[Bug 1416039] Re: Broken apparmor profile

2016-03-09 Thread Kees Cook
This is needed for trusty too, it seems. ** Also affects: squid3 (Ubuntu Trusty) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1416039

[Bug 1534340] Re: openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
** Changed in: openssh (Ubuntu Trusty) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in Ubuntu. https://bugs.launchpad.net/bugs/1534340 Title: openssh server 6.6 does not report max auth

[Bug 1534340] [NEW] openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
mportance: Undecided Assignee: Kees Cook (kees) Status: New ** Also affects: openssh (Ubuntu Trusty) Importance: Undecided Status: New ** Changed in: openssh (Ubuntu) Status: New => Fix Released ** Changed in: openssh (Ubuntu Trusty) Assignee: (unassig

[Bug 1534340] Re: openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
** Patch added: "openssh_6.6p1-2ubuntu2.5.debdiff" https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+attachment/4550125/+files/openssh_6.6p1-2ubuntu2.5.debdiff -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh

[Bug 1418778] Re: Stack smashing while using a lot of connections

2015-02-06 Thread Kees Cook
Today I learned that Apache raises its rlimit for open files to 8192 by default. This is controlled by APACHE_ULIMIT_MAX_FILES. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libfcgi in Ubuntu. https://bugs.launchpad.net/bugs/1418778

[Bug 1397706] Re: Argument perl_version isn't numeric in numeric

2014-12-02 Thread Kees Cook
Works for me on Trusty. ** Tags removed: verification-needed ** Tags added: verification-done -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to spamassassin in Ubuntu. https://bugs.launchpad.net/bugs/1397706 Title: Argument

[Bug 1397706] Re: Argument perl_version isn't numeric in numeric

2014-12-01 Thread Kees Cook
** Also affects: spamassassin (Ubuntu Precise) Importance: Undecided Status: New ** Also affects: spamassassin (Ubuntu Lucid) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to

[Bug 1397706] [NEW] Argument perl_version isn't numeric in numeric

2014-11-30 Thread Kees Cook
Public bug reported: After recent updates, the spamassassin (and related mimedefang) actions produce (seemingly harmless) warnings: /etc/cron.daily/spamassassin: Argument perl_version isn't numeric in numeric ge (=) at (eval 638) line 1. Argument perl_version isn't numeric in numeric ge (=) at

[Bug 1397706] Re: Argument perl_version isn't numeric in numeric

2014-11-30 Thread Kees Cook
Utopic) Status: New = In Progress ** Changed in: spamassassin (Ubuntu Trusty) Status: New = In Progress ** Changed in: spamassassin (Ubuntu Trusty) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: spamassassin (Ubuntu Utopic) Assignee: (unassigned) = Kees Cook (kees

[Bug 1331503] [NEW] apparmor profile missing link permission

2014-06-18 Thread Kees Cook
Public bug reported: type=1400 audit(1403024365.999:20455): apparmor=DENIED operation=link prof ile=/usr/sbin/named name=/var/lib/bind/db-GFtoRz38 pid=32341 comm=named requested_mask=l denied_mask=l fsuid=105 ouid=105 target=/var/lib/bind/db.MYDOMAIN

[Bug 1331503] Re: apparmor profile missing link permission

2014-06-18 Thread Kees Cook
Seems to break slaved domain updates. (i.e. my server is secondary for a master server, and when they make changes the AXFR seems to throw this into the kernel logs.) Since the /var/cache line has l already, it seems like just a simple fix; I didn't investigate the true origin. -- You received

[Bug 501956] Re: OpenSSH does not log failed attempts when key authentication is used

2012-10-14 Thread Kees Cook
** Branch linked: lp:~kees/openssh/report-publickey -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in Ubuntu. https://bugs.launchpad.net/bugs/501956 Title: OpenSSH does not log failed attempts when key authentication is

[Bug 966707] Re: not built with all hardening features

2012-03-29 Thread Kees Cook
** Changed in: vsftpd (Ubuntu Precise) Status: New = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to vsftpd in Ubuntu. https://bugs.launchpad.net/bugs/966707 Title: not built with all hardening features To

[Bug 966707] [NEW] not built with all hardening features

2012-03-27 Thread Kees Cook
Public bug reported: vsftpd has only a partially hardened build. Debian fixed this, and the solution is trivial. ** Affects: vsftpd (Ubuntu) Importance: Undecided Status: New ** Affects: vsftpd (Ubuntu Precise) Importance: Undecided Status: New ** Tags: patch **

[Bug 966707] Re: not built with all hardening features

2012-03-27 Thread Kees Cook
** Patch added: vsftpd_2.3.5-1ubuntu2.debdiff https://bugs.launchpad.net/ubuntu/+source/vsftpd/+bug/966707/+attachment/2951684/+files/vsftpd_2.3.5-1ubuntu2.debdiff -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to vsftpd in Ubuntu.

[Bug 810270] Re: AppArmor profiles need updates for /var/run → /run and /var/lock → /run/lock and /dev/shm → /run/shm

2012-02-24 Thread Kees Cook
If filesystem paths have been relocated, please use /etc/apparmor.d/tunables/alias to handle replacements. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to bind9 in Ubuntu. https://bugs.launchpad.net/bugs/810270 Title: AppArmor

Re: [Bug 892554] Re: SSH keys summary does not report ECDSA key

2011-11-22 Thread Kees Cook
the fingerprint report, but instead, allow one to skip the ssh-keyscan step, and just pull the .pub file directly out of the console output. i.e. _add_ it to the console output. -- Kees Cook -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

Re: [Bug 892554] Re: SSH keys summary does not report ECDSA key

2011-11-21 Thread Kees Cook
What's the best way to add a known_hosts entry from these fingerprints? Maybe the -e option should be used instead of -l ? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cloud-init in Ubuntu. https://bugs.launchpad.net/bugs/892554

[Bug 892554] [NEW] SSH keys summary does not report ECDSA key

2011-11-19 Thread Kees Cook
Public bug reported: The final report of SSH key fingerprints does not include ECDSA: $ ec2-get-console-output --region us-west-2 i-107ee921 ... Your identification has been saved in /etc/ssh/ssh_host_rsa_key. Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub. The key fingerprint

[Bug 556167] Re: vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2011-11-16 Thread Kees Cook
Hm, I don't agree. I think the problem is in libparted/arch/linux.c init_file(): dev-bios_geom.sectors = 32; vs _device_probe_geometry() which defaults to what the LBA reports or: dev-bios_geom.sectors = 63; So, when vmbuilder uses parted to build the disk, parted treats the

[Bug 556167] Re: vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2011-11-07 Thread Kees Cook
The problem is that parted treats local files (as used by vmbuilder) differently from actual disk files, and changes the sector size accordingly (without an option to change it). As a result, the partition start locations are too small for grub2 to install. I had originally reproduced this by

[Bug 801501] Re: [MIR] nova

2011-09-13 Thread Kees Cook
This is a step in the right direction (regex arg filtering is better than filename-glob filtering), but I think this probably needs to have even more logic built in. For example, running ip ... $interface ... might need logic to have the wrapper look up the interface and decide if it is actually a

[Bug 801501] Re: [MIR] nova

2011-09-12 Thread Kees Cook
Quick notes: * should use /run instead of /var/run * while it's nice to have the sudoers split, the sudoers fragment is wildly permissive (chown as root is trivial to exploit). I would recommend specific helper scripts that validate the logic of the requested dangerous commands (see the

[Bug 817187] Re: change in readlink() errno in 2.6.39 and later kernels causes FTBFS for packages with older gnulib

2011-08-02 Thread Kees Cook
Packages with gnulib in their source: main: augeas binfmt-support eglibc findutils gdb glib2.0 groff grub2 hello hello-debhelper liblouis libpipeline libtasn1-3 libvirt man-db mlocate texinfo universe/multiverse: amanda eiskaltdcpp freedink genparse hivex instantbird libdc0 libdrizzle

[Bug 800340] Re: [MIR] ipxe

2011-07-19 Thread Kees Cook
This looks fine to me. +1 ** Changed in: ipxe (Ubuntu) Status: New = In Progress ** Changed in: ipxe (Ubuntu) Assignee: Kees Cook (kees) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https

[Bug 793694] Re: Format string bug in parselog.pl

2011-06-08 Thread Kees Cook
This looks like a regular bug to me. I don't think Perl will deal with the %n in an unsafe way. ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to samba in Ubuntu.

[Bug 779391] Re: CVE-2011-1764: format string vulnerability

2011-05-09 Thread Kees Cook
AAaargh. Who reimplements sprintf!? I am working on hardy and dapper now. Will have this uploaded shortly. Thanks for double-checking and getting the Lucid and Oneiric patches ready! At least full ASLR (PIE[1]) is in place in Lucid and later, so exploiting this is difficult, but not impossible.

[Bug 779391] Re: CVE-2011-1764: format string vulnerability

2011-05-09 Thread Kees Cook
** Changed in: exim4 (Ubuntu Oneiric) Importance: Undecided = Medium ** Changed in: exim4 (Ubuntu Lucid) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: exim4 (Ubuntu Maverick) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: exim4 (Ubuntu Natty) Assignee

[Bug 779391] Re: CVE-2011-1764: format string vulnerability

2011-05-08 Thread Kees Cook
** Changed in: exim4 (Ubuntu) Status: New = Triaged -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to exim4 in Ubuntu. https://bugs.launchpad.net/bugs/779391 Title: CVE-2011-1764: format string vulnerability --

[Bug 768707] [NEW] cyrus-sasl2-heimdal uninstallable and ftbfs

2011-04-21 Thread Kees Cook
Public bug reported: cyrus-sasl2-heimdal 2.1.23.dfsg1-5.1ubuntu1 is uninstallable with cyrus- sasl2 2.1.23.dfsg1-5ubuntu3, and ftbfs due to heimdal changes, from what I can see. I suspect the only way forward on this is to get cyrus-sasl2 2.1.23.dfsg1-6 (or, likely, newer) into natty which merges

[Bug 230197] Re: network-manager-openvpn is incapable of supplying openssl-vulnkey with the X.509 key passphrase it requests

2011-04-16 Thread Kees Cook
** Changed in: openvpn (Ubuntu) Assignee: iamn fouda (eman-abu-fouda) = Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openvpn in Ubuntu. https://bugs.launchpad.net/bugs/230197 Title:

[Bug 694029] Re: [natty] kvm guests become unstable after a while

2011-04-08 Thread Kees Cook
model name : Intel(R) Core(TM)2 Quad CPUQ6600 @ 2.40GHz -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to qemu-kvm in Ubuntu. https://bugs.launchpad.net/bugs/694029 Title: [natty] kvm guests become unstable after a while --

[Bug 731878] Re: shutdown(2) behavior changed in kernel

2011-04-06 Thread Kees Cook
This appears to be a behavioral change to the shutdown(2) function. The socket gets only partially shut down. It's like close() was called instead of shutdown() which is supposed to kill the socket everywhere. ** Summary changed: - amavis force-reload crashes amavis + shutdown(2) behavior

[Bug 733914] [NEW] autofs races network interfaces, ends up not working

2011-03-12 Thread Kees Cook
Public bug reported: Binary package hint: autofs5 When autofs starts, the network may not be up yet. started net-device- up IFACE!=lo does not handle multi-homed machines, bridging, etc. autofs needs to wait until all configured networking has finished coming up before starting. ProblemType:

[Bug 733914] Re: autofs races network interfaces, ends up not working

2011-03-12 Thread Kees Cook
** Tags added: regression-release ** Also affects: autofs5 (Ubuntu Natty) Importance: Undecided Status: New ** Changed in: autofs5 (Ubuntu Natty) Assignee: (unassigned) = Canonical Server Team (canonical-server) ** Changed in: autofs5 (Ubuntu Natty) Milestone: None =

[Bug 722815] Re: apparmor prevents ntp from reading gpsd

2011-03-10 Thread Kees Cook
) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: ntp (Ubuntu) Importance: Low = Wishlist -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to ntp in ubuntu. https://bugs.launchpad.net/bugs/722815 Title: apparmor prevents ntp

[Bug 694029] Re: [natty] kvm guests become unstable after a while

2011-03-01 Thread Kees Cook
I have no wireless on my system, and I just saw this in a VM I started. ** Changed in: linux (Ubuntu) Status: New = Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to qemu-kvm in ubuntu.

[Bug 723312] Re: package postfix 2.8.0-1~build1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2011-02-22 Thread Kees Cook
** Changed in: postfix (Ubuntu) Status: New = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to postfix in ubuntu. https://bugs.launchpad.net/bugs/723312 Title: package postfix 2.8.0-1~build1 failed to

[Bug 722386] Re: sshd buffer overflow detected crash from certain ip addresses

2011-02-21 Thread Kees Cook
The backtrace shows that this is from the pgsql PAM module. A quick check of the code shows that it is assuming that h_addr is always an IPv4 when it may not be, resulting in a potential overflow of the buffer it creates to hold an IP address. ** Package changed: openssh (Ubuntu) = pam-pgsql

[Bug 719833] [NEW] ssh upstart job fails to actually bring up ssh

2011-02-15 Thread Kees Cook
Public bug reported: When I reboot my router, ssh does not start. Feb 15 22:51:32 router init: ssh main process (897) terminated with status 255 Feb 15 22:51:32 router init: ssh main process ended, respawning Feb 15 22:51:32 router init: ssh main process (915) terminated with status 255 Feb 15

[Bug 719833] Re: ssh upstart job fails to actually bring up ssh

2011-02-15 Thread Kees Cook
-- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in ubuntu. https://bugs.launchpad.net/bugs/719833 Title: ssh upstart job fails to actually bring up ssh -- Ubuntu-server-bugs mailing list

[Bug 697197] Re: Empty password allows access to VNC in libvirt

2011-02-11 Thread Kees Cook
** Changed in: libvirt (Ubuntu Natty) Importance: High = Undecided ** Changed in: libvirt (Ubuntu Natty) Assignee: Serge Hallyn (serge-hallyn) = (unassigned) ** Changed in: qemu-kvm (Ubuntu Maverick) Milestone: maverick-updates = None ** Changed in: libvirt (Ubuntu Lucid)

[Bug 697197] Re: Empty password allows access to VNC in libvirt

2011-02-11 Thread Kees Cook
Thanks for preparing the debdiffs! It looks like karmic is vulnerable too, so we'll need that as well. I'll update the debdiffs to use proper DEP-3 and fix up the formatting of the changelogs a bit (CVE- vs CVE: ), and get these building. ** Also affects: libvirt (Ubuntu Karmic) Importance:

[Bug 697197] Re: Empty password allows access to VNC in libvirt

2011-02-11 Thread Kees Cook
** Changed in: qemu-kvm (Ubuntu Maverick) Assignee: Ubuntu Security Team (ubuntu-security) = Kees Cook (kees) ** Changed in: qemu-kvm (Ubuntu Lucid) Assignee: Ubuntu Security Team (ubuntu-security) = Kees Cook (kees) ** Changed in: qemu-kvm (Ubuntu Karmic) Importance: Undecided

[Bug 713855] Re: Merge exim4 4.74-1 (main) from Debian experimental (main)

2011-02-09 Thread Kees Cook
This looks pretty good. Can you change 71_exiq_grep_error_on_messages_without_size.patch to use the upstream fix (from that report), drop the From (this should have been Author: with Daniel van Eeden) and add an Origin: line, and finally mention the debian bug # in the changelog? Thanks! **

[Bug 576949] Re: [lucid] LOAD DATA INFILE fails in replication, simple patch available in 5.1.43

2011-02-09 Thread Kees Cook
This looks good; I'll upload it to -proposed now. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-dfsg-5.1 in ubuntu. https://bugs.launchpad.net/bugs/576949 Title: [lucid] LOAD DATA INFILE fails in replication, simple

[Bug 576949] Re: [lucid] LOAD DATA INFILE fails in replication, simple patch available in 5.1.43

2011-02-09 Thread Kees Cook
This has been uploaded to -proposed. Once it has built, please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance! ** Changed in: mysql-dfsg-5.1 (Ubuntu Lucid) Status: Confirmed = Fix

[Bug 713855] Re: Merge exim4 4.74-1 (main) from Debian experimental (main)

2011-02-09 Thread Kees Cook
Thanks! I've uploaded this merge now. ** Changed in: exim4 (Ubuntu) Status: Incomplete = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to exim4 in ubuntu. https://bugs.launchpad.net/bugs/713855 Title: Merge

[Bug 699967] Re: Empty list of plugins/services with hostname containing uppercase letters

2011-02-09 Thread Kees Cook
This has been uploaded to -proposed. Once it has built, please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance! ** Also affects: munin (Ubuntu Maverick) Importance: Undecided

[Bug 706917] Re: ClamAV misses SafeBrowsing option in freshclam.conf

2011-02-04 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. https://bugs.launchpad.net/bugs/706917 Title: ClamAV misses

[Bug 713002] Re: Impossible to disable IPv4

2011-02-04 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in ubuntu. https://bugs.launchpad.net/bugs/713002 Title: Impossible to disable

[Bug 695985] Re: /etc/mysql/debian-start exposes debian-sys-maint users password to any users on the box via ps(1)

2011-01-06 Thread Kees Cook
** Visibility changed to: Public ** Changed in: mysql-5.1 (Ubuntu) Status: New = Confirmed ** Changed in: mysql-5.1 (Ubuntu) Importance: Undecided = Medium -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-5.1 in

[Bug 691414] Re: clamav taking extremely long time to load database

2010-12-22 Thread Kees Cook
I can confirm as well, the long load times are gone and I'm able to scan incoming email again. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. https://bugs.launchpad.net/bugs/691414 Title: clamav taking

[Bug 691345] Re: buffer overflow in tftp

2010-12-16 Thread Kees Cook
** Changed in: tftp-hpa (Ubuntu) Status: New = Fix Committed ** Changed in: tftp-hpa (Ubuntu) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: tftp-hpa (Ubuntu) Importance: Undecided = Medium ** Changed in: netkit-tftp (Ubuntu) Status: New = Confirmed ** Also

[Bug 691345] Re: buffer overflow in tftp

2010-12-16 Thread Kees Cook
** Changed in: netkit-tftp (Ubuntu Natty) Status: Confirmed = Fix Committed ** Changed in: netkit-tftp (Ubuntu Natty) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: netkit-tftp (Ubuntu Natty) Importance: Undecided = Medium -- You received this bug notification because

[Bug 691414] [NEW] clamav taking extremely long time to load database

2010-12-16 Thread Kees Cook
Public bug reported: Binary package hint: clamav # apt-cache policy clamav-daemon clamav-daemon:   Installed: 0.96.3+dfsg-2ubuntu1.0.10.04.2   Candidate: 0.96.3+dfsg-2ubuntu1.0.10.04.2 Since the security update of clamav, the daemon takes multiple minutes to load its virus database, and is

[Bug 688522] Re: [FTBFS] Eucalyptus doesn't build on maverick, with -security pocket enabled

2010-12-13 Thread Kees Cook
** Changed in: eucalyptus (Ubuntu Maverick) Status: New = Invalid ** Changed in: openjdk-6 (Ubuntu Maverick) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to eucalyptus in ubuntu.

[Bug 684874] Re: Merge rabbitmq-server 2.2.0-1 (main) from Debian unstable (main)

2010-12-06 Thread Kees Cook
Based on the comments in bug #506985, I think this delta should have been dropped in maverick (it was only to support pre-lucid upgrades). After looking at the package diffs, this is the only real difference between Ubuntu and Debian now, so I think this bug should be changed from a merge to a

[Bug 611316] Re: Segmentation fault in php5-sybase

2010-12-06 Thread Kees Cook
** Changed in: php5 (Ubuntu) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. https://bugs.launchpad.net/bugs/611316 Title: Segmentation fault in php5-sybase --

[Bug 43574] Re: Needs Ubuntu-style init script

2010-12-06 Thread Kees Cook
Thanks, this looks good. I'll upload shortly. ** Changed in: xinetd (Ubuntu) Status: In Progress = Fix Committed ** Changed in: xinetd (Ubuntu) Assignee: (unassigned) = Scott Moser (smoser) -- You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 671672] [NEW] Sync krb5 1.8.3+dfsg-2 (main) from Debian unstable (main)

2010-11-05 Thread Kees Cook
kdc before x display managers, Closes: #588536 -- Sam Hartman hartm...@debian.org Thu, 05 Aug 2010 12:15:50 -0400 -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Kees Cook k...@outflux.net iQIcBAEBCgAGBQJM1JULAAoJEIly9N/cbcAmGMsP/RaoAMd60/WBWDkBJJnSjsu2

[Bug 655442] Re: memory content leak when using invalid utf-8 with XMLWriter::writeAttribute

2010-10-06 Thread Kees Cook
I've also reported this to libxml2, in case it should be fixed there instead. https://bugzilla.gnome.org/show_bug.cgi?id=631551 ** Bug watch added: GNOME Bug Tracker #631551 https://bugzilla.gnome.org/show_bug.cgi?id=631551 -- memory content leak when using invalid utf-8 with

[Bug 655442] Re: memory content leak when using invalid utf-8 with XMLWriter::writeAttribute

2010-10-06 Thread Kees Cook
** Package changed: php5 (Ubuntu) = libxml2 (Ubuntu) ** Also affects: libxml2 via https://bugzilla.gnome.org/show_bug.cgi?id=631551 Importance: Unknown Status: Unknown -- memory content leak when using invalid utf-8 with XMLWriter::writeAttribute

[Bug 655442] [NEW] memory content leak when using invalid utf-8 with XMLWriter::writeAttribute

2010-10-05 Thread Kees Cook
*** This bug is a security vulnerability *** Public security bug reported: Binary package hint: php5 It seems that PHP is not correctly using libxml2's xmlwriter routines, and allows passing in invalid utf-8 strings which are then misparsed by libxml2, allowing memory contents to leak into the

[Bug 655442] Re: memory leak when using invalid utf-8 with XMLWriter::writeAttribute

2010-10-05 Thread Kees Cook
** Attachment added: xmlwriter.php https://bugs.edge.launchpad.net/ubuntu/+source/php5/+bug/655442/+attachment/1674325/+files/xmlwriter.php ** Changed in: php5 (Ubuntu) Status: New = Confirmed ** Changed in: php5 (Ubuntu) Importance: Undecided = Low ** Summary changed: - memory

[Bug 655442] Re: memory content leak when using invalid utf-8 with XMLWriter::writeAttribute

2010-10-05 Thread Kees Cook
Appears broken all the way back through Hardy. Dapper behaves correctly. ** Bug watch added: bugs.php.net/ #52998 http://bugs.php.net/bug.php?id=52998 ** Also affects: php via http://bugs.php.net/bug.php?id=52998 Importance: Unknown Status: Unknown -- memory content leak when

[Bug 644009] Re: package nagios3-common 3.0.6-2ubuntu1.1 failed to install/upgrade: subprocess post-installation script returned error exit status 1

2010-10-01 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Tags added: jaunty -- package nagios3-common 3.0.6-2ubuntu1.1 failed to install/upgrade: subprocess post-installation script returned error exit status 1 https://bugs.launchpad.net/bugs/644009 You

[Bug 647600] Re: package mysql-server-5.0 (not installed) failed to install/upgrade: subprocess new pre-installation script returned error exit status 1

2010-10-01 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Tags added: karmic -- package mysql-server-5.0 (not installed) failed to install/upgrade: subprocess new pre-installation script returned error exit status 1 https://bugs.launchpad.net/bugs/647600

[Bug 616759] Re: CVE-2009-3555 tracking bug

2010-09-17 Thread Kees Cook
I can confirm that the firefox CVE-2009-3555 warnings go away once these packages are installed on Lucid. Additionally, I tested that sasl and dovecot still work as expected. Awesome. :) -- CVE-2009-3555 tracking bug https://bugs.launchpad.net/bugs/616759 You received this bug notification

[Bug 623144] Re: chkutmp assert failure: *** stack smashing detected ***: ./chkutmp terminated

2010-08-27 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- chkutmp assert failure: *** stack smashing detected ***: ./chkutmp terminated https://bugs.launchpad.net/bugs/623144 You received this bug notification because you are a member of Ubuntu Server

[Bug 578922] Re: mysql configuration should be adjusted to help prevent against chained attacks against LAMP stack

2010-06-04 Thread Kees Cook
** Changed in: apparmor (Ubuntu) Importance: Undecided = Medium ** Changed in: mysql-dfsg-5.1 (Ubuntu) Importance: Undecided = Medium ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) = Jamie Strandboge (jdstrand) -- mysql configuration should be adjusted to help prevent

[Bug 331410] Re: CVE-2008-6123: not fixed in latest security releases

2010-06-02 Thread Kees Cook
** Changed in: net-snmp (Ubuntu Lucid) Status: Fix Committed = Fix Released -- CVE-2008-6123: not fixed in latest security releases https://bugs.launchpad.net/bugs/331410 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to net-snmp in

[Bug 331410] Re: CVE-2008-6123: not fixed in latest security releases

2010-06-02 Thread Kees Cook
https://lists.ubuntu.com/archives/ubuntu-security- announce/2010-June/001098.html -- CVE-2008-6123: not fixed in latest security releases https://bugs.launchpad.net/bugs/331410 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to net-snmp in

[Bug 331410] Re: CVE-2008-6123: not fixed in latest security releases

2010-06-01 Thread Kees Cook
Hi! Thanks for the report. It looks like this wasn't triaged correctly when we first looked at it. We'll get this fixed and published. Thanks for the patches and for testing it. ** Also affects: net-snmp (Ubuntu Karmic) Importance: Undecided Status: New ** Also affects: net-snmp

[Bug 331410] Re: CVE-2008-6123: not fixed in latest security releases

2010-06-01 Thread Kees Cook
Ah-ha, I see the problem now. This vulnerability was introduced after all the versions of net-snmp that were in the archive at the time the CVE was published. At some point Debian packaged the 5.4.x series from a point that did not include the fix, which is why only Lucid and later have the

[Bug 573222] Re: [SRU] php5 session.save_path moved to /tmp

2010-05-13 Thread Kees Cook
I can confirm that the sess_* files have moved back to /var/lib/php5. Thanks! -- [SRU] php5 session.save_path moved to /tmp https://bugs.launchpad.net/bugs/573222 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. --

[Bug 573206] [NEW] upstart script does not load AppArmor profile

2010-05-01 Thread Kees Cook
Public bug reported: mysql is starting before apparmor, so it must load the apparmor profile on its own. On a fresh Lucid install with mysql, aa-status will report: 1 processes are unconfined but have a profile defined. /usr/sbin/mysqld (1346) ** Affects: mysql-dfsg-5.1 (Ubuntu)

[Bug 573206] Re: upstart script does not load AppArmor profile

2010-05-01 Thread Kees Cook
The following should fix it... ** Patch added: mysql-dfsg-5.1_5.1.41-3ubuntu12.1.debdiff http://launchpadlibrarian.net/47035494/mysql-dfsg-5.1_5.1.41-3ubuntu12.1.debdiff -- upstart script does not load AppArmor profile https://bugs.launchpad.net/bugs/573206 You received this bug

[Bug 573222] Re: php5 session.save_path moved to /tmp

2010-05-01 Thread Kees Cook
** Package changed: apparmor (Ubuntu Lucid) = php5 (Ubuntu Lucid) ** Changed in: php5 (Ubuntu Lucid) Status: New = Confirmed ** Changed in: php5 (Ubuntu Lucid) Importance: Undecided = Medium ** Changed in: php5 (Ubuntu Maverick) Status: New = Confirmed ** Changed in: php5

[Bug 544545] Re: rngd doesn't start automatically

2010-04-23 Thread Kees Cook
** Changed in: rng-tools (Ubuntu) Assignee: (unassigned) = Kees Cook (kees) -- rngd doesn't start automatically https://bugs.launchpad.net/bugs/544545 You received this bug notification because you are a member of Ubuntu Server Team, which is a direct subscriber. -- Ubuntu-server-bugs

[Bug 177195] Re: php5-cgi crashed with SIGSEGV in realpath@@GLIBC_2.3()

2010-04-21 Thread Kees Cook
** Description changed: Binary package hint: php5 Code that worked great on another server causes segfaults on a freshly installed Gutsy 64-bit server ProblemType: Crash Architecture: amd64 Date: Tue Dec 18 18:08:58 2007 DistroRelease: Ubuntu 7.10 ExecutablePath:

[Bug 550343] Re: openvpn crashed with SIGSEGV

2010-04-21 Thread Kees Cook
** Description changed: Binary package hint: openvpn I was booting up my ubuntu 10.04 system. ProblemType: Crash DistroRelease: Ubuntu 10.04 Package: openvpn 2.1.0-1ubuntu1 ProcVersionSignature: Ubuntu 2.6.32-17.26-generic 2.6.32.10+drm33.1 Uname: Linux 2.6.32-17-generic

[Bug 562635] [NEW] Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main)

2010-04-13 Thread Kees Cook
/Linux) Comment: Kees Cook k...@outflux.net iEYEARECAAYFAkvE9U8ACgkQH/9LqRcGPm1gggCeJOzyEaInHrty4J749iFQNVzi daEAnAu1Y5V9xz5gEs3ToR02yzCmm5Jd =i9Xn -END PGP SIGNATURE- ** Affects: krb5 (Ubuntu) Importance: Wishlist Status: Confirmed -- Sync krb5 1.8.1+dfsg-2 (main) from

[Bug 562261] Re: Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main)

2010-04-13 Thread Kees Cook
While I'm not ubuntu-release or ubuntu-archive, I vote +1 for this into Lucid :) -- Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main) https://bugs.launchpad.net/bugs/562261 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to krb5 in

[Bug 562635] Re: Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main)

2010-04-13 Thread Kees Cook
*** This bug is a duplicate of bug 562261 *** https://bugs.launchpad.net/bugs/562261 ** This bug has been marked a duplicate of bug 562261 Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main) -- Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main)

[Bug 562261] Re: Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main)

2010-04-13 Thread Kees Cook
I have confirmed that nothing in main uses krb5_init_creds_step() besides krb5 itself. -- Sync krb5 1.8.1+dfsg-2 (main) from Debian unstable (main) https://bugs.launchpad.net/bugs/562261 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to

[Bug 556819] Re: Can i run GNOME ( graphical user interface) on cloud machine ?

2010-04-09 Thread Kees Cook
Thanks for your comments. This does not appear to be a bug report and we are closing it. We appreciate the difficulties you are facing, but it would make more sense to raise your question in the support tracker. Please visit https://answers.launchpad.net/ubuntu/+addquestion ** Visibility changed

[Bug 556687] Re: Can i run GNOME ( graphical user interface) on cloud machine ?

2010-04-09 Thread Kees Cook
Thanks for your comments. This does not appear to be a bug report and we are closing it. We appreciate the difficulties you are facing, but it would make more sense to raise your question in the support tracker. Please visit https://answers.launchpad.net/ubuntu/+addquestion ** Visibility changed

[Bug 556167] Re: vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2010-04-06 Thread Kees Cook
** Also affects: parted (Ubuntu) Importance: Undecided Status: New -- vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted) https://bugs.launchpad.net/bugs/556167 You received this bug

[Bug 556167] Re: vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2010-04-06 Thread Kees Cook
Incorrect but functional hack attached... ** Patch added: embedding-area-hack.patch http://launchpadlibrarian.net/43294626/embedding-area-hack.patch -- vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by

[Bug 556167] [NEW] vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2010-04-05 Thread Kees Cook
Public bug reported: parted uses a fixed sector count of 32 when writing partitions to a non-block device. (See init_file() via linux_new() in libparted/arch/linux.c) As a result, the track size of disks created with vmbuilder is 32 sectors, not the generally expected 63 sectors (used with LBA

[Bug 423252] Re: NSS using LDAP on Karmic breaks 'su' and 'sudo'

2010-03-24 Thread Kees Cook
It would help to understand if the problem is with eglibc, sudo, or libnss-ldap. ** Package changed: glibc (Ubuntu) = eglibc (Ubuntu) ** Also affects: libnss-ldap (Ubuntu) Importance: Undecided Status: New ** Also affects: eglibc (Ubuntu Lucid) Importance: Undecided Status:

[Bug 461829] Re: Disallowed command //usr/share/eucalyptus/populate_arp.pl

2010-03-23 Thread Kees Cook
+1, sorry I missed this bug for so long. ** Changed in: eucalyptus (Ubuntu Lucid) Assignee: Dustin Kirkland (kirkland) = (unassigned) -- Disallowed command //usr/share/eucalyptus/populate_arp.pl https://bugs.launchpad.net/bugs/461829 You received this bug notification because you are a

[Bug 292971] Re: nscd leaking memory using libnss-ldap

2010-03-18 Thread Kees Cook
** Also affects: libnss-ldap (Ubuntu Hardy) Importance: Undecided Status: New ** Also affects: libnss-ldap (Ubuntu Intrepid) Importance: Undecided Status: New ** Also affects: libnss-ldap (Ubuntu Jaunty) Importance: Undecided Status: New ** Also affects:

[Bug 540596] [NEW] NX memory not simulated for ARMv7 and above CPUs

2010-03-17 Thread Kees Cook
Public bug reported: Binary package hint: qemu-kvm The ARM emulation in qemu does not appear to correctly simulate non- executable memory for the CPUs that support it (ARMv7, maybe v6, and above). ** Affects: qemu-kvm (Ubuntu) Importance: Undecided Status: New -- NX memory not

[Bug 103010] Re: qemu no tun/tap networking

2010-03-09 Thread Kees Cook
@Chris Yup, I understand how capabilities work. I'm actively working on getting fscaps functioning with Debian/Ubuntu packaging (see https://wiki.ubuntu.com/Security/FilesystemCapabilties). (You seemed to miss me changing ep to ei in the wiki -- I've added the old instructions back and clarified

[Bug 103010] Re: qemu no tun/tap networking

2010-03-08 Thread Kees Cook
Please see https://help.ubuntu.com/community/KVM/Networking for a discussion of the issue. (Basically, it is unsafe to ship it this way as it gives any local user the ability to disrupt networking.) ** Changed in: qemu-kvm (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) =

[Bug 529411] Re: package postfix 2.6.5-3 failed to install/upgrade: alamprotsess installed post-installation script tagastas l?petamisel veakoodi 75

2010-03-02 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Package changed: postfix (Ubuntu) = dpkg (Ubuntu) ** Tags added: karmic ** Package changed: dpkg (Ubuntu) = postfix (Ubuntu) -- package postfix 2.6.5-3 failed to install/upgrade: alamprotsess

[Bug 530555] Re: package clamav-freshclam 0.95.3+dfsg-1ubuntu0.09.10 failed to install/upgrade: subprocess installed post-installation script returned error exit status 100

2010-03-02 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Tags added: karmic -- package clamav-freshclam 0.95.3+dfsg-1ubuntu0.09.10 failed to install/upgrade: subprocess installed post-installation script returned error exit status 100

[Bug 429443] Re: /usr/bin/kvm-ok should be disassociated from kvm

2010-03-01 Thread Kees Cook
This is sensible. If too much detection stuff like this ends up in update-notifier, I suspect we can just create a new package called cpu- checker, which is the bzr tree I've current got the check-bios-nx code and test suite in. On another note, I would like to see kvm-ok improved somehow so

  1   2   3   >