[Bug 556167] Re: vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2011-11-07 Thread Kees Cook
The problem is that parted treats local files (as used by vmbuilder) differently from actual disk files, and changes the sector size accordingly (without an option to change it). As a result, the partition start locations are too small for grub2 to install. I had originally reproduced this by

[Bug 556167] Re: vmbuilder uses parted to create disk images, which leads to broken sector counts (cannot use grub2 on disk images created by vmbuilder/parted)

2011-11-16 Thread Kees Cook
Hm, I don't agree. I think the problem is in libparted/arch/linux.c init_file(): dev-bios_geom.sectors = 32; vs _device_probe_geometry() which defaults to what the LBA reports or: dev-bios_geom.sectors = 63; So, when vmbuilder uses parted to build the disk, parted treats the

[Bug 892554] [NEW] SSH keys summary does not report ECDSA key

2011-11-19 Thread Kees Cook
Public bug reported: The final report of SSH key fingerprints does not include ECDSA: $ ec2-get-console-output --region us-west-2 i-107ee921 ... Your identification has been saved in /etc/ssh/ssh_host_rsa_key. Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub. The key fingerprint

Re: [Bug 892554] Re: SSH keys summary does not report ECDSA key

2011-11-21 Thread Kees Cook
What's the best way to add a known_hosts entry from these fingerprints? Maybe the -e option should be used instead of -l ? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cloud-init in Ubuntu. https://bugs.launchpad.net/bugs/892554

Re: [Bug 892554] Re: SSH keys summary does not report ECDSA key

2011-11-22 Thread Kees Cook
the fingerprint report, but instead, allow one to skip the ssh-keyscan step, and just pull the .pub file directly out of the console output. i.e. _add_ it to the console output. -- Kees Cook -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

[Bug 810270] Re: AppArmor profiles need updates for /var/run → /run and /var/lock → /run/lock and /dev/shm → /run/shm

2012-02-24 Thread Kees Cook
If filesystem paths have been relocated, please use /etc/apparmor.d/tunables/alias to handle replacements. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to bind9 in Ubuntu. https://bugs.launchpad.net/bugs/810270 Title: AppArmor

[Bug 966707] [NEW] not built with all hardening features

2012-03-27 Thread Kees Cook
Public bug reported: vsftpd has only a partially hardened build. Debian fixed this, and the solution is trivial. ** Affects: vsftpd (Ubuntu) Importance: Undecided Status: New ** Affects: vsftpd (Ubuntu Precise) Importance: Undecided Status: New ** Tags: patch **

[Bug 966707] Re: not built with all hardening features

2012-03-27 Thread Kees Cook
** Patch added: vsftpd_2.3.5-1ubuntu2.debdiff https://bugs.launchpad.net/ubuntu/+source/vsftpd/+bug/966707/+attachment/2951684/+files/vsftpd_2.3.5-1ubuntu2.debdiff -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to vsftpd in Ubuntu.

[Bug 966707] Re: not built with all hardening features

2012-03-29 Thread Kees Cook
** Changed in: vsftpd (Ubuntu Precise) Status: New = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to vsftpd in Ubuntu. https://bugs.launchpad.net/bugs/966707 Title: not built with all hardening features To

[Bug 501956] Re: OpenSSH does not log failed attempts when key authentication is used

2012-10-14 Thread Kees Cook
** Branch linked: lp:~kees/openssh/report-publickey -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in Ubuntu. https://bugs.launchpad.net/bugs/501956 Title: OpenSSH does not log failed attempts when key authentication is

[Bug 230197] Re: network-manager-openvpn is incapable of supplying openssl-vulnkey with the X.509 key passphrase it requests

2011-04-16 Thread Kees Cook
** Changed in: openvpn (Ubuntu) Assignee: iamn fouda (eman-abu-fouda) = Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openvpn in Ubuntu. https://bugs.launchpad.net/bugs/230197 Title:

[Bug 768707] [NEW] cyrus-sasl2-heimdal uninstallable and ftbfs

2011-04-21 Thread Kees Cook
Public bug reported: cyrus-sasl2-heimdal 2.1.23.dfsg1-5.1ubuntu1 is uninstallable with cyrus- sasl2 2.1.23.dfsg1-5ubuntu3, and ftbfs due to heimdal changes, from what I can see. I suspect the only way forward on this is to get cyrus-sasl2 2.1.23.dfsg1-6 (or, likely, newer) into natty which merges

[Bug 779391] Re: CVE-2011-1764: format string vulnerability

2011-05-08 Thread Kees Cook
** Changed in: exim4 (Ubuntu) Status: New = Triaged -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to exim4 in Ubuntu. https://bugs.launchpad.net/bugs/779391 Title: CVE-2011-1764: format string vulnerability --

[Bug 779391] Re: CVE-2011-1764: format string vulnerability

2011-05-09 Thread Kees Cook
AAaargh. Who reimplements sprintf!? I am working on hardy and dapper now. Will have this uploaded shortly. Thanks for double-checking and getting the Lucid and Oneiric patches ready! At least full ASLR (PIE[1]) is in place in Lucid and later, so exploiting this is difficult, but not impossible.

[Bug 779391] Re: CVE-2011-1764: format string vulnerability

2011-05-09 Thread Kees Cook
** Changed in: exim4 (Ubuntu Oneiric) Importance: Undecided = Medium ** Changed in: exim4 (Ubuntu Lucid) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: exim4 (Ubuntu Maverick) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: exim4 (Ubuntu Natty) Assignee

[Bug 793694] Re: Format string bug in parselog.pl

2011-06-08 Thread Kees Cook
This looks like a regular bug to me. I don't think Perl will deal with the %n in an unsafe way. ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to samba in Ubuntu.

[Bug 800340] Re: [MIR] ipxe

2011-07-19 Thread Kees Cook
This looks fine to me. +1 ** Changed in: ipxe (Ubuntu) Status: New = In Progress ** Changed in: ipxe (Ubuntu) Assignee: Kees Cook (kees) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https

[Bug 817187] Re: change in readlink() errno in 2.6.39 and later kernels causes FTBFS for packages with older gnulib

2011-08-02 Thread Kees Cook
Packages with gnulib in their source: main: augeas binfmt-support eglibc findutils gdb glib2.0 groff grub2 hello hello-debhelper liblouis libpipeline libtasn1-3 libvirt man-db mlocate texinfo universe/multiverse: amanda eiskaltdcpp freedink genparse hivex instantbird libdc0 libdrizzle

[Bug 801501] Re: [MIR] nova

2011-09-12 Thread Kees Cook
Quick notes: * should use /run instead of /var/run * while it's nice to have the sudoers split, the sudoers fragment is wildly permissive (chown as root is trivial to exploit). I would recommend specific helper scripts that validate the logic of the requested dangerous commands (see the

[Bug 801501] Re: [MIR] nova

2011-09-13 Thread Kees Cook
This is a step in the right direction (regex arg filtering is better than filename-glob filtering), but I think this probably needs to have even more logic built in. For example, running ip ... $interface ... might need logic to have the wrapper look up the interface and decide if it is actually a

[Bug 219914] Re: mod_disk_cache enabled globally by default

2008-04-20 Thread Kees Cook
I cannot reproduce this -- on both fresh installs of Hardy and Dapper-Hardy upgrades, the disk_cache module is not enabled. ** Changed in: apache2 (Ubuntu) Status: New = Incomplete -- mod_disk_cache enabled globally by default https://bugs.launchpad.net/bugs/219914 You received this bug

[Bug 230344] Re: bug in ssh-vulnkey - ref USN-612-2

2008-05-14 Thread Kees Cook
*** This bug is a duplicate of bug 230029 *** https://bugs.launchpad.net/bugs/230029 ** This bug has been marked a duplicate of bug 230029 ssh-vulnkey overlooks keys which have options in authorized_keys -- bug in ssh-vulnkey - ref USN-612-2 https://bugs.launchpad.net/bugs/230344 You

[Bug 232390] Re: ssh-keygen still generates compromised keys

2008-05-28 Thread Kees Cook
I assume that something unusual happened in the gutsy openssl update on your system. I can confirm that with libssl0.9.8 version 0.9.8e- 5ubuntu3.2 installed on gutsy I don't have bad key generation. ** Changed in: openssh (Ubuntu) Assignee: (unassigned) = Kees Cook (keescook) Status

[Bug 230632] Re: ssh-vulnkey doesnt check all keys. Also, it would be nice to extend the warning message.

2008-05-28 Thread Kees Cook
) Assignee: (unassigned) = Kees Cook (keescook) Status: New = Won't Fix -- ssh-vulnkey doesnt check all keys. Also, it would be nice to extend the warning message. https://bugs.launchpad.net/bugs/230632 You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 238630] [NEW] Please sync krb5 1.6.dfsg.3-2 (main) from Debian unstable (main).

2008-06-09 Thread Kees Cook
SIGNATURE- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Kees Cook [EMAIL PROTECTED] iEYEARECAAYFAkhNbvcACgkQH/9LqRcGPm2DEgCfeuNt4HaiPLLVZpe7GElvUQy8 0NwAmwXyFuK4qIhUcwlMHxixYhSou9Ei =IB5H -END PGP SIGNATURE- ** Affects: krb5 (Ubuntu) Importance: Wishlist Status: Confirmed

[Bug 239894] Re: CVE-2008-2364 Apache2 mod_proxy_http.c DOS

2008-06-17 Thread Kees Cook
** Changed in: apache2 (Ubuntu) Status: In Progress = Fix Released -- CVE-2008-2364 Apache2 mod_proxy_http.c DOS https://bugs.launchpad.net/bugs/239894 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in ubuntu. --

[Bug 246702] Re: [CVE-2008-1447] Randomize DNS query source ports to prevent cache poisoning

2008-07-08 Thread Kees Cook
Thanks for the report. Ubuntu is already in the process of publishing fixes for these issues. They should be visible in the archive shortly. ** Changed in: glibc (Ubuntu) Importance: Undecided = Medium Assignee: (unassigned) = Kees Cook (kees) Status: New = Confirmed ** Changed

[Bug 236869] Re: [php5][CVE-2007-2748] substr_count function allows context-dependent attackers to obtain sensitive information vi unspecified vectors

2008-07-15 Thread Kees Cook
Ubuntu (and Debian) PHP was not affected by the CVE. The CVE was introduced by some other broken fixes to CVE 2007-1375 that were not used in Ubuntu. ** Changed in: php5 (Ubuntu) Importance: Undecided = Low Assignee: (unassigned) = Kees Cook (kees) Status: New = Invalid -- [php5

[Bug 251625] Re: PHP5-CLI doesn't print floats properly

2008-07-24 Thread Kees Cook
This appears to be i386 only and a gutsy/hardy regression, not one introduced by updates or security versions. ** Changed in: php5 (Ubuntu) Importance: Undecided = High Status: New = Confirmed -- PHP5-CLI doesn't print floats properly https://bugs.launchpad.net/bugs/251625 You

[Bug 120375] Re: cannot boot raid1 with only one disk

2008-07-25 Thread Kees Cook
** Changed in: initramfs-tools Status: Confirmed = In Progress ** Changed in: mdadm (Ubuntu) Status: Triaged = In Progress ** Also affects: initramfs-tools (Ubuntu) Importance: Undecided Status: New ** Changed in: initramfs-tools (Ubuntu) Assignee: (unassigned) =

Re: [Bug 120375] Re: cannot boot raid1 with only one disk

2008-07-25 Thread Kees Cook
On Sat, Jul 26, 2008 at 01:15:08AM -, ceg wrote: # We've given up, A while loop is calling panic. An if statement might look better. No, the while loop is correct -- it lets the user attempt to fix the system repeatedly and on failures, it will drop to a shell again. -- cannot boot raid1

[Bug 249878] Re: CVE-2008-2952: BER Decoding Remote DoS Vulnerability

2008-08-01 Thread Kees Cook
(Ubuntu) Assignee: (unassigned) = Kees Cook (kees) Status: New = Fix Released ** Changed in: openldap2.3 (Ubuntu Dapper) Importance: Undecided = Medium Assignee: (unassigned) = Kees Cook (kees) Status: New = Fix Released ** Changed in: openldap2.3 (Ubuntu) Importance

[Bug 258162] Re: Postfix local privilege escalation via hardlinked symlinks

2008-08-19 Thread Kees Cook
Published: http://www.ubuntu.com/usn/usn-636-1 ** Changed in: postfix (Ubuntu) Assignee: (unassigned) = LaMont Jones (lamont) Status: Fix Committed = Fix Released -- Postfix local privilege escalation via hardlinked symlinks https://bugs.launchpad.net/bugs/258162 You received this

[Bug 259827] [NEW] Please sync apache2 2.2.9-7 (main) from Debian unstable (main).

2008-08-20 Thread Kees Cook
, to get useful dependency information. -- Stefan Fritsch [EMAIL PROTECTED] Sun, 06 Jul 2008 10:38:37 +0200 -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Kees Cook [EMAIL PROTECTED] iEYEARECAAYFAkisWvAACgkQH/9LqRcGPm2E9ACfd8YL2q3zbzVHnmf4MSW1srG5

[Bug 259827] Re: Please sync apache2 2.2.9-7 (main) from Debian unstable (main).

2008-08-28 Thread Kees Cook
I have merged this now. ** Changed in: apache2 (Ubuntu) Assignee: (unassigned) = Kees Cook (kees) Status: Confirmed = Fix Released -- Please sync apache2 2.2.9-7 (main) from Debian unstable (main). https://bugs.launchpad.net/bugs/259827 You received this bug notification because you

[Bug 264155] [NEW] fails subselect on i386 testsuite runs with segv when compiled with PIE

2008-09-02 Thread Kees Cook
Public bug reported: With PIE enabled (see https://wiki.ubuntu.com/Security/HardeningWrapper), the mysql server will segv during the subselect test. ** Affects: mysql-dfsg-5.0 (Ubuntu) Importance: Undecided Status: New -- fails subselect on i386 testsuite runs with segv when

[Bug 264155] Re: fails subselect on i386 testsuite runs with segv when compiled with PIE

2008-09-02 Thread Kees Cook
https://edge.launchpad.net/ubuntu/+source/mysql- dfsg-5.0/5.0.67-0ubuntu2/+build/700370 -- fails subselect on i386 testsuite runs with segv when compiled with PIE https://bugs.launchpad.net/bugs/264155 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 246298] Re: package bacula-director-sqlite3 2.4.0-1ubuntu1 [modified: usr/sbin/bacula-dir usr/sbin/dbcheck] failed to install/upgrade:

2008-09-04 Thread Kees Cook
The crash isn't fixed -- it's just hidden. We need to drill down and find the root-cause of the overflow. ** Changed in: bacula (Ubuntu) Importance: Undecided = High Assignee: (unassigned) = Zulnedi (zul) Status: Fix Released = Confirmed Target: None = intrepid-alpha-6 **

[Bug 246298] Re: package bacula-director-sqlite3 2.4.0-1ubuntu1 [modified: usr/sbin/bacula-dir usr/sbin/dbcheck] failed to install/upgrade:

2008-09-04 Thread Kees Cook
** Bug watch added: bugs.bacula.org/ #1138 http://bugs.bacula.org/view.php?id=1138 ** Also affects: bacula via http://bugs.bacula.org/view.php?id=1138 Importance: Unknown Status: Unknown -- package bacula-director-sqlite3 2.4.0-1ubuntu1 [modified: usr/sbin/bacula-dir

[Bug 246298] Re: package bacula-director-sqlite3 2.4.0-1ubuntu1 [modified: usr/sbin/bacula-dir usr/sbin/dbcheck] failed to install/upgrade:

2008-09-05 Thread Kees Cook
** Changed in: bacula (Ubuntu) Status: Confirmed = Fix Released -- package bacula-director-sqlite3 2.4.0-1ubuntu1 [modified: usr/sbin/bacula-dir usr/sbin/dbcheck] failed to install/upgrade: https://bugs.launchpad.net/bugs/246298 You received this bug notification because you are a

[Bug 265102] [NEW] bacula not compiled with FORTIFY_SOURCE

2008-09-05 Thread Kees Cook
Public bug reported: Binary package hint: bacula Due to upstream's strange use of redefinable extern unions, fortify has unfriendly behavior. It would be nice to fix this in a sensible fashion so that the rest of bacula could get fortify protections.

[Bug 265102] Re: bacula not compiled with FORTIFY_SOURCE

2008-09-05 Thread Kees Cook
Yeah, this is mostly a place-holder bug so we can review the roll-out of fortify-source distro-wide. Thanks for looking into it! It does seem clear that glibc got confused about the union size. ** Bug watch added: bugs.bacula.org/ #1138 http://bugs.bacula.org/view.php?id=1138 ** Also

[Bug 246702] Re: [CVE-2008-1447] Randomize DNS query source ports to prevent cache poisoning

2008-09-09 Thread Kees Cook
** Changed in: glibc (Ubuntu) Importance: Medium = Low Assignee: Kees Cook (kees) = (unassigned) -- [CVE-2008-1447] Randomize DNS query source ports to prevent cache poisoning https://bugs.launchpad.net/bugs/246702 You received this bug notification because you are a member of Ubuntu

[Bug 270663] Re: needless use of m flag now that PROT_EXEC bug on i386 was solved

2008-09-15 Thread Kees Cook
In cups: usr.sbin.cupsd: /etc/shadow m, usr.sbin.cupsd: /etc/passwd m, usr.sbin.cupsd: /etc/group m, In mysqld: usr.sbin.mysqld: /etc/group

[Bug 256014] Re: escapeshellcmd() security fix generates problems with mediawiki and other web-apps

2008-09-29 Thread Kees Cook
Status: Unknown ** Changed in: php5 (Ubuntu) Importance: Undecided = Low Assignee: (unassigned) = Kees Cook (kees) Status: New = Triaged -- escapeshellcmd() security fix generates problems with mediawiki and other web-apps https://bugs.launchpad.net/bugs/256014 You received

[Bug 290901] Re: [SRU] for broken header parser

2008-11-07 Thread Kees Cook
** Changed in: dovecot (Ubuntu) Assignee: (unassigned) = Mathias Gug (mathiaz) Status: New = In Progress -- [SRU] for broken header parser https://bugs.launchpad.net/bugs/290901 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to

[Bug 290901] Re: [SRU] for broken header parser

2008-11-07 Thread Kees Cook
** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2008-4907 -- [SRU] for broken header parser https://bugs.launchpad.net/bugs/290901 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to dovecot in ubuntu. -- Ubuntu-server-bugs

[Bug 290901] Re: [SRU] for broken header parser

2008-11-07 Thread Kees Cook
This has been published: http://www.ubuntu.com/usn/USN-666-1 ** Changed in: dovecot (Ubuntu Intrepid) Status: In Progress = Fix Released -- [SRU] for broken header parser https://bugs.launchpad.net/bugs/290901 You received this bug notification because you are a member of Ubuntu Server

[Bug 296920] Re: ssh : ClientAliveInterval ClientAliveCountMax combination not working properly

2008-11-11 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security issue -- ssh : ClientAliveInterval ClientAliveCountMax combination not working properly https://bugs.launchpad.net/bugs/296920 You received this bug notification because you are a member of Ubuntu Server Team, which

[Blueprint improved-power-management] Improved Power Management

2008-11-25 Thread Kees Cook
Blueprint changed by Kees Cook: Whiteboard changed to: AQU - powerman (http://powerman.sourceforge.net/) ITP and packaging underway in Debian http://www.codon.org.uk/~mjg59/power/good_practices.html -- Improved Power Management https://blueprints.edge.launchpad.net/ubuntu/+spec/improved

[Bug 241892] Re: [CVE-2008-2292] Buffer overflow in __snprint_value() in snmp_get

2008-12-03 Thread Kees Cook
http://www.ubuntu.com/usn/usn-685-1 ** Changed in: net-snmp (Ubuntu) Assignee: (unassigned) = Kees Cook (kees) Status: Incomplete = Fix Released -- [CVE-2008-2292] Buffer overflow in __snprint_value() in snmp_get https://bugs.launchpad.net/bugs/241892 You received this bug

[Bug 239129] Re: [CVE-2008-0960] Multiple SNMP implementations HMAC authentication spoofing

2008-12-03 Thread Kees Cook
Feisty is EOL ** Changed in: net-snmp (Ubuntu Intrepid) Status: New = Won't Fix -- [CVE-2008-0960] Multiple SNMP implementations HMAC authentication spoofing https://bugs.launchpad.net/bugs/239129 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 239129] Re: [CVE-2008-0960] Multiple SNMP implementations HMAC authentication spoofing

2008-12-03 Thread Kees Cook
net-snmp fixed for this issue: http://www.ubuntu.com/usn/usn-685-1 ** Changed in: net-snmp (Ubuntu Hardy) Importance: Undecided = Medium ** Changed in: net-snmp (Ubuntu Gutsy) Importance: Undecided = Medium Assignee: (unassigned) = Kees Cook (kees) Status: New = Fix Released

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
Given the large number of affected packages, perhaps it is better to fix the compiler option. I'm curious to see what upstream thinks of this. ** Also affects: glibc (Ubuntu) Importance: Undecided Status: New -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
** Bug watch added: Sourceware.org Bugzilla #7075 http://sourceware.org/bugzilla/show_bug.cgi?id=7075 ** Also affects: glibc via http://sourceware.org/bugzilla/show_bug.cgi?id=7075 Importance: Unknown Status: Unknown ** Changed in: glibc (Ubuntu) Importance: Undecided = High

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
Searching all of Ubuntu source in Jaunty: 29 main 0 restricted 182 universe 15 multiverse ** Attachment added: report of search in main http://launchpadlibrarian.net/20285489/main.log -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
** Attachment added: report of search in universe http://launchpadlibrarian.net/20285495/universe.log -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch https://bugs.launchpad.net/bugs/305901 You received this bug notification because you are a member of

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
** Attachment added: report of search in multiverse http://launchpadlibrarian.net/20285502/multiverse.log -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch https://bugs.launchpad.net/bugs/305901 You received this bug notification because you are a

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
yeah, my search was glitched. New logs attached only count difference was universe, which went to 187. ** Attachment added: main.log http://launchpadlibrarian.net/20288238/main.log -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
** Attachment added: universe.log http://launchpadlibrarian.net/20288259/universe.log -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch https://bugs.launchpad.net/bugs/305901 You received this bug notification because you are a member of Ubuntu Server

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-07 Thread Kees Cook
** Attachment added: multiverse.log http://launchpadlibrarian.net/20288264/multiverse.log ** Attachment removed: report of search in main http://launchpadlibrarian.net/20285489/main.log ** Attachment removed: report of search in universe

Re: [Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-22 Thread Kees Cook
On Tue, Dec 23, 2008 at 06:14:32AM -, Anders Kaseorg wrote: • There are no instances of snprintf in your results. I haven't yet re-run the search with snprintf. • Does your search include DBS style tarball-inside-a-tarball packages? It does not yet, but I've put together a script that

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-23 Thread Kees Cook
http://people.ubuntu.com/~kees/sprintf-glibc/ 29 main 15 multiverse 208 universe 251 total I removed a few copies of the kernel, which all show the same report, as well as gnokii, which had a note in the Changelog about how they'd fixed it already. -- Intrepid gcc -O2 breaks

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2008-12-23 Thread Kees Cook
(er, 252 total -- I added linux back in at the last moment) I'm also testing a patch to glibc to avoid the change in behavior when using _FORTIFY_SOURCE. ** Attachment added: no-sprintf-pre-truncate.diff http://launchpadlibrarian.net/20703741/no-sprintf-pre-truncate.diff -- Intrepid gcc

[Bug 290901] Re: [SRU] for broken header parser

2009-01-07 Thread Kees Cook
** Changed in: dovecot (Ubuntu) Status: In Progress = Fix Released -- [SRU] for broken header parser https://bugs.launchpad.net/bugs/290901 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to dovecot in ubuntu. -- Ubuntu-server-bugs

[Bug 239894] Re: CVE-2008-2364 Apache2 mod_proxy_http.c DOS

2009-01-07 Thread Kees Cook
** Changed in: apache2 (Ubuntu Dapper) Importance: High = Low ** Changed in: apache2 (Ubuntu Feisty) Importance: High = Low ** Changed in: apache2 (Ubuntu Gutsy) Importance: High = Low ** Changed in: apache2 (Ubuntu Hardy) Importance: High = Low ** Changed in: apache2 (Ubuntu)

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2009-01-08 Thread Kees Cook
For intrepid-proposed: glibc (2.8~20080505-0ubuntu8) intrepid-proposed; urgency=low * Add debian/patches/ubuntu/no-sprintf-pre-truncate.diff: do not pre-clear target buffers on sprintf to retain backward compatibility (LP: #305901). ** Changed in: glibc (Ubuntu Intrepid)

[Bug 252675] Re: Please include 9.4.2-P2 patches in Hardy server

2009-01-09 Thread Kees Cook
** Changed in: bind9 (Ubuntu) Status: Fix Committed = Fix Released -- Please include 9.4.2-P2 patches in Hardy server https://bugs.launchpad.net/bugs/252675 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to bind9 in ubuntu. --

[Bug 205921] Re: openvpn crashed with signal 25 in __kernel_vsyscall()

2009-01-23 Thread Kees Cook
** Attachment removed: CoreDump.gz http://launchpadlibrarian.net/12837653/CoreDump.gz ** Visibility changed to: Public ** This bug is no longer flagged as a security issue -- openvpn crashed with signal 25 in __kernel_vsyscall() https://bugs.launchpad.net/bugs/205921 You received this bug

[Bug 201736] Re: Hammering via ssh crashes Ubuntu Server

2009-01-23 Thread Kees Cook
** This bug is no longer flagged as a security issue -- Hammering via ssh crashes Ubuntu Server https://bugs.launchpad.net/bugs/201736 You received this bug notification because you are a member of Ubuntu Server Team, which is a direct subscriber. -- Ubuntu-server-bugs mailing list

[Bug 225105] Re: Mimetypes coming from package mime-support cannot be removed

2009-01-23 Thread Kees Cook
** Changed in: apache2 (Ubuntu) Status: New = Confirmed -- Mimetypes coming from package mime-support cannot be removed https://bugs.launchpad.net/bugs/225105 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to apache2 in ubuntu. --

[Bug 239129] Re: [CVE-2008-0960] Multiple SNMP implementations HMAC authentication spoofing

2009-01-23 Thread Kees Cook
** Changed in: ucd-snmp (Ubuntu Dapper) Status: New = Confirmed ** Changed in: ecos (Ubuntu Dapper) Status: New = Confirmed ** Changed in: ecos (Ubuntu Gutsy) Status: New = Confirmed ** Changed in: ecos (Ubuntu Hardy) Status: New = Confirmed ** Changed in: ecos

[Bug 117736] Re: pam_mount unable to unmount needs root priv

2009-01-23 Thread Kees Cook
** Changed in: openssh (Ubuntu) Status: New = Confirmed ** This bug is no longer flagged as a security issue -- pam_mount unable to unmount needs root priv https://bugs.launchpad.net/bugs/117736 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 293258] Re: mysql user has home directory writable by mysqld

2009-01-23 Thread Kees Cook
** Visibility changed to: Public ** Changed in: mysql-dfsg-5.0 (Ubuntu) Status: New = Confirmed -- mysql user has home directory writable by mysqld https://bugs.launchpad.net/bugs/293258 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 239894] Re: CVE-2008-2364 Apache2 mod_proxy_http.c DOS

2009-01-27 Thread Kees Cook
** Changed in: apache2 (Ubuntu) Status: Fix Released = New ** Changed in: apache2 (Ubuntu) Status: New = In Progress ** Changed in: apache2 (Ubuntu) Status: In Progress = Fix Released -- CVE-2008-2364 Apache2 mod_proxy_http.c DOS https://bugs.launchpad.net/bugs/239894 You

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2009-01-27 Thread Kees Cook
Mathieu: does reverting to an earlier glibc solve the problem for you? -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch https://bugs.launchpad.net/bugs/305901 You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 305901] Re: Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch

2009-01-28 Thread Kees Cook
My intrepid machines with this glibc show the expected behavior and show no signs of regression. -- Intrepid gcc -O2 breaks string appending with sprintf(), due to fortify source patch https://bugs.launchpad.net/bugs/305901 You received this bug notification because you are a member of Ubuntu

[Bug 324249] Re: [CVE-2009-0265] BIND 9 not properly checking the return value from OpenSSL EVP_VerifyFinal()

2009-02-02 Thread Kees Cook
Thanks for the report, however, this does not affect the BIND released in Ubuntu. See the Notes section in the Ubuntu CVE tracker: http://people.ubuntu.com/~ubuntu-security/cve/CVE-2009-0265 ** Changed in: bind9 (Ubuntu) Assignee: (unassigned) = Kees Cook (kees) Status: New

[Bug 671672] [NEW] Sync krb5 1.8.3+dfsg-2 (main) from Debian unstable (main)

2010-11-05 Thread Kees Cook
kdc before x display managers, Closes: #588536 -- Sam Hartman hartm...@debian.org Thu, 05 Aug 2010 12:15:50 -0400 -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Kees Cook k...@outflux.net iQIcBAEBCgAGBQJM1JULAAoJEIly9N/cbcAmGMsP/RaoAMd60/WBWDkBJJnSjsu2

[Bug 684874] Re: Merge rabbitmq-server 2.2.0-1 (main) from Debian unstable (main)

2010-12-06 Thread Kees Cook
Based on the comments in bug #506985, I think this delta should have been dropped in maverick (it was only to support pre-lucid upgrades). After looking at the package diffs, this is the only real difference between Ubuntu and Debian now, so I think this bug should be changed from a merge to a

[Bug 611316] Re: Segmentation fault in php5-sybase

2010-12-06 Thread Kees Cook
** Changed in: php5 (Ubuntu) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. https://bugs.launchpad.net/bugs/611316 Title: Segmentation fault in php5-sybase --

[Bug 43574] Re: Needs Ubuntu-style init script

2010-12-06 Thread Kees Cook
Thanks, this looks good. I'll upload shortly. ** Changed in: xinetd (Ubuntu) Status: In Progress = Fix Committed ** Changed in: xinetd (Ubuntu) Assignee: (unassigned) = Scott Moser (smoser) -- You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 688522] Re: [FTBFS] Eucalyptus doesn't build on maverick, with -security pocket enabled

2010-12-13 Thread Kees Cook
** Changed in: eucalyptus (Ubuntu Maverick) Status: New = Invalid ** Changed in: openjdk-6 (Ubuntu Maverick) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to eucalyptus in ubuntu.

[Bug 691345] Re: buffer overflow in tftp

2010-12-16 Thread Kees Cook
** Changed in: tftp-hpa (Ubuntu) Status: New = Fix Committed ** Changed in: tftp-hpa (Ubuntu) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: tftp-hpa (Ubuntu) Importance: Undecided = Medium ** Changed in: netkit-tftp (Ubuntu) Status: New = Confirmed ** Also

[Bug 691345] Re: buffer overflow in tftp

2010-12-16 Thread Kees Cook
** Changed in: netkit-tftp (Ubuntu Natty) Status: Confirmed = Fix Committed ** Changed in: netkit-tftp (Ubuntu Natty) Assignee: (unassigned) = Kees Cook (kees) ** Changed in: netkit-tftp (Ubuntu Natty) Importance: Undecided = Medium -- You received this bug notification because

[Bug 691414] [NEW] clamav taking extremely long time to load database

2010-12-16 Thread Kees Cook
Public bug reported: Binary package hint: clamav # apt-cache policy clamav-daemon clamav-daemon:   Installed: 0.96.3+dfsg-2ubuntu1.0.10.04.2   Candidate: 0.96.3+dfsg-2ubuntu1.0.10.04.2 Since the security update of clamav, the daemon takes multiple minutes to load its virus database, and is

[Bug 691414] Re: clamav taking extremely long time to load database

2010-12-22 Thread Kees Cook
I can confirm as well, the long load times are gone and I'm able to scan incoming email again. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. https://bugs.launchpad.net/bugs/691414 Title: clamav taking

[Bug 695985] Re: /etc/mysql/debian-start exposes debian-sys-maint users password to any users on the box via ps(1)

2011-01-06 Thread Kees Cook
** Visibility changed to: Public ** Changed in: mysql-5.1 (Ubuntu) Status: New = Confirmed ** Changed in: mysql-5.1 (Ubuntu) Importance: Undecided = Medium -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-5.1 in

[Bug 706917] Re: ClamAV misses SafeBrowsing option in freshclam.conf

2011-02-04 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. https://bugs.launchpad.net/bugs/706917 Title: ClamAV misses

[Bug 713002] Re: Impossible to disable IPv4

2011-02-04 Thread Kees Cook
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in ubuntu. https://bugs.launchpad.net/bugs/713002 Title: Impossible to disable

[Bug 713855] Re: Merge exim4 4.74-1 (main) from Debian experimental (main)

2011-02-09 Thread Kees Cook
This looks pretty good. Can you change 71_exiq_grep_error_on_messages_without_size.patch to use the upstream fix (from that report), drop the From (this should have been Author: with Daniel van Eeden) and add an Origin: line, and finally mention the debian bug # in the changelog? Thanks! **

[Bug 576949] Re: [lucid] LOAD DATA INFILE fails in replication, simple patch available in 5.1.43

2011-02-09 Thread Kees Cook
This looks good; I'll upload it to -proposed now. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-dfsg-5.1 in ubuntu. https://bugs.launchpad.net/bugs/576949 Title: [lucid] LOAD DATA INFILE fails in replication, simple

[Bug 576949] Re: [lucid] LOAD DATA INFILE fails in replication, simple patch available in 5.1.43

2011-02-09 Thread Kees Cook
This has been uploaded to -proposed. Once it has built, please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance! ** Changed in: mysql-dfsg-5.1 (Ubuntu Lucid) Status: Confirmed = Fix

[Bug 713855] Re: Merge exim4 4.74-1 (main) from Debian experimental (main)

2011-02-09 Thread Kees Cook
Thanks! I've uploaded this merge now. ** Changed in: exim4 (Ubuntu) Status: Incomplete = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to exim4 in ubuntu. https://bugs.launchpad.net/bugs/713855 Title: Merge

[Bug 699967] Re: Empty list of plugins/services with hostname containing uppercase letters

2011-02-09 Thread Kees Cook
This has been uploaded to -proposed. Once it has built, please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance! ** Also affects: munin (Ubuntu Maverick) Importance: Undecided

[Bug 697197] Re: Empty password allows access to VNC in libvirt

2011-02-11 Thread Kees Cook
** Changed in: libvirt (Ubuntu Natty) Importance: High = Undecided ** Changed in: libvirt (Ubuntu Natty) Assignee: Serge Hallyn (serge-hallyn) = (unassigned) ** Changed in: qemu-kvm (Ubuntu Maverick) Milestone: maverick-updates = None ** Changed in: libvirt (Ubuntu Lucid)

[Bug 697197] Re: Empty password allows access to VNC in libvirt

2011-02-11 Thread Kees Cook
Thanks for preparing the debdiffs! It looks like karmic is vulnerable too, so we'll need that as well. I'll update the debdiffs to use proper DEP-3 and fix up the formatting of the changelogs a bit (CVE- vs CVE: ), and get these building. ** Also affects: libvirt (Ubuntu Karmic) Importance:

[Bug 697197] Re: Empty password allows access to VNC in libvirt

2011-02-11 Thread Kees Cook
** Changed in: qemu-kvm (Ubuntu Maverick) Assignee: Ubuntu Security Team (ubuntu-security) = Kees Cook (kees) ** Changed in: qemu-kvm (Ubuntu Lucid) Assignee: Ubuntu Security Team (ubuntu-security) = Kees Cook (kees) ** Changed in: qemu-kvm (Ubuntu Karmic) Importance: Undecided

[Bug 719833] [NEW] ssh upstart job fails to actually bring up ssh

2011-02-15 Thread Kees Cook
Public bug reported: When I reboot my router, ssh does not start. Feb 15 22:51:32 router init: ssh main process (897) terminated with status 255 Feb 15 22:51:32 router init: ssh main process ended, respawning Feb 15 22:51:32 router init: ssh main process (915) terminated with status 255 Feb 15

[Bug 719833] Re: ssh upstart job fails to actually bring up ssh

2011-02-15 Thread Kees Cook
-- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openssh in ubuntu. https://bugs.launchpad.net/bugs/719833 Title: ssh upstart job fails to actually bring up ssh -- Ubuntu-server-bugs mailing list

  1   2   3   4   5   6   7   8   9   10   >