Discuss

discuss@lists.centos.org

8 participants
34745 discussions

full-d] Administrivia: List Compromised due to Mailman Vulnerability (fwd)
by R P Herrold 09 Feb '05

09 Feb '05

Sorry for the cross post, but this is an important one potentially affecting all recipients. This just crossed the Full Disclosure mailman moderated mailing list. It bears a careful read, and thought about whether a response is needed. The implication is that if there is any use of a mailman password in common with a password you 'care' about, you need to take appropriate action at once. Also some backends merge Bugzilla and mailman password stores, which can cause unexpected secondary effects. I have not seen a patch yet, and so one has to assume that the configs and passwords for all mailman moderated mailing lists are compromised. Once a fix issues, Mailman moderators will want to do a global password change, and local list modification. -- Russ Herrold ---------- Forwarded message ---------- Date: Wed, 9 Feb 2005 18:15:02 +0000 From: John Cartwright <johnc(a)grok.org.uk> To: full-disclosure(a)lists.netsys.com Subject: full-d] Administrivia: List Compromised due to Mailman Vulnerability Hi On 7th February 2005 I was notified of a number of potentially - compromised Full-Disclosure subscriber accounts. Following an investigation it appears that the Mailman configuration database was obtained from lists.netsys.com on 2nd January 2005 using a remote directory traversal exploit for a previously unpublished vulnerability in Mailman 2.1.5. Subscriber addresses and passwords have been compromised. All list members are advised to change their password immediately. There do not appear to be further signs of intrusion although investigations continue. The vulnerability lies in the Mailman/Cgi/private.py file: def true_path(path): "Ensure that the path is safe by removing .." path = path.replace('../', '') path = path.replace('./', '') return path[1:] A crafted URL fragment of the form ".../....///" will pass through the above function and return as "../", thus allowing directory traversal to occur using the following URL syntax to retrieve an arbitrary path. /mailman/private/<list>/<path>?username=<username>&password=<password> Expect vendor advisories nearer the end of the week, for now here is a suggested fix from Barry Warsaw: SLASH = '/' def true_path(path): "Ensure that the path is safe by removing .." parts = [x for x in path.split(SLASH) if x not in ('.', '..')] return SLASH.join(parts)[1:] This issue only affects Mailman installations running on web servers that don't strip extraneous slashes from URLs, such as Apache 1.3.x. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0202 to this mailman issue. Cheers - John _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html

4 6

Re: [Centos] help with xargs and mv
by James B. Byrne 09 Feb '05

09 Feb '05

Just a note that I caught and corrected the syntax error on my last example and that correcting it does not change the result at all. # cat workmv | xargs -i '{}' mv --Target-Directory=./mqueue/offline/ ./mqueue/'{}' vice # cat workmv | xargs -i '{}' --Target-Directory=./mqueue/offline/ mv ./mqueue/'{}' both give xargs: {}: No such file or directory Regards, Jim -- *** e-mail is not a secure channel *** mailto:byrnejb.<token>@harte-lyne.ca James B. Byrne Harte & Lyne Limited vox: +1 905 561 1241 9 Brockley Drive fax: +1 905 561 0757 Hamilton, Ontario <token> = hal Canada L8E 3C3

1 0

RE: CentOS Digest, Vol 2, Issue 13
by Melinda Odom 09 Feb '05

09 Feb '05

>>> I have ecommerce stores on my server who use the same instantssl certificate without any problems. These particular certificates were migrated over from one plesk system to my new server with centOS 3.4 and plesk 7.5.1 reloaded. >>> We got it working. It was a custom config problem for that one site. Sincerely, Melinda Odom www.designhosting.biz 479-471-0891 -----Original Message----- From: centos-bounces(a)caosity.org [mailto:centos-bounces@caosity.org]On Behalf Of centos-request(a)caosity.org Sent: Wednesday, February 09, 2005 6:00 AM To: centos(a)caosity.org Subject: CentOS Digest, Vol 2, Issue 13 Send CentOS mailing list submissions to centos(a)caosity.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.caosity.org/mailman/listinfo/centos or, via email, send a message with subject or body 'help' to centos-request(a)caosity.org You can reach the person managing the list at centos-owner(a)caosity.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS digest..." Today's Topics: 1. Re: CentOS 3.4 on Compaq Proliant (Troy Engel) 2. ssl certificate problem - one domain only (Melinda Odom) 3. CentOS-3 x86_64 errata : Updated Perl packages fix security issues (Tru Huynh) 4. Re: ssl certificate problem - one domain only (John Hinton) 5. Re: Samba print queues showing old jobs (Gavin Carr) ---------------------------------------------------------------------- Message: 1 Date: Tue, 08 Feb 2005 15:00:02 -0800 From: Troy Engel <tengel(a)fluid.com> Subject: Re: [Centos] CentOS 3.4 on Compaq Proliant To: CentOS discussion and information list <centos(a)caosity.org> Message-ID: <42094472.2060106(a)fluid.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed John Hinton wrote: > >> I am trying to install CentOS 3.4 on a Compaq Proliant 1600, and it >> hangs on probing monitor type when anaconda starts. I have tried >> > Do the install using the nousb flag. I have had the same issue on some > 1850s and had to disable the onboard scsi port allowing only the scsi > card to be enabled. Same same -- on the random old Compaq....DL360(?) (long since dead) it physically had no USB on the motherboard, and it took forever to figure out the 'nousb' flag to make any Redhat installs work. -te -- Troy Engel | Systems Engineer Fluid, Inc | http://www.fluid.com ------------------------------ Message: 2 Date: Tue, 8 Feb 2005 18:05:14 -0600 From: "Melinda Odom" <info(a)designhosting.biz> Subject: [Centos] ssl certificate problem - one domain only To: <centos(a)caosity.org> Message-ID: <OHEMIKFDMHLDNJAPNOLEGEHKFGAA.info(a)designhosting.biz> Content-Type: text/plain; charset="iso-8859-1" Hi, I have ecommerce stores on my server who use the same instantssl certificate without any problems. These particular certificates were migrated over from one plesk system to my new server with centOS 3.4 and plesk 7.5.1 reloaded. When I generated a new csr for a new client on my centOS server and chose apache mod_ssl at instantssl for the csr I got the certificate, installed it (first new install on my new server) and now when someone goes to this particular ecommerce site and tries to purchase anything or create an account a box pops up asking if they want to open or download the file. This has never happened before and does not happen on all the certificates I migrated over to the new server without generating a csr. I am very confused as to what is happening. When I turn the ssl off for this particular ecommerce store everything works and customers can buy and register. My other sites that were migrated over to this new server do not have any problems and are using instantssl also. I called instantssl.com and they told me it was a problem with the mime types and the server was configured incorrectly and to look in the httpd.conf file. I see these for the httpd.conf file: /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.save_by_frontpage I see this one is turned off in the httpd.conf file: LoadModule env_module modules/mod_env.so #LoadModule mime_magic_module modules/mod_mime_magic.so LoadModule cern_meta_module modules/mod_cern_meta.so Other ones: # TypesConfig describes where the mime.types file (or equivalent) is # to be found. # TypesConfig /etc/mime.types DefaultType text/plain Is there something that needs to be changed to make this ssl certificate work? Sincerely, Melinda Odom www.designhosting.biz 479-471-0891 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.300 / Virus Database: 265.8.6 - Release Date: 2/7/2005

1 0

Samba print queues showing old jobs
by Nigel Kendrick 09 Feb '05

09 Feb '05

We have a server running Centos-3 with all latest updates. The server hosts 3 printers for us which are accessed by various Windows clients. About 3 months ago we noticed that, after a cups update, if you looked at the print queues in Windows they would show old jobs that had long been printed. After a further cups update this quirk went away but it's just come backs again - possibly after the recent cups update. Or is it me!? Anything worth checking? Thanks Nigel Kendrick

3 2

CentOS-3 x86_64 errata : Updated Perl packages fix security issues
by Tru Huynh 09 Feb '05

09 Feb '05

https://rhn.redhat.com/errata/RHSA-2005-105.html refers Updated files are :- updates/x86_64/RPMS/perl-5.8.0-89.10.i386.rpm updates/x86_64/RPMS/perl-5.8.0-89.10.x86_64.rpm updates/x86_64/RPMS/perl-CGI-2.81-89.10.x86_64.rpm updates/x86_64/RPMS/perl-CPAN-1.61-89.10.x86_64.rpm updates/x86_64/RPMS/perl-DB_File-1.804-89.10.x86_64.rpm updates/x86_64/RPMS/perl-suidperl-5.8.0-89.10.x86_64.rpm updates/x86_64/SRPMS/perl-5.8.0-89.10.src.rpm To update run 'yum update perl' Tru -- Tru Huynh (CentOS-3 x86_64 helper) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

ssl certificate problem - one domain only
by Melinda Odom 09 Feb '05

09 Feb '05

Hi, I have ecommerce stores on my server who use the same instantssl certificate without any problems. These particular certificates were migrated over from one plesk system to my new server with centOS 3.4 and plesk 7.5.1 reloaded. When I generated a new csr for a new client on my centOS server and chose apache mod_ssl at instantssl for the csr I got the certificate, installed it (first new install on my new server) and now when someone goes to this particular ecommerce site and tries to purchase anything or create an account a box pops up asking if they want to open or download the file. This has never happened before and does not happen on all the certificates I migrated over to the new server without generating a csr. I am very confused as to what is happening. When I turn the ssl off for this particular ecommerce store everything works and customers can buy and register. My other sites that were migrated over to this new server do not have any problems and are using instantssl also. I called instantssl.com and they told me it was a problem with the mime types and the server was configured incorrectly and to look in the httpd.conf file. I see these for the httpd.conf file: /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.save_by_frontpage I see this one is turned off in the httpd.conf file: LoadModule env_module modules/mod_env.so #LoadModule mime_magic_module modules/mod_mime_magic.so LoadModule cern_meta_module modules/mod_cern_meta.so Other ones: # TypesConfig describes where the mime.types file (or equivalent) is # to be found. # TypesConfig /etc/mime.types DefaultType text/plain Is there something that needs to be changed to make this ssl certificate work? Sincerely, Melinda Odom www.designhosting.biz 479-471-0891 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.300 / Virus Database: 265.8.6 - Release Date: 2/7/2005

2 1

CentOS 3.4 on Compaq Proliant
by mlnoe＠mn.rr.com 08 Feb '05

08 Feb '05

I am trying to install CentOS 3.4 on a Compaq Proliant 1600, and it hangs on probing monitor type when anaconda starts. I have tried running 'linux text' and manually installing drivers from the f2 options screen. Any ideas? Forgive me if this is an unbearably simple question, but I am new to linux. Mike

3 2

some things missing from addons directory
by Joe Pruett 08 Feb '05

08 Feb '05

i was just trying to update a rh9 box to centos 3.4 and ran into a number of issues that i finally realized would be solved by pointing to the addons area. but there are still some things that crop up. one of them is doxygen-doxywizard. there is a new version of doxygen in the 3.4 base, but the addons has an older version, so the yum upgrade gets confused. i don't see php-manual in the addons directory at all, so that is probably not the same issue. with yum is there a way we could have a list of old packages like php-manual that just don't exist anymore and have it uninstall it? for now, i am just tracking down things and removing packages that can't be upgraded. having it all happen automatically would be nice :-).

3 3

CentOS-3 i386 errata : Updated Perl packages fix security issues
by Lance Davis 08 Feb '05

08 Feb '05

https://rhn.redhat.com/errata/RHSA-2005-105.html refers Updated files are :- updates/i386/RPMS/perl-5.8.0-89.10.i386.rpm updates/i386/RPMS/perl-CGI-2.81-89.10.i386.rpm updates/i386/RPMS/perl-CPAN-1.61-89.10.i386.rpm updates/i386/RPMS/perl-DB_File-1.804-89.10.i386.rpm updates/i386/RPMS/perl-suidperl-5.8.0-89.10.i386.rpm updates/i386/SRPMS/perl-5.8.0-89.10.src.rpm To update run 'yum update perl' Lance

1 0

swatch 3.1.1 & CentOS 3.4
by Barry L. Kline 08 Feb '05

08 Feb '05

I have need of the functionality of the "swatch" utility. Prior to the actual installation of swatch I used perl2rpm to create RPMs for the PERL modules not provided in CentOS. I got a clean 'make test' from the package so I know that everything is configured properly. The bottom line is that the utility appears to be broken. I can downgrade to version 3.0.8, which appears to work properly, but that version lacks the "threshold" feature that I need. My questions are thus: 1) Is anyone successfully using swatch 3.1.1 with CentOS? If so, what incantation did you need do to make it function properly? 2) Is there another product that you use that provides similar capabilities? For reference, the project page is: http://sourceforge.net/projects/swatch/ TIA, Barry

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss