MESSAGE
DATE | 2005-08-30 |
FROM | Ruben Safir
|
SUBJECT | Subject: [NYLXS - HANGOUT] [Fwd: [suse-security-announce] SUSE Security Announcement:
|
-----Forwarded Message----- > From: Marcus Meissner > To: suse-security-announce-at-suse.com > Subject: [suse-security-announce] SUSE Security Announcement: php4/php5 Pear::XML_RPC code injection and PCRE integer overflow problems (SUSE-SA:2005:049) > Date: Tue, 30 Aug 2005 16:34:40 +0200 > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: php4, php5 > Announcement ID: SUSE-SA:2005:049 > Date: Tue, 30 Aug 2005 15:00:00 +0000 > Affected Products: 9.0, 9.1, 9.2, 9.3 > SUSE Linux Enterprise Server 8, 9 > Vulnerability Type: remote code execution > Severity (1-10): 8 > SUSE Default Package: yes > Cross-References: CAN-2005-2498 > CAN-2005-2491 > > > Content of This Advisory: > 1) Security Vulnerability Resolved: > Pear::XML_RPC code injection problem, pcre integer overflow > Problem Description > 2) Solution or Work-Around > 3) Special Instructions and Notes > 4) Package Location and Checksums > 5) Pending Vulnerabilities, Solutions, and Work-Arounds: > See SUSE Security Summary Report. > 6) Authenticity Verification and Additional Information > > ______________________________________________________________________________ > > 1) Problem Description and Brief Discussion > > This update fixes the following security issues in the PHP scripting > language. > > - Bugs in the PEAR::XML_RPC library allowed remote attackers to pass > arbitrary PHP code to the eval() function (CAN-2005-1921, > CAN-2005-2498). > > The Pear::XML_RPC library is not used by default in SUSE Linux, but > might be used by third-party PHP applications. > > - A integer overflow bug was found in the PCRE (perl compatible regular > expression) library which could be used by an attacker to potentially > execute code. (CAN-2005-2491) > > 2) Solution or Work-Around > > Please install the updated packages. > > 3) Special Instructions and Notes > > Make sure you restart the web server using PHP after the update. > > 4) Package Location and Checksums > > The preferred method for installing security updates is to use the YaST > Online Update (YOU) tool. YOU detects which updates are required and > automatically performs the necessary steps to verify and install them. > Alternatively, download the update packages for your distribution manually > and verify their integrity by the methods listed in Section 6 of this > announcement. Then install the packages using the command > > rpm -Fhv > > to apply the update, replacing with the filename of the > downloaded RPM package. > > Our maintenance customers are notified individually. The packages are > offered for installation from the maintenance web. > > > x86 Platform: > > SUSE Linux 9.3: > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-mod_php4-4.3.10-14.9.i586.rpm > f4e6d7578b6ae62a0b49989a3be4ef4b > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-mod_php5-5.0.3-14.9.i586.rpm > 79bb1fdc66068aba68a253d16a02f471 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/mod_php4-servlet-4.3.10-14.9.i586.rpm > 08708573a0dee6ea412f7afc0d472244 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-4.3.10-14.9.i586.rpm > ffc0d7f665be377b1c9450f16d8b0b35 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-devel-4.3.10-14.9.i586.rpm > 44bbb9ec8f40b92030a591a718312ce1 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-exif-4.3.10-14.9.i586.rpm > 081168bede1cc4409c17fe71ea891f6e > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-fastcgi-4.3.10-14.9.i586.rpm > f6beca45181a6f92cba938b6b1009b39 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-pear-4.3.10-14.9.i586.rpm > c35765443f99ee337e8df8b54414ef74 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-session-4.3.10-14.9.i586.rpm > 9681a8e5dd6db224689d8e5dc6f07aff > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php4-sysvshm-4.3.10-14.9.i586.rpm > 9f18c0bce655a1eda2fa9db9cb703e68 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-5.0.3-14.9.i586.rpm > d39bb57b5df06dc64e3cc5cf484c030c > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-devel-5.0.3-14.9.i586.rpm > 514561227c94e8af808dfb9d47a8143a > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-exif-5.0.3-14.9.i586.rpm > a08670d24ea2af4e22425b9879804fa9 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-fastcgi-5.0.3-14.9.i586.rpm > 9c374d9ed218a85399d5a529f8f97417 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-pear-5.0.3-14.9.i586.rpm > 4cba59009162137d5e4a79f0c355ec15 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-sysvmsg-5.0.3-14.9.i586.rpm > a31dd5f81ebe25fc69b4a3a29321fed9 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/php5-sysvshm-5.0.3-14.9.i586.rpm > 4b1cf3f9ccfc1f4a546f188768a54da2 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-32bit-9.3-7.4.x86_64.rpm > 4cddafbceded22b220e48542f6371337 > > SUSE Linux 9.2: > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-mod_php4-4.3.8-8.12.i586.rpm > b5f30d4fcad5a1f8a3e5dfc9db519914 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/mod_php4-servlet-4.3.8-8.12.i586.rpm > eed1a644b3908e719d81359b96ef4244 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-4.3.8-8.12.i586.rpm > 3a9fd735f7897fb97be921dee4afe850 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-devel-4.3.8-8.12.i586.rpm > 6145bf500d49378b1f7cd5441612ad92 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-exif-4.3.8-8.12.i586.rpm > 38c72905c9c47a6ab680faa781927020 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-fastcgi-4.3.8-8.12.i586.rpm > 8483c7ce1b73710f03120fb7cf009740 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-pear-4.3.8-8.12.i586.rpm > 202af06b5ee93fd667a7484d01c3089b > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-session-4.3.8-8.12.i586.rpm > 498f23a90eab4da6a06de67e44a84014 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/php4-sysvshm-4.3.8-8.12.i586.rpm > 254f0ee5ac6d04f244a8cfd171fdff57 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-32bit-9.2-200508260320.x86_64.rpm > 528b00aeb3433f5829cd070a84cfeeb9 > > SUSE Linux 9.1: > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-mod_php4-4.3.4-43.41.i586.rpm > 214e4ef40cb48c998342995cac9d04b8 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/mod_php4-core-4.3.4-43.41.i586.rpm > f2d4e625ea55fa7ead3a754238ca7078 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/mod_php4-servlet-4.3.4-43.41.i586.rpm > fabfae99a0462b49ec5f1109cd6820a9 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-4.3.4-43.41.i586.rpm > ca1aaef816f44495a90d4fb487a26524 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-devel-4.3.4-43.41.i586.rpm > 66fe3a880315e1de5d408a5dcaca3680 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-exif-4.3.4-43.41.i586.rpm > c21383cbc809a455c7eff45b8f533f52 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-fastcgi-4.3.4-43.41.i586.rpm > 21363ed91ae437ca66a97ba597c2529c > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-imap-4.3.4-43.41.i586.rpm > ebdd8e83894392f455f57f8bf96022ea > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-mysql-4.3.4-43.41.i586.rpm > f6bf0f02c69fe67d2b229000bb5c93de > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-pear-4.3.4-43.41.i586.rpm > a2b8fbb9a6f9720e332d311096280aa8 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-recode-4.3.4-43.41.i586.rpm > 7a82acc19b8817a5b80e87bacfab33c7 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-servlet-4.3.4-43.41.i586.rpm > 654aa331a6353a34937d6688f8cb6d36 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-session-4.3.4-43.41.i586.rpm > fd388995234e536a8d72983f3eb51ce1 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-sysvshm-4.3.4-43.41.i586.rpm > d47c5fee9862e92daa317f48f3337b28 > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/php4-wddx-4.3.4-43.41.i586.rpm > 29bd1f214d830de2f70c093ad428452b > source rpm(s): > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/php4-4.3.4-43.41.src.rpm > dd586cc978292519a290d27439a9da28 > > SUSE Linux 9.0: > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-mod_php4-4.3.3-194.i586.rpm > 72dc636b72a3e8b8703eb3d6b770ca61 > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_php4-4.3.3-194.i586.rpm > a0934b5d7f27d2d86a9587dd5981e550 > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_php4-aolserver-4.3.3-194.i586.rpm > 8a9553c2157af21753305fc013bd4b75 > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_php4-core-4.3.3-194.i586.rpm > 9dce9a4f911cd1deed07096d5c5be00a > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_php4-devel-4.3.3-194.i586.rpm > 5fab53be54518170d3885459ee51232f > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_php4-servlet-4.3.3-194.i586.rpm > fd0e4d8d4a938711bc2a93c50a5a1be9 > source rpm(s): > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/mod_php4-4.3.3-194.src.rpm > f9f22aee983bbb30e2a10b4343155587 > > x86-64 Platform: > > SUSE Linux 9.3: > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-mod_php4-4.3.10-14.9.x86_64.rpm > a3566598438cadf224fd5b1a126a6024 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-mod_php5-5.0.3-14.9.x86_64.rpm > c6186821c83c329729f282fb8ca34be8 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/mod_php4-servlet-4.3.10-14.9.x86_64.rpm > ac65da1e1109543f424e6abb1fa99201 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-4.3.10-14.9.x86_64.rpm > 70c628abfaef3a4749c4683a9fa6de25 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-devel-4.3.10-14.9.x86_64.rpm > 3dde57064fcec2d5fbb5eb8397174f43 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-exif-4.3.10-14.9.x86_64.rpm > be6b952045156e8e39286cf31567f8c2 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-fastcgi-4.3.10-14.9.x86_64.rpm > afcaf39f5dd99859f789e68d8183895d > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-pear-4.3.10-14.9.x86_64.rpm > 62d056349b1fffe351fb0d88c3d69905 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-session-4.3.10-14.9.x86_64.rpm > 1352247dee304526e024d8c4132fc04c > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php4-sysvshm-4.3.10-14.9.x86_64.rpm > 0b76af3f88a4482fc59b3e7ddba60ebd > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-5.0.3-14.9.x86_64.rpm > 915b53c32abeff07e509c7480946ba40 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-devel-5.0.3-14.9.x86_64.rpm > 99df6f9e22a93b0ae6a07689d04af43e > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-exif-5.0.3-14.9.x86_64.rpm > e0cdc636f1234231653f0cdc354272be > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-fastcgi-5.0.3-14.9.x86_64.rpm > 6c25772c43098d4ceeba2637a06b21a0 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-pear-5.0.3-14.9.x86_64.rpm > 2621bf4f9a6582135e10e60861c16c73 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-sysvmsg-5.0.3-14.9.x86_64.rpm > 7a008af048763a61e05b5d90c94cdaa7 > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/php5-sysvshm-5.0.3-14.9.x86_64.rpm > 408072d7b235721984593b2daf4cc56f > source rpm(s): > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/php4-4.3.10-14.9.src.rpm > 2becfb1be4d621a677305153b6aeb04e > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/php5-5.0.3-14.9.src.rpm > 2ec1cf29732840e136d7291677a58c46 > > SUSE Linux 9.2: > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-mod_php4-4.3.8-8.12.x86_64.rpm > b138dceb7fbc705676fc37c1959a7265 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/mod_php4-servlet-4.3.8-8.12.x86_64.rpm > d8b17ce13cc0ffd38ab340d1374c27e9 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-4.3.8-8.12.x86_64.rpm > 89572dce1437f77010f224dde5f77b84 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-devel-4.3.8-8.12.x86_64.rpm > af4ef7e10f30648c8d6397b3453eade5 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-exif-4.3.8-8.12.x86_64.rpm > 138673e37f145774abb545ff17b2d873 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-fastcgi-4.3.8-8.12.x86_64.rpm > 0af41c67a8a227f2e59d47530b79aef4 > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-pear-4.3.8-8.12.x86_64.rpm > a267c09190f6782bd408f3b9d451755f > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-session-4.3.8-8.12.x86_64.rpm > 400df3b11703fba3c363cb6cfd90425f > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/php4-sysvshm-4.3.8-8.12.x86_64.rpm > a0b37ffe882338dd6ed727fd657f7180 > source rpm(s): > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/php4-4.3.8-8.12.src.rpm > b987cb8e60e74cac76b83a6b85092a13 > > SUSE Linux 9.1: > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-mod_php4-4.3.4-43.41.x86_64.rpm > 1088ec323766692fdf30252386dd17d5 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/mod_php4-core-4.3.4-43.41.x86_64.rpm > b32bec6f686d83cdff538c661c9bd693 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/mod_php4-servlet-4.3.4-43.41.x86_64.rpm > 6a4a2ee9725a7cbeda50f0bf3c30e1b0 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-4.3.4-43.41.x86_64.rpm > eaace43d9273a5fbf79fa47af64cb764 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-devel-4.3.4-43.41.x86_64.rpm > 23ea7c1d4f9d4088201a39106062a169 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-exif-4.3.4-43.41.x86_64.rpm > dd0df0fc61f5331bb7fa8d2fff929cff > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-fastcgi-4.3.4-43.41.x86_64.rpm > e14efdeda23c06aac65e55db83555328 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-imap-4.3.4-43.41.x86_64.rpm > 1a81b3b1c7b6562c330e5fd8afb33489 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-mysql-4.3.4-43.41.x86_64.rpm > 4e5afde23ba37c5c83bcd2f4ea23e5a4 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-pear-4.3.4-43.41.x86_64.rpm > 3ec4a646f4254293af2423b1690e68c3 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-recode-4.3.4-43.41.x86_64.rpm > 70de23feb7e561f4f9225d82dd51ff6f > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-servlet-4.3.4-43.41.x86_64.rpm > de543ba0db1f755f16afa77a1ad6ad06 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-session-4.3.4-43.41.x86_64.rpm > 973fcbda433eb8187b426ec93e8fefb2 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-sysvshm-4.3.4-43.41.x86_64.rpm > 42c4cc25a00aa42b83aad8be9cbcc265 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/php4-wddx-4.3.4-43.41.x86_64.rpm > 5941a332be13d1a602d6bb2e48c7b188 > source rpm(s): > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/php4-4.3.4-43.41.src.rpm > 2e021c18d66c00989a1fe019cb241064 > > SUSE Linux 9.0: > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-mod_php4-4.3.3-194.x86_64.rpm > c83318085caf523c2a4afcf7e707aaf4 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_php4-4.3.3-194.x86_64.rpm > f10309b963b542c0dedb3533c139bc9a > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_php4-aolserver-4.3.3-194.x86_64.rpm > 19c7918452fdaee52677f3a7adad2863 > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_php4-core-4.3.3-194.x86_64.rpm > deebef74b38aca7af032deec065a8f5e > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_php4-devel-4.3.3-194.x86_64.rpm > 9979f459d175849bd4eda540a8044c3a > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_php4-servlet-4.3.3-194.x86_64.rpm > f15b60a9766e6d9fd405a854e71e9809 > source rpm(s): > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/mod_php4-4.3.3-194.src.rpm > 5bb5ca24643ef02c1e9b645a2656670c > > > ______________________________________________________________________________ > > 5) Pending Vulnerabilities, Solutions, and Work-Arounds: > > See SUSE Security Summary Report. > ______________________________________________________________________________ > > 6) Authenticity Verification and Additional Information > > - Announcement authenticity verification: > > SUSE security announcements are published via mailing lists and on Web > sites. The authenticity and integrity of a SUSE security announcement is > guaranteed by a cryptographic signature in each announcement. All SUSE > security announcements are published with a valid signature. > > To verify the signature of the announcement, save it as text into a file > and run the command > > gpg --verify > > replacing with the name of the file where you saved the > announcement. The output for a valid signature looks like: > > gpg: Signature made using RSA key ID 3D25D3D9 > gpg: Good signature from "SuSE Security Team " > > where is replaced by the date the document was signed. > > If the security team's key is not contained in your key ring, you can > import it from the first installation CD. To import the key, use the > command > > gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc > > - Package authenticity verification: > > SUSE update packages are available on many mirror FTP servers all over the > world. While this service is considered valuable and important to the free > and open source software community, the authenticity and the integrity of > a package needs to be verified to ensure that it has not been tampered > with. > > There are two verification methods that can be used independently from > each other to prove the authenticity of a downloaded file or RPM package: > > 1) Using the internal gpg signatures of the rpm package > 2) MD5 checksums as provided in this announcement > > 1) The internal rpm package signatures provide an easy way to verify the > authenticity of an RPM package. Use the command > > rpm -v --checksig > > to verify the signature of the package, replacing with the > filename of the RPM package downloaded. The package is unmodified if it > contains a valid signature from build-at-suse.de with the key ID 9C800ACA. > > This key is automatically imported into the RPM database (on > RPMv4-based distributions) and the gpg key ring of 'root' during > installation. You can also find it on the first installation CD and at > the end of this announcement. > > 2) If you need an alternative means of verification, use the md5sum > command to verify the authenticity of the packages. Execute the command > > md5sum > > after you downloaded the file from a SUSE FTP server or its mirrors. > Then compare the resulting md5sum with the one that is listed in the > SUSE security announcement. Because the announcement containing the > checksums is cryptographically signed (by security-at-suse.de), the > checksums show proof of the authenticity of the package if the > signature of the announcement is valid. Note that the md5 sums > published in the SUSE Security Announcements are valid for the > respective packages only. Newer versions of these packages cannot be > verified. > > - SUSE runs two security mailing lists to which any interested party may > subscribe: > > suse-security-at-suse.com > - General Linux and SUSE security discussion. > All SUSE security announcements are sent to this list. > To subscribe, send an e-mail to > . > > suse-security-announce-at-suse.com > - SUSE's announce-only mailing list. > Only SUSE's security announcements are sent to this list. > To subscribe, send an e-mail to > . > > For general information or the frequently asked questions (FAQ), > send mail to or > . > > ===================================================================== > SUSE's security contact is or . > The public key is listed below. > ===================================================================== > ______________________________________________________________________________ > > The information in this advisory may be distributed or reproduced, > provided that the advisory is not modified in any way. In particular, the > clear text signature should show proof of the authenticity of the text. > > SUSE Linux Products GmbH provides no warranties of any kind whatsoever > with respect to the information contained in this security advisory. > > Type Bits/KeyID Date User ID > pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team > pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key > > - -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff > 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d > M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO > QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK > XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE > D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd > G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM > CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE > myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr > YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD > wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d > NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe > QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe > LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t > XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU > D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 > 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot > 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW > cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E > ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f > AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E > Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ > HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h > t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT > tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM > 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q > 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 > QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw > JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ > 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH > ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 > wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY > EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol > 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK > CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co > SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo > omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt > A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J > /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE > GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf > ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT > ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 > RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ > 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb > B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X > 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA > 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj > qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p > WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL > hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG > BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ > AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi > RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 > zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM > /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 > whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl > D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz > dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI > RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI > DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= > =LRKC > - -----END PGP PUBLIC KEY BLOCK----- > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (GNU/Linux) > > iQEVAwUBQxRuSHey5gA9JdPZAQKaUAgAkQsKdm2Mzo8/4re3JrzG6LiXhw79oRFR > 0H/ZIenkXfjVN3CEBffGDJhJkGA1GrizInVw+ZAS2myAPB8LzPhBaI1QGNlFYUo7 > GQtunZK7hgY8Az0VrleF1ZK5B1p8hr+DuP3KgK6QMVfAm8sptOgFoOJRP3OjLydD > RAJoSHCrAgCzWxW4XS0GeJcTKYaq8RVlW1QVD9AJYblT2G/96QhKusCCagR78Gy0 > kqlrStMF7ZmQP1u+KnLCSk+y0VT86UVSWxJkXuN9J93zTkkcSnY6p0bVvKmKroXA > PPmlsiZL71PtP65f74hAYF7xaiELfaOCU257i4UGtZbNhbhibnFgHg== > =mpni > -----END PGP SIGNATURE-----
|
|