Discuss

discuss@lists.centos.org

3 participants
34748 discussions

[Fwd: [Full-disclosure] [ GLSA 200507-05 ] zlib: Buffer overflow]
by William Warren 07 Jul '05

07 Jul '05

Has Centos been tested for this yet? -------- Original Message -------- Subject: [Full-disclosure] [ GLSA 200507-05 ] zlib: Buffer overflow Date: Wed, 06 Jul 2005 16:23:20 +0200 From: Thierry Carrez <koon(a)gentoo.org> Organization: Gentoo Linux To: gentoo-announce(a)lists.gentoo.org CC: full-disclosure(a)lists.grok.org.uk, bugtraq(a)securityfocus.com, security-alerts(a)linuxsecurity.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200507-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: zlib: Buffer overflow Date: July 06, 2005 Bugs: #98121 ID: 200507-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A buffer overflow has been discovered in zlib, potentially resulting in the execution of arbitrary code. Background ========== zlib is a widely used free and patent unencumbered data compression library. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-libs/zlib < 1.2.2-r1 >= 1.2.2-r1 Description =========== Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a buffer overflow in zlib. A bounds checking operation failed to take invalid data into account, allowing a specifically malformed deflate data stream to overrun a buffer. Impact ====== An attacker could construct a malformed data stream, embedding it within network communication or an application file format, potentially resulting in the execution of arbitrary code when decoded by the application using the zlib library. Workaround ========== There is no known workaround at this time. Resolution ========== All zlib users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.2-r1" References ========== [ 1 ] CAN-2005-2096 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200507-05.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security(a)gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0 -- My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD. -- carpe ductum -- "Grab the tape" CDTT (Certified Duct Tape Technician) Linux user #322099 Machines: 206822 256638 276825 http://counter.li.org/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

2 2

NetRaid 1Si on Centos4
by Francesco F 07 Jul '05

07 Jul '05

Hi, I tried to install Centos4 on server with scsi NetRaid 1si. This card isnt't support from kernel version 2.6 (old megaraid driver, like LSI controller). What are steps to doing new install with this scsi card? And it will be stable? Thanks, Francesco

1 0

CentOS on IBM 7043-150, liblaus missing
by Richard Bejtlich 07 Jul '05

07 Jul '05

Hello, I found Pasi's site (http://centos.upi.iki.fi/pub/centos/4/os/ppc/) describing how to get CentOS working on a IBM 7043-150 43p CHRP 604e RS/6000 box. I have the exact same machine. I followed his instructions and got the version of CentOS he provided working on my system. [root@murray ~]# uname -a Linux murray 2.6.9-5.0.3.102.EC #1 Sun Mar 6 18:32:26 EET 2005 ppc ppc ppc GNU/Linux [root@murray ~]# cat /etc/redhat-release CentOS release 4.0 (Final) I thank him for posting the files and his instructions! Is anyone else running CentOS on IBM RS/6000 hardware? Does anyone know if CentOS will formally distribute a ppc version for my hardware? I've only found one problem with CentOS so far -- liblaus is missing, so I can't use passwd to change passwords. [root@murray ~]# passwd richard passwd: error while loading shared libraries: liblaus.so.1: cannot open shared object file: No such file or directory [root@murray ~]# ldd /usr/bin/passwd libuser.so.1 => /usr/lib/libuser.so.1 (0x0ffcb000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x0ff7e000) libgobject-2.0.so.0 => /usr/lib/libgobject-2.0.so.0 (0x0ff16000) libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0x0fef2000) libdl.so.2 => /lib/libdl.so.2 (0x0fece000) libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0x0fe1d000) libpopt.so.0 => /usr/lib/libpopt.so.0 (0x0fdf4000) libpam_misc.so.0 => /lib/libpam_misc.so.0 (0x0fdd0000) liblaus.so.1 => not found libselinux.so.1 => /lib/libselinux.so.1 (0x0fda0000) libc.so.6 => /lib/tls/libc.so.6 (0x0fc43000) libpam.so.0 => /lib/libpam.so.0 (0x0fc1a000) /lib/ld.so.1 (0x30000000) Have you encountered this issue? Any ideas on how to fix it? Thank you again for helping me get my 7043-150 doing something useful! Sincerely, Richard PS: Has anyone tried running other Linux distros? I did not have any luck booting the latest Debian (debian-31r0a-powerpc-binary-1.iso) or NetBSD (2.0.2, prepcd.iso) on this system, but maybe I wasn't using the right OpenFirmware commands.

3 2

Netware server emulation on Linux
by Nigel kendrick 07 Jul '05

07 Jul '05

One of our group companies has just 'gone live' on a new laboratory management package. Although the software is M$-based (ie: expects a M$ server at the heart of it), it is running with its core database on a CentOS3 server using Samba for client access - in fact, the developers are amazed at the performance and say it beats a Win2K/2K3 server 'hands down'!!! Anyway, the old lab management app that I inherited has its database hosted on a Netware 3.12 server and the client app is written in Turbo Pascal including database units compiled with a specific Netware switch and if we try to run the db off the Linux server using Samba we get record lock errors. Unfortuntely, we have no confidence in re-compiling the ancient source code, expecially since the company that developed the database engine is long gone. We need access to the old data for reference and although I am going to attempt to extract it all and do some PHP stuff with it, a Google search turns up two netware emulation packages for Linux - lwared and mars_nwe - so my question is this: has anyone around these here parts used any or both of these apps with CentOS 3 or 4 and if so can I have any useful insight? I suppose the ultimate test would be to try them both but a head start would be aprpeciated. Thanks as ever, Nigel Kendrick

2 1

CentOS 4.1 Apache
by Ben 06 Jul '05

06 Jul '05

Hi folks, I've just put CentOS 4.1 on my webserver, displacing OpenBSD (1 up for Linux :-)) I found that the Virtual Hosts function doesn't appear to work. All virtual hosts accesses default to the main www directory instead of serving from their respective directories. Has anyone else found the same problem? Thanks. Ben

10 17

sendmail + plain auth
by alex＠milivojevic.org 06 Jul '05

06 Jul '05

I'm probably missing something obvious, but I can get sendmail to give me AUTH PLAIN and LOGIN options. What I have is fairly standard configuration. The relevant part of sendmail.mc looks something like this: define(`confCACERT_PATH',`/etc/ssl/certs') define(`confCACERT',`/etc/ssl/ca-bundle.crt') define(`confSERVER_CERT',`/etc/ssl/smtp.crt') define(`confSERVER_KEY',`/etc/ssl/smtp.key') define(`confAUTH_OPTIONS', `A p') TRUST_AUTH_MECH(`EXTERNAL LOGIN PLAIN') define(`confAUTH_MECHANISMS', `EXTERNAL LOGIN PLAIN') DAEMON_OPTIONS(`Port=25, Name=MTA') DAEMON_OPTIONS(`Port=465, Name=TLSMTA, M=s') So basically, LOGIN and PLAIN should be offered when SSL/TLS is in use (but not for plaintext sessions). However, when connecting over TLS, sendmail doesn't advertise them: $ openssl s_client -connect localhost:465 [ SSL/TLS handshake output deleted, AES256 cipher was used ] 220 testbox.miliv.org ESMTP Unauthorized access prohibited EHLO localhost 250-testbox.miliv.org Hello localhost [127.0.0.1], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DELIVERBY 250 HELP Attempt to "brute-force" use them results in error (as expected): AUTH PLAIN 504 5.3.3 AUTH mechanism PLAIN not available I'm sure I'm missing something obvious here, probably a flag or two either in confAUTH_OPTIONS or in DAEMON_OPTIONS, but couldn't dig out which. Alraedy drank all coffe, and becoming desparate ;-) ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

4 8

does anyone have mysql 4.1 rpms for centos 3
by Robin Mordasiewicz 06 Jul '05

06 Jul '05

I am in need of mysql 4.1 rpms which will not break the php_mysql module. --

2 1

Re: Compiling kernel 2.6.12.2 with gcc-3.4.3-22.1
by Bryan J. Smith <b.j.smith＠ieee.org> 06 Jul '05

06 Jul '05

From: Jose Alburquerque <jaalburquerque(a)cox.net> > Sorry, I'm not very experienced and didn't know exactly where to turn > to compile a new kernel. Well hold on. ;-> If there is one area where Fedora Core (FC) and Red Hat Enterprise Linux (RHEL) _really_ differ, it's the kernel. So you _might_ run into issues with rebuilding that on RHEL/CentOS 4, especially since Fedora Development is currently targeting FC 5 -- 2 revisions (~12 months) ahead of where RHEL/CentOS 4 is at. That's why I was wondering if there is a "Development" kernel more for RHEL/CentOS than Fedora Development. I have used the Fedora Development kernels on RHEL/CentOS in the past, but typically only on desktops or systems under test. > Thanks for the link! I'd much rather have an rpm than compiling > directly from source! Well, it's really more than just that. It's all the patches and other fixes Red Hat adds. As much as Red Hat is trying to use the vanilla kernel in Fedora Core as of kernel 2.6, there are still a number of patches, tweaks, etc... that still go in. If I need to modify anything, unpackage the RPMBUILD/SPEC environment, create a formal patch and "rpmbuild -bb kernel-2.6.spec" directly. But I typically and rarely have to do that, and it's a matter of "rpmbuild --rebuild --target=i686|x86_64 kernel-2.6*.src.rpm" directly. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Compiling kernel 2.6.12.2 with gcc-3.4.3-22.1
by Jose Alburquerque 06 Jul '05

06 Jul '05

Hi. I just have a quick question that maybe some of you might know. I'm thinking of compiling a new kernel (kernel 2.6.12.2) for my system which is running CentOS 4 (updated to 4.1 using yum). I downloaded the kernel tarball and read in the docs that for stability gcc 2.95.x (x>=3) might be best to compile the new kernel. With an "rpm -q gcc" command I see that I have gcc-3.4.3-22.1 installed on my box. Can anyone tell me if the kernel I'm trying to compile will compile fine using the version I have installed? Should I "downgrade" my gcc to 2.95 to compile this kernel? The reason I'm trying to compile an new kernel is that my system uses a LSI Logic/Symbios Logic 53c875 SCSI controller (information obtained from "System Tools/Hardware Browser" menu in GNOME) and I keep getting a bunch of errors like the following in my system logs: sym0:0:0:phase change 6-7 11@12856b84 resid=2. I read somewhere that by compiling a new kernel (2.6.11, I think), this problem might go away and I wanted my system to run as efficiently so decided to compile a new kernel. Am I doing the right thing? Thanks! Sincerely Jose

4 6

Opteron Mobo Suggestions
by Kirk Bocek 06 Jul '05

06 Jul '05

I've been planning to build a dual Opteron server for awhile. I'd like to get people's suggestions on a suitable motherboard. I've looked at the Tyan K8SE (S2892) and K8SRE (S2891) but would like to find more Linux-specific experiences with these boards. Some features I expect are at least 4 SATA (SATA-300?) ports, serial console support in the BIOS, USB 2.0 and IEEE-1394 ports, low-end on-board video. Anyone care to share their experiences? Kirk Bocek

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss