date:20150128

What is Ghost i.e security hole in the Linux?

2015-01-28 Thread Norah Jones

Hi, 

Can someone describe in detail about the Ghost security hole. And is there any 
patch or a solution to fix it?

Thanks,
Norah Jones


-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org

Re: Linux and Skype Video

2015-01-28 Thread Tim

Can you stop posting this at the top of your replies:

 This message is probably spam
  
 Symbol: ONCE_RECEIVED(1.00)
  
 X-Virus-Scanned: clamav-milter 0.98.4 at mcbain0012
 X-Virus-Status: Clean

The spam indication is obviously wrong, something declaring that it's
not a virus is not trustworthy to other people (here, run the attached
file, because I say it's safe), and very annoying in general.

-- 
All mail to my mailbox is automatically deleted, there is no point trying
to privately email me, I will only read messages posted to the public lists.


-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org

Re: What is Ghost i.e security hole in the Linux?

2015-01-28 Thread Frank Elsner

On Wed, 28 Jan 2015 14:21:41 + Norah Jones wrote:
 Hi, 
 
 Can someone describe in detail about the Ghost security hole. And is there 
 any patch or a solution to fix it?

You should read 

https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability


--Frank
-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org

Re: No sound in Skype on Fedora 20 64-bit

2015-01-28 Thread Ian Malone

On 28 January 2015 at 02:53, Jim Lewis j...@jklewis.com wrote:



 On 01/27/2015 06:37 PM, Jim Lewis wrote:
   Okay, so I installed lpf-skype on Fedora 20 and also got the no sound
 problem. When I tried to fix it by doing what I did on F21:

 yum -y install pulseaudio-libs.i686 alsa-plugins-pulseaudio.i686



   Protected multilib versions: pulseaudio-libs-5.0-25.fc20.i686 !=
 pulseaudio-libs-5.0-7.fc20.x86_64

   How do I fix that one?

jd1008:
 So, how did you install lpf-skype?
 If you used yum, yum would have resolved all dependencies,
 so you would not have had to install anything afterwards.



 I used yum to install lpf-skype.

It sounds like lpf-skype has its dependencies wrong as it probably
should be listing 32bit pulse (it'll run without it, but wont perform
its major function).

Your immediate problem though is getting the 32 bit pulse installed.
The bit you snipped from the error is telling you more about it
Multilib version problems found. This often means that the root
cause is something else and multilib version checking is just
pointing out that there is a problem.

For some reason yum has determined it would be trying to install a
different version of 32bit pulseaudio-libs (5.0-25) to the 64bit one
(5.0-7). Normally it would just update the 64bit one so both are the
same version, something is preventing it from doing that.
Possibilities:
Something with a dependency on the older 64 bit version that doesn't
have an update available. Third party repositories or packages
installed without a repository are the likely culprits. - In this case
if you can find and remove the blocking package then you'll be able to
update, but you may not be able to reinstall.
Repo metadata is not properly updated yet and the newer 32bit library
is visible while the newer 64bit is not. In this case just waiting and
trying again later will probably work.
In either case you could get around it by installing the older 32bit
version, telling yum to install pulseaudio-libs-5.0-7.fc20.i686
(provided it's still available), though if something is holding you at
the older version you will run into it again at some point.

-- 
imalone
http://ibmalone.blogspot.co.uk
-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org

Re: What is Ghost i.e security hole in the Linux?

2015-01-28 Thread Doug

On 01/28/2015 09:21 AM, Norah Jones wrote:

Hi,

Can someone describe in detail about the Ghost security hole. And is there any
patch or a solution to fix it?

Thanks,
Norah Jones

The following is repeated verbatim from the PCLinuxOS Forum:

(Posted by jzakiya)

glibc vulnerbility
« on: Yesterday at 04:28:36 PM »

Quote

Articles outlines security bug in pre glibc-2.17 (pclos at glibc-2.16-7)

http://www.openwall.com/lists/oss-security/2015/01/27/9

http://arstechnica.com/security/2015/01/highly-critical-ghost-allowing-code-execution-affects-most-linux-systems/

An extremely critical vulnerability affecting most Linux distributions gives
attackers the ability to execute malicious code on servers used to deliver
e-mail, host webpages, and carry out other vital functions.

The vulnerability in the GNU C Library (glibc) represents a major Internet threat, in
some ways comparable to the Heartbleed and Shellshock bugs that came to light last year.
The bug, which is being dubbed Ghost by some researchers, has the common
vulnerability and exposures designation of CVE-2015-0235. While a patch was issued two
years ago, most Linux versions used in production systems remain unprotected at the
moment. What's more, patching systems requires core functions or the entire affected
server to be rebooted, a requirement that may cause some systems to remain vulnerable for
some time to come.

The buffer overflow flaw resides in __nss_hostname_digits_dots(), a glibc
function that's invoked by the gethostbyname() and gethostbyname2() function
calls. A remote attacker able to call either of these functions could exploit
the flaw to execute arbitrary code with the permissions of the user running the
application. In a blog post published Tuesday, researchers from security firm
Qualys said they were able to write proof-of-concept exploit code that carried
out a full-fledged remote code execution attack against the Exim mail server.
The exploit bypassed all existing exploit protections available on both 32-bit
and 64-bit systems, including address space layout randomization, position
independent executions, and no execute protections. Qualys has not yet
published the exploit code but eventually plans to make it available as a
Metasploit module.
“A lot of collateral damage on the Internet”

The glibc is the most common code library used by Linux. It contains standard
functions that programs written in the C and C++ languages use to carry out
common tasks. The vulnerability also affects Linux programs written in Python,
Ruby, and most other languages because they also rely on glibc. As a result,
most Linux systems should be presumed vulnerable unless they run an alternative
to glibc or use a glibc version that contains the update from two years ago.
The specter of so many systems being susceptible to an exploit with such severe
consequences is prompting concern among many security professionals. Besides
Exim, other Linux components or apps that are potentially vulnerable to Ghost
include MySQL servers, Secure Shell servers, form submission apps, and other
types of mail servers.

If [researchers] were able to remotely exploit a pretty modern version of Exim with full
exploit mitigations, that's pretty severe, said Jon Oberheide, a Linux security expert and
the CTO of two-factor authentication service Duo Security. There could be a lot of collateral
damage on the Internet if this exploit gets published publicly, which it looks like they plan to
do, and if other people start to write exploits for other targets.

The bug affects virtually all Linux-based software that performs domain name
resolution. As result, it most likely can be exploited not only against servers
but also client applications. Word of the vulnerability appears to have caught
developers of the Ubuntu, Debian, and Red Hat distributions of Linux off guard.
At the time this post was being prepared they appeared to be aware of the bug
but had not yet distributed a ready-made fix. People who administer Linux
systems should closely monitor official channels for information about how
specific distributions are affected and whether a patch is available. Admins
should also prepare for the inevitable reboots that will be required after
installing the patch.
Report to moderator Logged
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org

60 matches

Mail list logo