Re: [arm64] secure boot breach via VFIO_NOIOMMU

2023-12-14 Thread Steve McIntyre
d >https://salsa.debian.org/kernel-team/linux/-/merge_requests/502#note_315464 > >The proposed patch felt probably trough the cracks. Nod. -- Steve McIntyre, Cambridge, UK.st...@einval.com The two hard things in computing: * naming things * cache invalidation * off-by-one errors -- Stig Sandbeck Mathisen

DSA-5332 Missing from your cross references page

2023-08-25 Thread Mouer, Steve
is missing: https://security-tracker.debian.org/tracker/DSA-5332-1 Can you tell us whether there is a reason for this, or has this just been missed? If missed, would it be possible to get this data added please? Regards, Steve

[SECURITY] [DSA 5280-1] grub2 security update

2022-11-15 Thread Steve McIntyre
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5280-1 secur...@debian.org https://www.debian.org/security/ Steve McIntyre November 15, 2022

Re: Problems with shim and shim-signed in unstable, and proposed solutions to unblock us

2019-03-06 Thread Steve McIntyre
On Mon, Mar 04, 2019 at 04:30:46PM +, Steve McIntyre wrote: >> >>3. Upload new version of the shim-signed source package and a >> (lightly) bodged binary package >>3a. Use versions: >> - source: 1.28+nmu2 >> - binary

Re: Problems with shim and shim-signed in unstable, and proposed solutions to unblock us

2019-03-04 Thread Steve McIntyre
I've had a reply from Mark (ftpteam) in IRC: On Sun, Mar 03, 2019 at 11:35:45PM +, Steve McIntyre wrote: ... >So, we're looking at three hacky options options here to work our way >out of this hole. In (probably?) descending order of hackitude: > >1. Ask the nice ftpm

Re: powerpc update for amd64

2018-03-04 Thread Steve Kemp
ilable architectures, even if the changes are not useful / relevant for them. Typically security updates apply to all architectures. In this case just be glad you got "lucky" - and you don't have to schedule reboot(s) of all your server(s). Steve -- https://steve.fi/

Re: [SECURITY] [DSA 3074-2] php5 regression update

2014-11-19 Thread Steve Kemp
). Take a look at /etc/sysctl.conf, and the comments at the top of that file pointing to the man-page and other locations. Steve -- Git-based DNS hosting https://dns-api.com/ -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Re: about bash and Debian Lenny

2014-10-02 Thread Steve
to be What is your budget?.. Steve -- http://www.steve.org.uk/

Re: goals for hardening Debian: ideas and help wanted

2014-04-24 Thread Steve Langasek
of the box. If you found it otherwise, I think you should be filing a bug report against apparmor. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer

Re: [SECURITY] [DSA 2521-1] libxml2 security update

2012-08-04 Thread Steve Dispensa
My guess is libpfhttphook is not vulnerable. I'd like to hear from someone else tho. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=679280 -Steve Sent from my phone On Aug 4, 2012, at 12:31, Moritz Muehlenhoff j...@debian.org wrote: CVE-2012-2807 -- To UNSUBSCRIBE, email to debian

Re: Logs errors on Debian Squeeze with Bind 9.7.3

2011-06-28 Thread Steve Suehring
, or so I've gathered. Steve http://www.braingia.org/ On Tue, Jun 28, 2011 at 01:13:31PM -0300, OLCESE, Marcelo Oscar. wrote: Good morning people Since I upgraded to BIND 9.7.3 Debian 6, I'm having a lot of logs as I've outlined. error (network unreachable) resolving '98.31.207.117

Re: [SECURITY] [DSA-2158-1] cgiirc security update

2011-02-11 Thread Steve Kemp
occurring during the middle of the preparation and release of the update. I'm uploading for lenny/old-security now. Steve -- Debian GNU/Linux System Administration http://www.debian-administration.org/ -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject

Re: Results of environment variable fuzzing Debian 5.05 SUID/SGIDs

2011-01-18 Thread Steve Kemp
On Tue Jan 18, 2011 at 13:49:23 +1100, Silvio Cesare wrote: lbreakout2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608980 That could well be a duplicate of CAN-2004-0158, which was fixed in Woody: http://lists.debian.org/debian-changes/2004/02/msg00029.html Steve -- http

Re: Results of environment variable fuzzing Debian 5.05 SUID/SGIDs

2011-01-18 Thread Steve Kemp
started doing the same thing a few years ago, and it was very useful. However to make your reports more thorough it is important to look at the source of the code to see if the crash is an exploitable one or not. Ideally you'd include that information in any bug reports you submitted. Steve

Re: libapache2-mod-fcgid in lenny vulnerable to hole for weeks

2010-12-23 Thread Steve Kemp
for new volunteers soon. If there were a need for it I'd be happy to make myself available again for team work. I don't expect I'm going to suffer from being busy in the way that I was previously again. Steve -- http://www.steve.org.uk/ -- To UNSUBSCRIBE, email to debian-security-requ

Re: rkhunter warning wget

2009-10-15 Thread Steve Kemp
: 1220829421 You've applied a security update, which has changed the binary /usr/bin/wget. The alert is telling you that the binary has changed, and since this is expected (because you've applied the security update) the alert is informational not a real report. Steve -- Debian GNU/Linux System

Re: Maintaining packages properly

2009-03-19 Thread Steve Kemp
then it is definitely time to call it a day and cease pretending we have auditors on hand. Steve -- Managed Anti-Spam Service http://mail-scanning.com/ -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Re: Why is su preserving the environment?

2009-01-24 Thread Steve Langasek
? Because su does not attempt to control what commands are being run; if you can su to another user, you can run arbitrary commands as that user, which means there's no sense in trying to filter the environment. -- Steve Langasek Give me a lever long enough and a Free OS Debian

Re: [SECURITY] [DSA-1645-1] New lighttpd packages fix various problems

2008-10-06 Thread Steve Kemp
On Mon Oct 06, 2008 at 20:40:36 +0200, Gerfried Fuchs wrote: From reading the changelog these issues have all three been addressed in the 1.4.19-5 upload which was done a week ago already. Was this missed, or are the patches therein considered incomplete? This was missed. Steve

Re: Bug#311772: Fwd: Password leaks are security holes

2008-08-28 Thread Steve Langasek
module or something similar to get your login credentials. No, that's not true. The only added permission the 'adm' group has on Debian is to be able to read log files; so this *does* expose passwords to users who wouldn't otherwise be able to get at them. -- Steve Langasek

Re: [SECURITY] [DSA 1631-1] New libxml2 packages fix denial of service

2008-08-26 Thread Steve Kemp
On Tue Aug 26, 2008 at 20:13:58 +0200, Christoph Auer wrote: Debian Security Advisory DSA-1631-_2_ [EMAIL PROTECTED] minor error in the subject My apologises, I managed to miss that. Steve -- Managed Anti-Spam Service http://mail-scanning.com/ -- To UNSUBSCRIBE

Re: [SECURITY] [DSA 1631-1] New libxml2 packages fix denial of service

2008-08-22 Thread Steve Kemp
is the same. On my personal Debian Unstable machine I'm not seeing any breakage - nor on my Etch system. It is possible it is soley broken on Lenny, but I don't have any systems to look at. I see you've reported a bug, so I guess we'll take it from there. Steve -- Managed Anti-Spam Service

Re: securing server

2008-05-07 Thread Steve
issues, I guess this is totally useless since any (good) port scanner will defeat this without any problem. Remember, security by obscurity is a bad idea. -- Steve -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: securing server

2008-05-07 Thread Steve
the attacks will really start. you are smart, you should have known all this. Just tried to pinpoint an issue. Best regards -- Steve -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 1534-2] New iceape packages fix regression

2008-04-25 Thread Steve Kemp
On Thu Apr 24, 2008 at 14:13:14 -0700, Brad Dondale wrote: I have started 2 weeks holidays. If you have any technical support requests, please create a ticket with your online ticket system. Thanks! Please fix your broken auto-responding system. Steve -- Debian GNU/Linux System

Re: Is oldstable security support duration something to be proud of?

2008-03-10 Thread Steve Kemp
agrees or not. As has already been hashed out on the debian-www list. Steve -- http://www.steve.org.uk/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [vendor-sec] Re: qemu unchecked block read/write vulnerability

2008-02-19 Thread Steve Kemp
sure we get mails if it looks like there is no visible progress.) I hope that doesn't make you feel any worse! Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: strange output for command ps

2008-01-30 Thread Steve Suehring
This looks normal to me. I believe 'ps' cuts off the USER column after a certain number of characters. To test, I just added a user 'stevesuehring' to a local Debian etch box and then logged in as that user. The ps output shows 1002 in the USER column rather than the name. Steve On Wed

Re: [SECURITY] [DSA 1465-1] New apt-listchanges packages fix arbitrary code execution

2008-01-17 Thread Steve Kemp
On Thu Jan 17, 2008 at 16:35:47 +0100, Philipp Kern wrote: Still that breaks because os is not imported. Please fix. Quickly. Done. Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject

Re: [SECURITY] [DSA 1448-1] New eggdrop packages fix execution of arbitrary code

2008-01-05 Thread Steve Kemp
On Sat Jan 05, 2008 at 15:11:22 +, Steve Kemp wrote: - Debian Security Advisory DSA-1448-1 [EMAIL PROTECTED] http://www.debian.org/security/ Steve Kemp January 05, 2008

Re: ping22: can not kill this process

2008-01-04 Thread Steve Kemp
/examples). Steve -- http://www.steve.org.uk/ pgpiQG2VvWmON.pgp Description: PGP signature

Re: [SECURITY] [DSA 1422-1] New e2fsprogs packages fix arbitrary code execution

2007-12-07 Thread Steve Kemp
? or has sarge been archived and i missed the announcement? Sarge is affected, but I don't yet have a working patch for that. There should be an update shortly, but this is pretty low-risk and it seemed sensible to release now, rather than waiting. Steve -- -- To UNSUBSCRIBE, email

Re: [SECURITY] [DSA 1422-1] New e2fsprogs packages fix arbitrary code execution

2007-12-07 Thread Steve Kemp
for Sid/Ubuntu. If there are missing bits then we'll need to reissue the update, but right now I believed the patch was as complete as it needed to be. Sorry, this mail was originally only addressed to Steve but since I also got this mail through the debian-security list it ended up here

Re: UNS: Re: [SECURITY] [DSA 1409-2] New samba packages fix several vulnerabilities

2007-11-27 Thread Steve Kemp
On Tue Nov 27, 2007 at 12:00:05 +1300, Ewen McNeill wrote: In message [EMAIL PROTECTED], Steve Kemp writes: Package: samba Vulnerability : several Problem type : remote Debian-specific: no CVE Id(s) : CVE-2007-4572, CVE-2007-5398 [...] For the stable distribution (etch

Re: Firewall with woody

2007-10-17 Thread Steve Kemp
to be security-relevant bugs present in your host(s). Do I have to upgrade the version any time a new one is release? You don't need to. We can't force you. But you should strongly consider the benefits of running a stable supported version of Debian which receives security fixes. Steve

Re: [SECURITY] [DSA 1379-1] New quagga packages fix denial of service

2007-10-04 Thread Steve Kemp
On Thu Oct 04, 2007 at 09:49:27 +0200, Etienne Favey wrote: In what respect is the quagga problem related to the openssl problem, that it gets the same DSA ID number? It was a mistake, the number was reused by accident. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED

Re: [SECURITY] [DSA 1376-1] New kdebase packages fix authentication bypass

2007-09-21 Thread Steve Kemp
to satisfy itself: eg. kappfinder_3.5.5a.dfsg.1-6etch1_amd64.deb kate_3.5.5a.dfsg.1-6etch1_amd64.deb (Same thing for fetchmail/fetchmailconf.) Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 1376-1] New kdebase packages fix authentication bypass

2007-09-21 Thread Steve Kemp
and there aren't any i386 binary packages for it available. Noah has kindly volunteered to build complete packages for i386, so I'd expect this situation to be resolved in the next few hours. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL

Re: [SECURITY] [DSA 1376-1] New kdebase packages fix authentication bypass

2007-09-21 Thread Steve Kemp
On Fri Sep 21, 2007 at 11:45:37 -0400, Noah Meyerhans wrote: Check i386. The security archive does not seem to have a complete set of i386 binary packages... Stupid buildds .. I'll find a spare i386 machine and build for that over the weekend all being well. Steve

Re: [SECURITY] [DSA 1376-1] New kdebase packages fix authentication bypass

2007-09-21 Thread Steve Kemp
On Fri Sep 21, 2007 at 19:18:38 +0300, Riku Valli wrote: fetchmailconf have similar problem too. That should be fixed now. I'm just going to send out the mail ... Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: security.d.o packages for etch built on sarge

2007-06-30 Thread Steve Kemp
checked the build-logs I've got access to (all except i386) and they seem fine. is it just i386 you see this behavior upon? Do other people see this too, or is it a potentially broken system you're installing upon (I have to ask; some people still have mixed sources.lists files..) Steve

Re: an issue with recent security advisories

2007-06-18 Thread Steve Kemp
only receive new updates for point releases of Etch. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 1266-1] New gnupg packages fix signature forgery

2007-03-14 Thread Steve Langasek
1.4.6-2 was a candidate for inclusion in etch. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. [EMAIL PROTECTED] http://www.debian.org/ -- To UNSUBSCRIBE, email

Re: Bug#401969: please build using hunspell

2006-12-09 Thread Steve Kemp
be difficult; especially if we don't know about it in advance.) Steve -- signature.asc Description: Digital signature

Re: Mass update deployment strategy

2006-11-27 Thread Steve Kemp
? cfengine. I'm interested in puppet, but it wasn't (isn't yet?) stable at the time I started automation on a decent sized farm. Steve -- Debian GNU/Linux System Administration http://www.debian-administration.org/ signature.asc Description: Digital signature

Re: [TGSysadmin] [SECURITY] [DSA 1155-1] New sendmail packages fix denial of service

2006-08-24 Thread Steve Kemp
in errata reports. All DSA notices have a description like that. These descriptions come from the package itself. eg: [EMAIL PROTECTED]:~$ apt-cache show sendmail | grep Desc Description: powerful, efficient, and scalable Mail Transport Agent Steve -- Debian GNU/Linux System Administration

Re: editing new known_hosts files

2006-07-22 Thread Steve Kemp
the known_hosts file? You can't decrypt them, but you can delete all entries for a given host with: ssh-keygen -R host.name See the manpage for ssh-keygen for details. (Search for hash to see the relevent options.) Steve -- Debian GNU/Linux System Administration http://www.debian

Re: BADSIG verifying s.d.o Release file

2006-06-30 Thread Steve Kemp
invalid: BADSIG 010908312D230C5F Debian Archive Automatic Signing Key (2006) [EMAIL PROTECTED] This is a known issue, relating to some of the infrastructure changes. Hopefully it will be resolved shortly. Currently each of the release files are empty... Steve -- signature.asc Description

Re: BADSIG verifying s.d.o Release file

2006-06-30 Thread Steve Kemp
On Fri, Jun 30, 2006 at 10:33:55AM +0200, martin f krafft wrote: also sprach Steve Kemp [EMAIL PROTECTED] [2006.06.30.1004 +0200]: This is a known issue, relating to some of the infrastructure changes. Hopefully it will be resolved shortly. Thanks Steve. Do you know why

Re: Command history log for audit trail

2006-06-15 Thread Steve Kemp
to create a log for all commands run on a system? Use the 'snoopy' package, as described here: http://www.debian-administration.org/articles/88 Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Debian Kernel security status?

2006-04-21 Thread Steve Kemp
, or there is a lot of demand, it may be possible to continue supporting it for a little longer. Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit signature.asc Description: Digital signature

Re: security issues with apache!

2006-03-12 Thread Steve Kemp
', 'perl' etc in requests via mod_security is a much more useful thing to do. Steve -- Debian GNU/Linux System Administration http://www.debian-administration.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Another problem with gnupg

2006-03-10 Thread Steve Kemp
shortly - new packages are already in the queue. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [gna-private] [SECURITY] [DSA 987-1] New tar packages fix arbitrary code execution

2006-03-08 Thread Steve Kemp
from a remote source. Steve -- Debian GNU/Linux System Administration http://www.debian-administration.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: first A record of security.debian.org extremely slow

2006-03-02 Thread Steve Kemp
On Thu, Mar 02, 2006 at 10:36:16PM +0100, Marc Haber wrote: How would you implement the automatism to trigger the update on the incoming e-mail? procmail, matching on new mails to the debian-security-announce mailing list .. Steve -- Debian GNU/Linux System Administration http

Re: CVE-2006-0225, scponly shell command possible

2006-02-15 Thread Steve Kemp
. Steve -- Debian GNU/Linux System Administration http://www.debian-administration.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Removing email addresses from gpg-key?

2006-01-24 Thread Steve Kemp
for that. Obvious once you said it too! I've revoked the obsolete email addresses and uploaded again now. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 945-1] New antiword packages fix insecure temporary file creation

2006-01-17 Thread Steve Kemp
' to the string, but for some reason I've updated the minor too. Definitely something I'll be careful to avoid in the future. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

2006-01-09 Thread Steve Kemp
who are at risk; and we don't offer explicit security support there. (Though obviously it should be fixed ASAP.) Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: hardening checkpoints

2005-12-21 Thread steve
an ID (they do a photocopy of it; she couldn't tell me how long they keep it..) to be able to use a computer in an Internet Café (terrorism you know...). Sorry ;-) Greetings Michelle Have a nice day -- steve jabber : [EMAIL PROTECTED]

Re: hardening checkpoints

2005-12-21 Thread steve
Le Mercredi, 21 Décembre 2005 12.40, Johannes Wiedersich a écrit : steve wrote: Le Mardi, 20 Décembre 2005 16.18, Michelle Konzack a écrit : But in ALL Internet Cafes I can use my own (selfmade) Debian Live-System with my prefered Desktop. In all Internet Cafes i get an IP via DHCP

Re: Restricting ssh access to internet but not to internal network

2005-11-25 Thread Steve Suehring
from externally so that the internal-use daemon can't be accessed. Hope that helps. I'm sure others will have ideas too. Steve On Thu, Nov 24, 2005 at 10:14:11PM -0800, Patrick wrote: I have an server running sshd on Sarge. I want all users to be able to access the computer from within

Re: What is a security bug?

2005-11-23 Thread Steve Kemp
badly formed input HTML. They were not treated as security bugs which suprised me at the time. Steve -- signature.asc Description: Digital signature

Re: PMASA-2005-6 when register_globals = on

2005-11-15 Thread Steve Kemp
in Debian package by default so I doubt if this is serious problem. I'd like to ask if I should prepare the new package for sarge or not? I think an upload would be justified. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: What's going on with advisory for phpmyadmin?

2005-10-28 Thread Steve Kemp
a patch, or a pointer to one. c) Be patient. d) Don't file reports which are already in the BTS. e) Be patient. f) Be patient. All reports are read and responded to *in time*. Be patient. None of this is news. Steve -- signature.asc Description: Digital

Re: What's going on with advisory for phpmyadmin?

2005-10-28 Thread Steve Kemp
waiting for other vendors, upstream etc, is not something that will be helped by more members). Steve -- signature.asc Description: Digital signature

Re: [SECURITY] [DSA 862-1] New Ruby 1.6 packages fix safety bypass

2005-10-11 Thread Steve Kemp
://www.us.debian.org/security/2005/dsa-862 Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

security.debian.org - Infrastructure updates

2005-10-05 Thread Steve Kemp
Hi, Just a quick note to point people at this news annoucement: http://lists.debian.org/debian-news/debian-news-2005/msg00047.html Steve -- signature.asc Description: Digital signature

Re: ClamAV vulnerability

2005-09-26 Thread Steve Kemp
, and should be available shortly. Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: security.debian.org timeouts

2005-09-19 Thread Steve Kemp
On Mon, Sep 19, 2005 at 09:18:29PM +0200, No?l K?the wrote: anybody knows what's the problem with klecker/security.d.o? http://lists.debian.org/debian-curiosa/2005/09/msg00018.html There is an advisory pending ... Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED

Re: Unusual incoming traffic detected from klecker.debian.org and sou rce.rfc822.org

2005-09-14 Thread Steve Kemp
On Wed, Sep 14, 2005 at 10:51:19AM +0200, Mathieu JANIN wrote: I was updating my system at that time, but klecker.debian.org is not in my sources (or perharps with an other name). klecker.debian.org is security.debian.org, which might explain it? Steve -- -- To UNSUBSCRIBE, email

Re: Bad press again...

2005-08-29 Thread Steve Kemp
On Mon, Aug 29, 2005 at 11:46:24AM -0500, Branden Robinson / Debian Project Leader wrote: As far as I know, the stable/oldstable security team was never (recently) down to Joey S. alone. Mike Stone and Steve Kemp have been active members for some time (Steve was, as I understand it, promoted

Re: Bad press again...

2005-08-29 Thread Steve Wray
Florian Weimer wrote: * Michael Stone: Contact the security team. Describe the bug in such a way that the security team understands its severity and impact. It is not sufficient to say just trust me and issue an advisory. From what I've seen so far this is not the obvious buffer overflow sort

Re: Bad press again...

2005-08-29 Thread Steve Wray
Florian Weimer wrote: * Steve Wray: Another example is fwbuilder which *silently* fails to overwrite its generated script at compile time if the user doesn't have write permissions on the existing script. Most bugs in security tools are security bugs. We have to draw a line somewhere

Re: Bad press again...

2005-08-29 Thread Steve Wray
Florian Weimer wrote: * Steve Wray: I view this as a security problem because what if you *think* you've made changes to your firewall and are now protected only... you arn't and the firewall hasn't been updated? Is that enough of a security problem for the fix to get into stable? [snip

Re: On Mozilla-* updates

2005-07-31 Thread Steve Kemp
* fix security holes to distributors. Their line is more upgrade to the newest version. Whilst the new versions do fix the holes, they traditionally also break things built against them, such as extensions, galeon, etc. Which is why we're seeing the problem now. Steve -- -- To UNSUBSCRIBE

Re: a compromised machine

2005-07-24 Thread Steve Kemp
if you have potentially untrusted scripts running. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: My machine was hacked - possibly via sshd?

2005-07-20 Thread Steve Kemp
a known-good media. If not your best option is to try to determine what route the attacker used to get in, make sure you're comfortable you can close it, and then reinstall. Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit -- To UNSUBSCRIBE, email to [EMAIL

Re: Light weight IDSes and then some

2005-07-15 Thread Steve Kemp
can describe some of the pros and cons of each? Simple introduction to both aide, and integrit: http://www.debian-administration.org/articles/49 It doesn't mention tripwire, which is a shame. But I'll try to update it later. Steve -- # The Debian Security Audit Project. http

Re: Timeliness of Debian Security Announceness? (DSA 756-1 Squirrelmail)

2005-07-14 Thread Steve Kemp
eventually. Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 741-1] New bzip2 packages prevent decompression bomb

2005-07-07 Thread steve
Hallo, Ik ben op vakantie tot 20 juli. Voor support vragen kunt u contact opnemen met onze supportdesk. Voor sales en andere vragen kunt u mailen naar [EMAIL PROTECTED] Met vriendelijke groet, Steve Karnadi Hello, I am on vacation until the 20th of July. You can contact our supportdesk

Re: gpg-errors with apt

2005-07-07 Thread Steve Kemp
Find the key that the archive is signed with, import it as you did for the main Sid/Etch archive and all should be well. Is this a bug or how do I solve this problem? Not a bug with the *Debian* archive, but a missing key on your side from the look of things.. Steve -- # The Debian Security

Re: gpg-errors with apt

2005-07-07 Thread Steve Kemp
07DC563D1F41B907 (For keyservers I use: keyring.debian.org pgp.mit.edu pgpkeys.pgp.net wwwkeys.uk.pgp.net or wwwkeys.pgp.net ) Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 742-1] New cvs packages fix arbitrary code execution

2005-07-07 Thread steve
Hallo, Ik ben op vakantie tot 20 juli. Voor support vragen kunt u contact opnemen met onze supportdesk. Voor sales en andere vragen kunt u mailen naar [EMAIL PROTECTED] Met vriendelijke groet, Steve Karnadi Hello, I am on vacation until the 20th of July. You can contact our supportdesk

Re: Firewall-troubleshooting

2005-07-02 Thread Steve Kemp
. (Sure if you had a trojan which phoned home, or tried to compromise other hosts .. it would help. But .. in general it less useful than it appears). Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Bad press related to (missing) Debian security

2005-06-27 Thread Steve Kemp
that is the intended job of a secretary is largely irrelevent. Other jobs like answering mails from people who say Help my server is hacked seem more secreatrial in nature, so I've tried to answer those as time and details permit. Steve -- www.steve.org.uk -- To UNSUBSCRIBE, email to [EMAIL

Re: Bad press related to (missing) Debian security

2005-06-27 Thread Steve Kemp
, but that only a very small number of people have the authority/ability to push the update out. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: getting the MAC address from an ip

2005-06-24 Thread Steve Kemp
If it's a remote host then you cannot Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: debian security archive/updates b0rken???

2005-06-19 Thread Steve Langasek
been published (I wouldn't know, not having access to look on klecker). -- Steve Langasek postmodern programmer signature.asc Description: Digital signature

Re: Please allow drupal 4.5.3-1

2005-06-03 Thread Steve Langasek
On Fri, Jun 03, 2005 at 08:19:22AM +0200, Martin Schulze wrote: Steve Langasek wrote: On Wed, Jun 01, 2005 at 07:16:00PM -0700, Ian Eure wrote: On Wednesday 01 June 2005 04:54 pm, Hilko Bengen wrote: Just a few hours ago, the Drupal project has released version 4.5.3, a bugfix

Re: Please allow drupal 4.5.3-1

2005-06-02 Thread Steve Langasek
, the diff between 4.5.2 and 4.5.3 is rather large and I don't believe it's all security-related, so I think this will have to be left for the security team after all. Thanks, -- Steve Langasek postmodern programmer signature.asc Description: Digital signature

Re: Security issue with 'elog' package

2005-05-03 Thread Steve Langasek
in unstable. Thanks, -- Steve Langasek postmodern programmer signature.asc Description: Digital signature

Re: Apache 1.3.33 (from sarge) and mod_chroot

2005-03-26 Thread Steve Suehring
I've had good luck with nullmailer for just this situation. It's simple and lightweight, works well in chroot. Steve === = Home Page: http://www.braingia.org

Re: Apache 1.3.33 (from sarge) and mod_chroot

2005-03-24 Thread Steve Kemp
it in Sarge. The homepage has lots of documentation, and it includes chroot functionality: http://www.modsecurity.org/ There's a brief introduction here: http://www.debian-administration.org/?article=65 Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject

Re: Analysis vulnerabilities associated to published security advisories, anyone?

2005-03-09 Thread Steve Kemp
/2005/ I'd be interested in average advisories per week, as well as classification on the actual output. (Seems like buffer overflows are still the biggest reported thing for this year - although you've done a good job at showing temporary file issues). Steve -- # The Debian Security Audit

Re: Analysis vulnerabilities associated to published security advisories, anyone?

2005-03-09 Thread Steve Kemp
On Wed, Mar 09, 2005 at 08:05:40PM +0100, David Schmitt wrote: On Wednesday 09 March 2005 19:13, Steve Kemp wrote: A simple script I wrote did that for me already - although there are some fixups required as we seem to have a few different spellings for different things. eg. sanitizing

Re: [ph.unimelb.edu.au #1013] AutoReply: [SECURITY] [DSA 675-1] New hztty packages fix local utmp exploit

2005-02-10 Thread Steve Kemp
On Thu, Feb 10, 2005 at 07:59:35PM +0100, Jasper Filon wrote: maybe someone should kick him off the list? And anybody else who manages to quote the entire text of the DSA for no purpose ..? Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble

Re: [SECURITY] [DSA 671-1] New xemacs21 packages fix arbitrary code execution

2005-02-08 Thread Steve Kemp
users believe that only GNU Emacs is affected, at least it makes GNU Emacs (emacs21) users wonder whether their editor is affected, too. Both Emacs, and XEmacs are affected. Perhaps the wording was a little unfortunate though. Steve -- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED

Re: [Fwd: security]

2005-01-29 Thread Steve Suehring
of this measure but it is another step you can take to help defend the computer. I'm sure others have appropriate suggestions as well. Steve On Sat, Jan 29, 2005 at 03:05:35PM +, michael wrote: On debian-user it was suggested I also post this here, thanks, Michael Forwarded Message

Re: DSA policy change? (posting stopped to full-disclosure ML)

2005-01-27 Thread Steve Kemp
/ filtering? Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

  1   2   3   4   >