the ntpdate manpage. ProblemType: Bug Architecture: amd64 Date: Sat Jan 23 16:31:50 2010 DistroRelease: Ubuntu 9.10 InstallationMedia: Ubuntu 9.10 Karmic Koala - Release amd64 (20091027) Package: ntpdate

[Bug 511743] Re: typo in ntpdate manpage (patch included)

2010-01-23 Thread Seth Arnold
Oh yeah, also in upstream Debian (which is where the svn repo came from), if anyone can easily push there too, I'm sure they'd like it. :) -- typo in ntpdate manpage (patch included) https://bugs.launchpad.net/bugs/511743 You received this bug notification because you are a member of Ubuntu

[Bug 1280576] Re: package clamav-daemon 0.97.8+dfsg-1ubuntu4 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2014-02-15 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1281830] Re: package bind9 1:9.8.1.dfsg.P1-4ubuntu0.8 failed to install/upgrade: le sous-processus script post-installation installé a retourné une erreur de sortie d'état 1

2014-02-18 Thread Seth Arnold
*** This bug is a duplicate of bug 1281829 *** https://bugs.launchpad.net/bugs/1281829 Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a

[Bug 1284139] Re: ubuntu 13.10 crashes and sends error report, bluetooth manager not working

2014-02-24 Thread Seth Arnold
Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it. Submitting the bug about the proper source package is essential. For help see

[Bug 1291527]

2014-03-12 Thread Seth Arnold
Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it. Submitting the bug about the proper source package is essential. For help see

[Bug 1291527] Re: package openssh-client 1:6.2p2-6 failed to install/upgrade: cannot copy extracted data for './etc/ssh/moduli' to '/etc/ssh/moduli.dpkg-new': unexpected end of file or stream

2014-03-12 Thread Seth Arnold
Please note the following in your logs: [ 1800.804033] mce: [Hardware Error]: Machine check events logged MCE are hardware errors and cannot be fixed in software. Probably your computer needs new motherboard, CPU, memory, or something else similarly drastic. Thanks. ** Information type changed

[Bug 1262710] Re: [MIR] nginx

2014-03-12 Thread Seth Arnold
After discussion between Adam Conrad, Thomas Ward, Dimitri John Ledkov, and myself, we came to conclusion that we should not remove the nginx- lua module from the distribution. So, we will re-promote lua5.1 to main as a build dependency for nginx and continue building the nginx-lua module so

[Bug 1294280] Re: [CVE-2014-0133] SPDY Heap Buffer Overflow Vulnerability

2014-03-18 Thread Seth Arnold
Trusty uses the --with-debug on all binaries; Saucy does not. Saucy should probably just get the upstream Nginx patch to enable that one code block. Thanks -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu.

[Bug 1267393] Re: [MIR] juju-core, juju-mongodb, gccgo-go, gccgo-4.9, golang

2014-03-19 Thread Seth Arnold
Patricia, it is currently blocked by (at least) the security team review; this review is currently blocked by preparing a new apparmor package upload for trusty. I sincerely hope this upload is completed this week. -- You received this bug notification because you are a member of Ubuntu Server

[Bug 1294880] Re: chkrootkit reports Sukkit root kit in both Lubuntu and xubuntu 13.10

2014-03-19 Thread Seth Arnold
chkrootkit is hilariously overzealous here; it is checking if /sbin/init contains the string HOME, which upstart most definitely does: $ grep HOME upstart/saucy/upstart-1.10/init/* grep: upstart/saucy/upstart-1.10/init/man: Is a directory grep: upstart/saucy/upstart-1.10/init/tests: Is a

[Bug 1295892] [NEW] nginx upgrade failed

2014-03-21 Thread Seth Arnold
Public bug reported: When upgrading nginx, I found this: Setting up nginx-common (1.4.1-3ubuntu1.3) ... Setting up nginx-light (1.4.1-3ubuntu1.3) ... * Starting nginx nginx nginx: [emerg] bind() to

[Bug 1295892] Re: nginx upgrade failed

2014-03-24 Thread Seth Arnold
Thomas, I was upgrading from version 1.4.1-3ubuntu1.2. Thanks -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1295892 Title: nginx upgrade failed To manage notifications about this

[Bug 1298295] Re: iscsitarget-dkms 1.4.20.2-5ubuntu3.3: iscsitarget kernel module failed to build

2014-03-27 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1267393] Re: [MIR] juju-core, juju-mongodb, gccgo-go, gccgo-4.9, golang

2014-04-02 Thread Seth Arnold
I partially reviewed juju-core version 1.17.6-0ubuntu1 as checked into trusty. This shouldn't be considered a full security audit; this review is even more cursory than usual, since the MIR has been retracted for trusty. So, here's the notes I've collected thus far in the hopes that they are

[Bug 1302886] Re: w3m -- ssl security check reveals flaws

2014-04-04 Thread Seth Arnold
Hello, thanks for reporting this to Ubuntu; however, we do not have any plans to update OpenSSL on released distributions. We will only provide specific security updates as described at https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions If you need TLS 1.2 support in the client programs, Ubuntu

[Bug 1304304] Re: nginx ubuntu package possibly affected by CVE 2014-0160

2014-04-08 Thread Seth Arnold
Did you restart nginx or reboot your system after applying the update? Thanks ** Information type changed from Private Security to Public Security ** Changed in: nginx (Ubuntu) Status: New = Incomplete -- You received this bug notification because you are a member of Ubuntu Server

[Bug 1304304] Re: nginx ubuntu package possibly affected by CVE 2014-0160

2014-04-08 Thread Seth Arnold
Kai, thanks, that makes more sense. Have fun! ** Changed in: nginx (Ubuntu) Status: Incomplete = Invalid -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1304304 Title: nginx

[Bug 1305228] Re: PasswordAuthentication no fails if user account has no password set

2014-04-09 Thread Seth Arnold
There are several possible states of 'no password' -- the hashed password field in /etc/shadow could be blank, could be a *, could be a !, or could be a ! followed by a 'old password' that is currently locked. Do you have easy access to /etc/shadow lines that work as expected and that don't work

[Bug 1274247] Re: [MIR] Glusterfs

2014-04-10 Thread Seth Arnold
I reviewed glusterfs version 3.4.2-1ubuntu1 as checked into trusty. This should not be considered a full security audit, but rather a quick gauge of maintainability. I'm not going to fill in the full review checklist; I don't think that the results would be that useful for anyone, so here's just

[Bug 1274247] Re: [MIR] Glusterfs

2014-04-10 Thread Seth Arnold
** Attachment added: cppcheck output https://bugs.launchpad.net/ubuntu/+source/glusterfs/+bug/1274247/+attachment/4080255/+files/cppcheck.txt ** Changed in: glusterfs (Ubuntu) Assignee: Seth Arnold (seth-arnold) = (unassigned) -- You received this bug notification because you

[Bug 1313916] Re: package ruby (not installed) failed to install/upgrade: a tentar sobre-escrever '/usr/share/man/man1/ruby.1.gz', que também está no pacote ruby-ni 2.0.0-p451-1

2014-04-28 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1314897] Re: package postfix (not installed) failed to install/upgrade: subprocess new pre-installation script was killed by signal (Broken pipe)

2014-05-01 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1315029] Re: shib2.load prevents webdav from reading .htpasswd file

2014-05-01 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1292234] Re: qcow2 image corruption in trusty (qemu 1.7 and 2.0 candidate)

2014-05-01 Thread Seth Arnold
I believe I just tripped this bug; I compressed some qcow2 images using this: for f in sec-{lucid,precise,quantal,saucy,trusty}-{amd64,i386} ; do echo $f ; qemu-img convert -s pristine -p -f qcow2 -O qcow2 $f.qcow2 reclaimed.qcow2 ; mv reclaimed.qcow2 $f.qcow2 ; virsh snapshot-delete $f

[Bug 1315162] [NEW] fiddling with snapshots leads to unbootable images

2014-05-01 Thread Seth Arnold
*** This bug is a duplicate of bug 1292234 *** https://bugs.launchpad.net/bugs/1292234 Public bug reported: After compacting qcow2 filesystem images some of them are no longer bootable. ProblemType: Bug DistroRelease: Ubuntu 14.04 Package: qemu 2.0.0~rc1+dfsg-0ubuntu3.1

[Bug 1315720] Re: package clamav-testfiles 0.97.8+dfsg-1ubuntu1.12.04.1 failed to install/upgrade: unable to open '/usr/share/clamav-testfiles/clam-aspack.exe.dpkg-new': Operation not permitted

2014-05-05 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1316872] Re: package mongodb-clients (not installed) failed to install/upgrade: trying to overwrite '/usr/bin/bsondump', which is also in package mongodb-10gen 2.4.10

2014-05-06 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1316971] Re: open-vm-dkms 2011.12.20-562307-0ubuntu1: open-vm-tools kernel module failed to build

2014-05-07 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1318192] Re: 14.04 host can not ssh to a Cisco router

2014-05-11 Thread Seth Arnold
*** This bug is a duplicate of bug 1287222 *** https://bugs.launchpad.net/bugs/1287222 ** This bug has been marked a duplicate of bug 1287222 openssh-client 6.5 regression bug with certain servers -- You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 1318682] Re: package python-samba 2:4.1.6+dfsg-1ubuntu2 failed to install/upgrade: cannot copy extracted data for './usr/lib/python2.7/dist-packages/samba/provision/sambadns.py' to '/usr/lib/pyth

2014-05-12 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1319578] [NEW] qcow2: Preventing invalid write on metadata (overlaps with refcount block); image marked as corrupt.

2014-05-14 Thread Seth Arnold
Public bug reported: One of my VMs remounted its filesystem read-only; I discovered this in the host's /var/log/libvirt/qemu/sec-trusty-amd64.log file: 2014-05-06 19:02:39.735+: shutting down 2014-05-07 18:44:45.578+: starting up LC_ALL=C

[Bug 1319600] [NEW] maas command line client brittle to unexpected inputs

2014-05-14 Thread Seth Arnold
Public bug reported: The maas command line client is brittle to unexpected inputs. On trusty, I tried to run the 'sudo maas createsuperuser' command that I used on precise, quantal, and saucy, but it failed. I wanted detailed help, so I ran 'maas -h', and that dumped a stack trace because the

[Bug 1319600] Re: maas-cli stack trace if .maascli.db unreadable

2014-05-14 Thread Seth Arnold
Is there any reason you missed that that we can help to fix? Only that in the middle of testing an update I followed the same directions for precise, quantal, saucy, and noticed no problems until trusty. Fair's fair, things change, but it would have been nice to have a hint in the right

[Bug 1322338] Re: CVE 2014-0240 and CVE 2014-0242

2014-05-23 Thread Seth Arnold
Looks good to me, but I moved the - LP: #1322338 annotation to after the SECURITY UPDATE line in the format (LP: #1322338) instead. I'll release this Monday. Thanks Felix -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mod-wsgi in

[Bug 1324050] Re: open-vm-dkms 2011.12.20-562307-0ubuntu1: open-vm-tools kernel module failed to build

2014-05-28 Thread Seth Arnold
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1324050] Re: open-vm-dkms 2011.12.20-562307-0ubuntu1: open-vm-tools kernel module failed to build

2014-05-28 Thread Seth Arnold
Do you need the open-vm-tools package? It probably only works with the original kernel shipped with 12.04 LTS in the 'linux' package rather than the HWE (hardware enablement) kernel updates released later. -- You received this bug notification because you are a member of Ubuntu Server Team,

[Bug 1324111] [NEW] please remove chkrootkit from main

2014-05-28 Thread Seth Arnold
Public bug reported: Please remove chkrootkit from main. $ reverse-depends -c main src:chkrootkit No reverse dependencies found $ reverse-depends -b src:chkrootkit No reverse dependencies found $ seeded-in-ubuntu chkrootkit chkrootkit (from chkrootkit) is seeded in: ubuntu-server: daily

[Bug 1324111] Re: please remove chkrootkit from main

2014-05-29 Thread Seth Arnold
Thanks Colin; I hadn't heard of the Supported-Sysadmin-Common seed before, and I asked James Page on IRC for feedback (for the server seed). Are there better people to ask for feedback? Thanks -- You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 1324111] Re: please remove chkrootkit from main

2014-05-29 Thread Seth Arnold
The impetus to remove chkrootkit is a (still embargoed) issue. The output from such a tool can never be conclusive. No tool can report this host is free of rootkits. When an administrator is suspicious the better suggestion is to save the system image for further inspection and re-install from

  1   2   3   4   5   6   7   8   9   10   >