[SECURITY] [DSA 222-1] New xpdf packages fix arbitrary command execution

2003-01-07 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 222-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze January 6th, 2003

FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Miles Beck
Hello, Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions have security flaws, see advisory at www.openssl.org,

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Noah L. Meyerhans
On Tue, Jan 07, 2003 at 08:00:11AM -0700, Miles Beck wrote: Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? Yes, 0.9.6c-2.woody.1. It contains all the security fixes present in openssl-0.9.6g. ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or

Re: Updated OPENSSL package for Debian?

2003-01-07 Thread Miles Beck
Hello, Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions have security flaws, see advisory at

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Adrian 'Dagurashibanipal' von Bidder
On Tue, 2003-01-07 at 16:00, Miles Beck wrote: Hello, Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions

Re: [SECURITY] [DSA 222-1] New xpdf packages fix arbitrary command execution

2003-01-07 Thread Erik Tews
On Tue, Jan 07, 2003 at 10:56:58AM -0500, Raymond Wood wrote: Does anyone know if the 'xpdf-i' is affected by this also, or not? apt-cache show xpdf-i gave me the following lines: This is a dummy package required to ensure your xpdf is upgraded to the latest xpdf package if you

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Noah L. Meyerhans
On Tue, Jan 07, 2003 at 05:08:23PM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: So the version from testing should do. You may want to download the source package and compile it yourself to avoid having to upgrade dependencies (I don't know, just speculating). Why tell him that? What

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Phillip Hofmeister
On Tue, 07 Jan 2003 at 08:00:11AM -0700, Miles Beck wrote: Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Marcel Weber
Miles Beck wrote: Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions have security flaws, see advisory at

Re: [SECURITY] [DSA 222-1] New xpdf packages fix arbitrary command execution

2003-01-07 Thread Matt Zimmerman
On Tue, Jan 07, 2003 at 10:56:58AM -0500, Raymond Wood wrote: We recommend that you upgrade your xpdf package. [snip] Does anyone know if the 'xpdf-i' is affected by this also, or not? xpdf-i in woody is a dummy package, as the standard xpdf package now implements the same functionality.

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Adrian 'Dagurashibanipal' von Bidder
On Tue, 2003-01-07 at 19:16, Noah L. Meyerhans wrote: On Tue, Jan 07, 2003 at 05:08:23PM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: So the version from testing should do. You may want to download the source package and compile it yourself to avoid having to upgrade dependencies (I

TCP port 6352?

2003-01-07 Thread Josh Carroll
Having failed to find any information about TCP port 6352 via google or /etc/services, I figured I'd ask here. I'm seeing an awful lot of dropped packets on this port recently, and I'm curious if anyone else has seen this. If so, what purpose does TCP port 6352 serve (either in the *nix domain

Re: raw disk access

2003-01-07 Thread Blars Blarson
In article [EMAIL PROTECTED] [EMAIL PROTECTED] writes: i am looking for forensics tools that can be used in computer crime investigations, and am particularly interesting in a tool that provides raw drive (hard, floppy, CD, DVD, etc.) access in order to create complete

Re: raw disk access

2003-01-07 Thread Andrew Sayers
What you're asking for is trivially available on all Linux systems. Through the /dev filesystem, the kernel makes many hardware devices available to ordinary programs. For example, if you had mounted your target disk as the secondary master hard drive, you could create an image of the disk by

ssh and lastlog

2003-01-07 Thread Thomas Gebhardt
Hi, as far as I can see, one can get at least 2 out of the following 3 items: * sshd Privilege Separation * /var/log/wtmp not world readable * users get a lastlog message at ssh login Am I right here? One could also enable the sshd UseLogin option to get the login lastlog message, but I'm

Re: [SECURITY] [DSA 222-1] New xpdf packages fix arbitrary command execution

2003-01-07 Thread Raymond Wood
On Mon, Jan 06, 2003 at 05:22:48PM +0100, Martin Schulze remarked: -- Debian Security Advisory DSA 222-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze

Re: Updated OPENSSL package for Debian?

2003-01-07 Thread Miles Beck
Hello, Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions have security flaws, see advisory at

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Adrian 'Dagurashibanipal' von Bidder
On Tue, 2003-01-07 at 16:00, Miles Beck wrote: Hello, Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Phillip Hofmeister
On Tue, 07 Jan 2003 at 08:00:11AM -0700, Miles Beck wrote: Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions

Re: [SECURITY] [DSA 222-1] New xpdf packages fix arbitrary command execution

2003-01-07 Thread Erik Tews
On Tue, Jan 07, 2003 at 10:56:58AM -0500, Raymond Wood wrote: Does anyone know if the 'xpdf-i' is affected by this also, or not? apt-cache show xpdf-i gave me the following lines: This is a dummy package required to ensure your xpdf is upgraded to the latest xpdf package if you

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Noah L. Meyerhans
On Tue, Jan 07, 2003 at 05:08:23PM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: So the version from testing should do. You may want to download the source package and compile it yourself to avoid having to upgrade dependencies (I don't know, just speculating). Why tell him that? What

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Marcel Weber
Miles Beck wrote: Is there an updated OPENSSL package for Debian greater than OpenSSL-0.9.6c? ~/Net_SSLeay.pm-1.21$ perl Makefile.PL Checking for OpenSSL-0.9.6g or newer... You have OpenSSL-0.9.6c installed in /usr openssl-0.9.6d and earlier versions have security flaws, see advisory at

Re: [SECURITY] [DSA 222-1] New xpdf packages fix arbitrary command execution

2003-01-07 Thread Matt Zimmerman
On Tue, Jan 07, 2003 at 10:56:58AM -0500, Raymond Wood wrote: We recommend that you upgrade your xpdf package. [snip] Does anyone know if the 'xpdf-i' is affected by this also, or not? xpdf-i in woody is a dummy package, as the standard xpdf package now implements the same functionality.

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Adrian 'Dagurashibanipal' von Bidder
On Tue, 2003-01-07 at 19:16, Noah L. Meyerhans wrote: On Tue, Jan 07, 2003 at 05:08:23PM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: So the version from testing should do. You may want to download the source package and compile it yourself to avoid having to upgrade dependencies (I

TCP port 6352?

2003-01-07 Thread Josh Carroll
Having failed to find any information about TCP port 6352 via google or /etc/services, I figured I'd ask here. I'm seeing an awful lot of dropped packets on this port recently, and I'm curious if anyone else has seen this. If so, what purpose does TCP port 6352 serve (either in the *nix domain

Re: FW: Updated OPENSSL package for Debian?

2003-01-07 Thread Mark L. Kahnt
On Tue, 2003-01-07 at 15:23, Adrian 'Dagurashibanipal' von Bidder wrote: On Tue, 2003-01-07 at 19:16, Noah L. Meyerhans wrote: On Tue, Jan 07, 2003 at 05:08:23PM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: So the version from testing should do. You may want to download the

Re: Updated OPENSSL package for Debian?

2003-01-07 Thread Cristian Ionescu-Idbohrn
On Tue, 7 Jan 2003, Adrian 'Dagurashibanipal' von Bidder wrote: Some might feel more comfortable with installing a package from testing than with modifying version checks in a configure script. But I agree that I probably should have said that testing, of course, does not have security

raw disk access

2003-01-07 Thread viv
Hi. As a Debian user, i am posting to this list first in the hopes that what i am looking for can be found as a Debian package. i am looking for forensics tools that can be used in computer crime investigations, and am particularly interesting in a tool

Re: TCP port 6352?

2003-01-07 Thread Olaf Meeuwissen
Josh Carroll [EMAIL PROTECTED] writes: Having failed to find any information about TCP port 6352 via google or /etc/services, I figured I'd ask here. I'm seeing an awful lot of dropped packets on this port recently, and I'm curious if anyone else has seen this. If so, what purpose does TCP

Re: raw disk access

2003-01-07 Thread Steve Mickeler
man dd On Tue, 7 Jan 2003, viv wrote: Hi. As a Debian user, i am posting to this list first in the hopes that what i am looking for can be found as a Debian package. i am looking for forensics tools that can be used in computer crime investigations, and am

Re: raw disk access

2003-01-07 Thread Dale Southard
Is the `dd` command what you are looking for (in combination with /dev/loop?), or is there some requirement that wasn't mentioned in your message? viv [EMAIL PROTECTED] writes: i am looking for forensics tools that can be used in computer crime investigations, and am

Re: raw disk access

2003-01-07 Thread Blars Blarson
In article [EMAIL PROTECTED] [EMAIL PROTECTED] writes: i am looking for forensics tools that can be used in computer crime investigations, and am particularly interesting in a tool that provides raw drive (hard, floppy, CD, DVD, etc.) access in order to create complete

Re: raw disk access

2003-01-07 Thread Andrew Sayers
What you're asking for is trivially available on all Linux systems. Through the /dev filesystem, the kernel makes many hardware devices available to ordinary programs. For example, if you had mounted your target disk as the secondary master hard drive, you could create an image of the disk by