Re: SSH Update for Potato?

2003-09-17 Thread Andreas Barth
* Shane Machon ([EMAIL PROTECTED]) [030917 06:50]: > On a more general note, is potato still supported by the Security Team? No. There was a notice sometimes ago. Cheers, Andi -- http://home.arcor.de/andreas-barth/ PGP 1024/89FB5CE5 DC F1 85 6D A6 45 9C 0F 3B BE F1 D0 C5 D1 D9 0C

Re: SSH Update for Potato?

2003-09-17 Thread Andreas Barth
* Shane Machon ([EMAIL PROTECTED]) [030917 06:50]: > On a more general note, is potato still supported by the Security Team? No. There was a notice sometimes ago. Cheers, Andi -- http://home.arcor.de/andreas-barth/ PGP 1024/89FB5CE5 DC F1 85 6D A6 45 9C 0F 3B BE F1 D0 C5 D1 D9

SSH Update for Potato?

2003-09-16 Thread Shane Machon
Hi Guys, This might be a longshot, but is there an update for potato? Is it vulnerable? I unfortunately still have a few clients running potato boxes. :( I didnt see anything about potato in the DSA. On a more general note, is potato still supported by the Security Team? If not then I will

SSH Update for Potato?

2003-09-16 Thread Shane Machon
Hi Guys, This might be a longshot, but is there an update for potato? Is it vulnerable? I unfortunately still have a few clients running potato boxes. :( I didnt see anything about potato in the DSA. On a more general note, is potato still supported by the Security Team? If not then I will

Re: php4 vulnerability - is potato affected?

2003-07-17 Thread Matt Zimmerman
On Thu, Jul 17, 2003 at 12:41:21PM +0200, Robert Varga wrote: > Are potato php4 packages (4.0.3pl1-0potato4) affected by the sechole > warned about in the recent DSA-351-1? > > If they are, will there be fixes for potato as well, or should we upgrade > to woody? potato is no l

Re: php4 vulnerability - is potato affected?

2003-07-17 Thread Matt Zimmerman
On Thu, Jul 17, 2003 at 12:41:21PM +0200, Robert Varga wrote: > Are potato php4 packages (4.0.3pl1-0potato4) affected by the sechole > warned about in the recent DSA-351-1? > > If they are, will there be fixes for potato as well, or should we upgrade > to woody? potato is no l

php4 vulnerability - is potato affected?

2003-07-17 Thread Robert Varga
Hello All, Are potato php4 packages (4.0.3pl1-0potato4) affected by the sechole warned about in the recent DSA-351-1? If they are, will there be fixes for potato as well, or should we upgrade to woody? Regards, Robert Varga

php4 vulnerability - is potato affected?

2003-07-17 Thread Robert Varga
Hello All, Are potato php4 packages (4.0.3pl1-0potato4) affected by the sechole warned about in the recent DSA-351-1? If they are, will there be fixes for potato as well, or should we upgrade to woody? Regards, Robert Varga -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of

Patched Sendmail package for potato/i386 (CA-2003-07)

2003-03-04 Thread Peter Parkkali
Hello, I applied the patch on Sendmail's web page to the sendmail sources for potato (8.9.3). I put the compiled package here: http://www.sci.fi/~pfp/sendmail-deb-ca-2003-07/ I haven't tested this (does an exploit exist yet?), other than confirming that sendmail itself works... -- p

Patched Sendmail package for potato/i386 (CA-2003-07)

2003-03-04 Thread Peter Parkkali
Hello, I applied the patch on Sendmail's web page to the sendmail sources for potato (8.9.3). I put the compiled package here: http://www.sci.fi/~pfp/sendmail-deb-ca-2003-07/ I haven't tested this (does an exploit exist yet?), other than confirming that sendmail itself works... -- p f

Re: ssh upgrade problems (potato)

2002-09-27 Thread Simon Young
ike it a lot. But I also found the *real* problem... Whenever I did a chmod 000 `which ssh-keygen`, I was just making sure this had the desired effect... ls -l `which ssh-keygen` lrwxrwxrwx1 root root 11 Nov 15 1999 /usr/local/bin/ssh-keygen -> ssh-keygen1 I thought that was kin

Re: ssh upgrade problems (potato)

2002-09-27 Thread Tim Haynes
Simon Young <[EMAIL PROTECTED]> writes: > On Fri, Sep 27, 2002 at 10:10:16AM -0400, don wrote: >> >> if its a local machine you could dpkg --purg the old ssh then just do >> your install > > Yes indeed. > > I could do that, and it would probably work. In fact, this is most likely > what I'll end

Re: ssh upgrade problems (potato)

2002-09-27 Thread Simon Young
On Fri, Sep 27, 2002 at 10:10:16AM -0400, don wrote: > > if its a local machine you could dpkg --purg > the old ssh then just do your install Yes indeed. I could do that, and it would probably work. In fact, this is most likely what I'll end up doing - but first I'd really like to know what the

ssh upgrade problems (potato)

2002-09-27 Thread Simon Young
Hi all, I know this query is a little out of date, but I was wondering if anyone had seen this before. I'm trying to upgrade ssh on one of my potato machines. But I always get this: # dpkg -i ssh_1%3a3.4p1-0.0potato1_i386.deb > (Reading database ... 35706 files and directories c

Re: ssh upgrade problems (potato)

2002-09-27 Thread Simon Young
like it a lot. But I also found the *real* problem... Whenever I did a chmod 000 `which ssh-keygen`, I was just making sure this had the desired effect... ls -l `which ssh-keygen` lrwxrwxrwx1 root root 11 Nov 15 1999 /usr/local/bin/ssh-keygen -> ssh-keygen1 I thought that was kin

Re: ssh upgrade problems (potato)

2002-09-27 Thread Tim Haynes
Simon Young <[EMAIL PROTECTED]> writes: > On Fri, Sep 27, 2002 at 10:10:16AM -0400, don wrote: >> >> if its a local machine you could dpkg --purg the old ssh then just do >> your install > > Yes indeed. > > I could do that, and it would probably work. In fact, this is most likely > what I'll end

Re: ssh upgrade problems (potato)

2002-09-27 Thread Simon Young
On Fri, Sep 27, 2002 at 10:10:16AM -0400, don wrote: > > if its a local machine you could dpkg --purg > the old ssh then just do your install Yes indeed. I could do that, and it would probably work. In fact, this is most likely what I'll end up doing - but first I'd really like to know what th

ssh upgrade problems (potato)

2002-09-27 Thread Simon Young
Hi all, I know this query is a little out of date, but I was wondering if anyone had seen this before. I'm trying to upgrade ssh on one of my potato machines. But I always get this: # dpkg -i ssh_1%3a3.4p1-0.0potato1_i386.deb > (Reading database ... 35706 files and directories c

Re: OpenSSL and Potato a request for clarificiation

2002-09-16 Thread Peter Cordes
On Mon, Sep 16, 2002 at 10:34:08AM +0100, John Winters wrote: > Sorry - I think what I just wrote about updates was complete balls. Yup. security.d.o is outside the US, so it has the updates for non-US mixed in with everything else. Moreover, security.d.o _is_ non-us.d.o: llama]~$ host non-us.

Re: OpenSSL and Potato a request for clarificiation

2002-09-16 Thread John Winters
Sorry - I think what I just wrote about updates was complete balls. John -- The Linux Emporium - the source for Linux CDs in the UK See http://www.linuxemporium.co.uk/ Evolution is now exciting.

Re: OpenSSL and Potato a request for clarificiation

2002-09-16 Thread John Winters
On Sun, 2002-09-15 at 22:14, Noah L. Meyerhans wrote: > On Sun, Sep 15, 2002 at 12:42:04PM +0100, John Winters wrote: > > Can anyone clarify this please? Have the relevant fixes from openssl > > 0.9.6e been back-ported into openssl-0.9.6c-0.potato.2? > > The problem is that

Re: OpenSSL and Potato a request for clarificiation

2002-09-15 Thread Noah L. Meyerhans
On Sun, Sep 15, 2002 at 12:42:04PM +0100, John Winters wrote: > Can anyone clarify this please? Have the relevant fixes from openssl > 0.9.6e been back-ported into openssl-0.9.6c-0.potato.2? The problem is that potato has more than one version of openssl. The security team had to p

Re: OpenSSL and Potato a request for clarificiation

2002-09-15 Thread Siggy Brentrup
On Sun, Sep 15, 2002 at 12:42:04PM +0100, John Winters wrote: > [...] > Can anyone clarify this please? Have the relevant fixes from openssl > 0.9.6e been back-ported into openssl-0.9.6c-0.potato.2? Did you look into the doc/openssl/changelog(.Debian)?.gz? HTH Siggy

OpenSSL and Potato a request for clarificiation

2002-09-15 Thread John Winters
In the light of the recent reports of an exploit in OpenSSL I've been reviewing my servers. Some of them are still running Potato and the status of the updates to Potato seem unclear. The announcement on Debian Security Announce dated 30th July says that no fix for Potato is available.

Potato security

2002-08-06 Thread Tomohiro KUBOTA
Hi, DSA-136 for potato seems not be available so far, even though more than one week has gone since DSA-136 was released. http://www.debian.org/security/2002/dsa-136 DSA-138 and DSA-140 don't mention potato at all. It doesn't mention even whether potato is affected or not.

potato libssl09 package vulnerable?

2002-08-02 Thread Paul Baker
So I see that the openssl, libssl-dev, libssl0.9.6 packages in potato have been fixed for DSA-136-1. I'm wondering if the libssl09 packages are also vulnerable to this exploit? If it is, is a fixed package going to be out soon, or should I be expending the effort to back port wo

Re: Support for Potato

2002-07-25 Thread Wichert Akkerman
Previously Jens Hafner wrote: > I couldn't agree more. Will there be an official announcement on this > list about how long you will be supporting potato? This week I hope. First we need to sort out a few technical issues related to the woody releas

RE: Support for Potato

2002-07-25 Thread Jens Hafner
I couldn't agree more. Will there be an official announcement on this list about how long you will be supporting potato? -Original Message- From: martin f krafft [mailto:[EMAIL PROTECTED] Sent: Thursday, July 25, 2002 1:08 AM To: 'debian-security@lists.debian.org' Subje

Re: Support for Potato

2002-07-24 Thread Noah L. Meyerhans
On Thu, Jul 25, 2002 at 08:54:17AM +0900, Howland, Curtis wrote: > I can't upgrade, it would require restarting and that would blow my > record on necraft.com Why would you need to restart? Today I wanted to upgrade a busy server (busy with apache & proftp). I put apache & proftp on hold in /var

RE: Support for Potato

2002-07-24 Thread Howland, Curtis
> On Thu, 25 Jul 2002 at 01:08:29AM +0200, martin f krafft wrote: > > least as usable and stable, and until potato->woody is guaranteed to > > progress without any problems... > > > Problems? What problems? Just A LOT of tweaks I can't upgrade, it would r

Re: Support for Potato

2002-07-24 Thread Phillip Hofmeister
On Thu, 25 Jul 2002 at 01:08:29AM +0200, martin f krafft wrote: > least as usable and stable, and until potato->woody is guaranteed to > progress without any problems... > Problems? What problems? Just A LOT of tweaks -- Phil PGP/GPG Key: http://www.zionlth.org/~plhof

Re: Support for Potato

2002-07-24 Thread martin f krafft
to's maintenance to be, roughly and on average? I've had loads of users ask if potato was to be continued because it just perfectly suits their needs and they don't want new stuff. It might just be worth it. The occasional security fix here and there, other than that it's not rea

Re: Support for Potato

2002-07-24 Thread Wichert Akkerman
Previously Desai, Jason wrote: > Does anybody know how long Debian will officially be supporting Potato and > providing security updates for it? Currently we're thinking of at least 3 months full support and somewhat longer for remote exploits. We haven't made any decisions yet

Re: Support for Potato

2002-07-24 Thread Noah L. Meyerhans
On Wed, Jul 24, 2002 at 01:24:51PM -0400, Desai, Jason wrote: > Does anybody know how long Debian will officially be supporting Potato and > providing security updates for it? We haven't yet announced anything officially. We do want to continue to support it for a longer time than w

Support for Potato

2002-07-24 Thread Desai, Jason
Does anybody know how long Debian will officially be supporting Potato and providing security updates for it? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: sources.list for potato

2002-06-23 Thread Olaf Meeuwissen
Wichert Akkerman <[EMAIL PROTECTED]> writes: > Previously Olaf Meeuwissen wrote: > > For a truly stable Debian system, drop > > deb http://http.us.debian.org/debian dists/potato-proposed-updates/ > > I wouldn't recom

Re: sources.list for potato

2002-06-21 Thread vdongen
-Original Message- From: Wichert Akkerman <[EMAIL PROTECTED]> Date: Fri, 21 Jun 2002 16:05:10 +0200 Subject: Re: sources.list for potato > Previously Pavel Minev Penev wrote: > > And there is no > > > > deb http://non-us.debian.org/debian-security unstable/

Re: sources.list for potato

2002-06-21 Thread Wichert Akkerman
Previously Pavel Minev Penev wrote: > And there is no > > deb http://non-us.debian.org/debian-security unstable/updates main > contrib non-free > > , is it? No, and there never will be. Wichert. -- _ /[EMAIL PROTECTED]

Re: sources.list for potato

2002-06-21 Thread Pavel Minev Penev
On Fri, Jun 21, 2002 at 08:22:32AM +0900, Olaf Meeuwissen wrote: > Mike Dresser <[EMAIL PROTECTED]> writes: > > > Hate to beat a dead horse, but > > > > > > deb http://http.us.debian.org/debian potato main contrib non-free > > deb http://http.us.debia

Re: sources.list for potato

2002-06-21 Thread Jamie Heilman
Wichert Akkerman wrote: > Previously Olaf Meeuwissen wrote: > > For a truly stable Debian system, drop > > deb http://http.us.debian.org/debian dists/potato-proposed-updates/ > > I wouldn't recommend that, on occasion a package makes it into > proposed-upda

Re: sources.list for potato

2002-06-21 Thread Wichert Akkerman
Previously Olaf Meeuwissen wrote: > For a truly stable Debian system, drop > > deb http://http.us.debian.org/debian dists/potato-proposed-updates/ I wouldn't recommend that, on occasion a package makes it into proposed-updates that really should not be installed on a potato r

Re: sources.list for potato

2002-06-20 Thread Olaf Meeuwissen
Mike Dresser <[EMAIL PROTECTED]> writes: > > For a truly stable Debian system, drop > > > > deb http://http.us.debian.org/debian dists/potato-proposed-updates/ > > > > (wait for official release updates) and then just s/potato/stable/g. > > Note that

Re: sources.list for potato

2002-06-20 Thread Olaf Meeuwissen
Geoff Crompton <[EMAIL PROTECTED]> writes: > > Oops! I confused the "crypto in main" issue with non-US being phased > > out. Of course, the patented bits will stay in non-US so it will not > > disappear in the foreseeable future. > > What is the 'cypto in main' issue? (Or better, have you got

Re: sources.list for potato

2002-06-20 Thread Geoff Crompton
On Fri, 21 Jun 2002 00:36, Olaf Meeuwissen wrote: > Geoff Crompton <[EMAIL PROTECTED]> writes: > > On Thu, 20 Jun 2002 23:22, Olaf Meeuwissen wrote: > > > (wait for official release updates) and then just s/potato/stable/g. > > > Note that non-US is being phased o

Re: sources.list for potato

2002-06-20 Thread Olaf Meeuwissen
Geoff Crompton <[EMAIL PROTECTED]> writes: > On Thu, 20 Jun 2002 23:22, Olaf Meeuwissen wrote: > > (wait for official release updates) and then just s/potato/stable/g. > > Note that non-US is being phased out. > > Can you point me to the mail-archive thread tha

Re: sources.list for potato

2002-06-20 Thread Mike Dresser
> For a truly stable Debian system, drop > > deb http://http.us.debian.org/debian dists/potato-proposed-updates/ > > (wait for official release updates) and then just s/potato/stable/g. > Note that non-US is being phased out. I've seen way too many packages that take too

Re: sources.list for potato

2002-06-20 Thread Geoff Crompton
On Thu, 20 Jun 2002 23:22, Olaf Meeuwissen wrote: > (wait for official release updates) and then just s/potato/stable/g. > Note that non-US is being phased out. Can you point me to the mail-archive thread that discusses this?(I haven't been following debian lists for very long)

Re: sources.list for potato

2002-06-20 Thread Olaf Meeuwissen
Mike Dresser <[EMAIL PROTECTED]> writes: > Hate to beat a dead horse, but > > > deb http://http.us.debian.org/debian potato main contrib non-free > deb http://http.us.debian.org/debian dists/potato-proposed-updates/ > > deb http://non-us.debian.org/debian-non-US

sources.list for potato

2002-06-20 Thread Mike Dresser
Hate to beat a dead horse, but deb http://http.us.debian.org/debian potato main contrib non-free deb http://http.us.debian.org/debian dists/potato-proposed-updates/ deb http://non-us.debian.org/debian-non-US potato/non-US main contrib non-free deb http://non-us.debian.org/debian-security potato

Re: Security problem in PHP3+Postgres with Potato?

2002-04-23 Thread SIBAUD Benoît FTRD/DAC/ISS
Hi, In March the 25th, I wrote a line about a security problem with PHP3+postgres+apache shipped with Potato, due to character encoding. The security team judged it wasn't a security problem, so I suppose I can publish details about the problem. apache 1.3.9-14 php3 3

Re: Security problem in PHP3+Postgres with Potato?

2002-04-23 Thread SIBAUD Benoît FTRD/DAC/ISS
Hi, In March the 25th, I wrote a line about a security problem with PHP3+postgres+apache shipped with Potato, due to character encoding. The security team judged it wasn't a security problem, so I suppose I can publish details about the problem. apache 1.3.9-14 php3 3

Re: DoS in Shells: was Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread Kurt Seifried
This is, to put it politely, incredibly old news. Let's face it, if you give a user a shell acount, with no restrictions on CPU time or memory usage, yes, they will be able to suck up as much resources as the computer can spare (this is, among other reasons why "nice" exists). I advise you place li

Re: DoS in Shells: was Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread Kurt Seifried
This is, to put it politely, incredibly old news. Let's face it, if you give a user a shell acount, with no restrictions on CPU time or memory usage, yes, they will be able to suck up as much resources as the computer can spare (this is, among other reasons why "nice" exists). I advise you place l

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread martin f krafft
also sprach Alun Jones <[EMAIL PROTECTED]> [2002.04.04.0445 +0200]: > > DenyFilter \*.*/ > > Just as a quick question, why not deny the string "/../" (you may have to > deny the regex "/\.\./", depending how the filter in question works)? quick answer: because i merely copied the fix from the s

Re: DoS in Shells: was Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread Chip McClure
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Also tested, and vulnerable on: FreeBSD 4.5-RELEASE FreeBSD 4.5-RELEASE #0: Mon Jan 28 14:31:56 GMT 2002 [EMAIL PROTECTED]:/usr/src/sys/compile/GENERIC i386 Tested using the shells bash, csh, ksh, zsh. Chip - - Chip McClure Sr. Unix Administra

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread martin f krafft
also sprach Alun Jones <[EMAIL PROTECTED]> [2002.04.04.0445 +0200]: > > DenyFilter \*.*/ > > Just as a quick question, why not deny the string "/../" (you may have to > deny the regex "/\.\./", depending how the filter in question works)? quick answer: because i merely copied the fix from the

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread Justin Shore
On 3/29/02 3:40 PM martin f krafft said... >dear bugtraq'ers, > >i must confess that the information i provided wrt the acclaimed DoS >exploit in Debian potato's proftpd package (1.2.0pre10-2.0potato1) was >not fully accurate. the package *does in fact contain a buggy daemon* >despite having been

Re: DoS in Shells: was Re: DoS in debian (potato) proftpd:1.2.0pre10-2.0potato1

2002-04-04 Thread Chip McClure
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Also tested, and vulnerable on: FreeBSD 4.5-RELEASE FreeBSD 4.5-RELEASE #0: Mon Jan 28 14:31:56 GMT 2002 [EMAIL PROTECTED]:/usr/src/sys/compile/GENERIC i386 Tested using the shells bash, csh, ksh, zsh. Chip - - Chip McClure Sr. Unix Administr

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-04 Thread Justin Shore
On 3/29/02 3:40 PM martin f krafft said... >dear bugtraq'ers, > >i must confess that the information i provided wrt the acclaimed DoS >exploit in Debian potato's proftpd package (1.2.0pre10-2.0potato1) was >not fully accurate. the package *does in fact contain a buggy daemon* >despite having been

DoS in Shells: was Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-03 Thread reaktor
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello All, I can confirm that the ls strings dos' slackware 8.0. Causes shell process of that user (user or root) to chew up the cpu until the shell terminates on sig 11. Works on any shell the user is using, csh, ksh, bash Tested on: Linux 2.2.1

DoS in Shells: was Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-03 Thread reaktor
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello All, I can confirm that the ls strings dos' slackware 8.0. Causes shell process of that user (user or root) to chew up the cpu until the shell terminates on sig 11. Works on any shell the user is using, csh, ksh, bash Tested on: Linux 2.2.1

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-03 Thread Alun Jones
At 03:40 PM 3/29/2002, martin f krafft wrote: ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* ... DenyFilter \*.*/ Just as a quick question, why not deny the string "/../" (you may have to deny the regex "/\.\./", depending how the filter in question works)? As far a

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-04-03 Thread Alun Jones
At 03:40 PM 3/29/2002, martin f krafft wrote: > ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* ... > DenyFilter \*.*/ Just as a quick question, why not deny the string "/../" (you may have to deny the regex "/\.\./", depending how the filter in question works)? As far as

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-03-29 Thread martin f krafft
dear bugtraq'ers, i must confess that the information i provided wrt the acclaimed DoS exploit in Debian potato's proftpd package (1.2.0pre10-2.0potato1) was not fully accurate. the package *does in fact contain a buggy daemon* despite having been fixed, according to the changelog: proftpd (1.2

Re: DoS in debian (potato) proftpd: 1.2.0pre10-2.0potato1

2002-03-29 Thread martin f krafft
dear bugtraq'ers, i must confess that the information i provided wrt the acclaimed DoS exploit in Debian potato's proftpd package (1.2.0pre10-2.0potato1) was not fully accurate. the package *does in fact contain a buggy daemon* despite having been fixed, according to the changelog: proftpd (1.

Re: DoS in debian (potato) proftpd

2002-03-27 Thread Gustavo Franco
On Wed, 27 Mar 2002 00:37:59 +0100 martin f krafft <[EMAIL PROTECTED]> wrote: >> [...] > > (please fix your line wraps!) > > security.debian.org has proftpd_1.2.0pre10-2.0potato1 which does not > contain this bug, at least not on i386 systems: > > fishbowl:~> ncftp lapse.home.madduck.net > NcFT

Re: DoS in debian (potato) proftpd

2002-03-27 Thread Gustavo Franco
On Wed, 27 Mar 2002 00:37:59 +0100 martin f krafft <[EMAIL PROTECTED]> wrote: >> [...] > > (please fix your line wraps!) > > security.debian.org has proftpd_1.2.0pre10-2.0potato1 which does not > contain this bug, at least not on i386 systems: > > fishbowl:~> ncftp lapse.home.madduck.net > NcF

Re: DoS in debian (potato) proftpd

2002-03-27 Thread Sven Hoexter
On Wed, Mar 27, 2002 at 12:37:59AM +0100, martin f krafft wrote: > also sprach Joe Dollard <[EMAIL PROTECTED]> [2002.03.25.2114 +0100]: Hi, > > The version of proftp that is in debian potato (1.2.0pre10 as > > reported by running 'proftpd -v ') is vulnerab

Re: DoS in debian (potato) proftpd

2002-03-27 Thread Sven Hoexter
On Wed, Mar 27, 2002 at 12:37:59AM +0100, martin f krafft wrote: > also sprach Joe Dollard <[EMAIL PROTECTED]> [2002.03.25.2114 +0100]: Hi, > > The version of proftp that is in debian potato (1.2.0pre10 as > > reported by running 'proftpd -v ') is vulnerab

Re: DoS in debian (potato) proftpd

2002-03-26 Thread martin f krafft
also sprach Joe Dollard <[EMAIL PROTECTED]> [2002.03.25.2114 +0100]: > The version of proftp that is in debian potato (1.2.0pre10 as > reported by running 'proftpd -v ') is vulnerable to a glob DoS > attack, as discovered on the 15th March 2001. You can v

Re: Security problem in PHP3+Postgres with Potato?

2002-03-26 Thread Pavel Minev Penev
On Mon, Mar 25, 2002 at 04:54:37PM +0100, Beno?t Sibaud wrote: > I think I found a security problem in PHP3+postgres+apache shipped with > Potato. > > Correct me if I'm wrong, but the following code should support any $var. > If you uncomment the client_encoding line, I&#

Re: DoS in debian (potato) proftpd

2002-03-26 Thread martin f krafft
also sprach Joe Dollard <[EMAIL PROTECTED]> [2002.03.25.2114 +0100]: > The version of proftp that is in debian potato (1.2.0pre10 as > reported by running 'proftpd -v ') is vulnerable to a glob DoS > attack, as discovered on the 15th March 2001. You ca

Re: Security problem in PHP3+Postgres with Potato?

2002-03-26 Thread Pavel Minev Penev
On Mon, Mar 25, 2002 at 04:54:37PM +0100, Beno?t Sibaud wrote: > I think I found a security problem in PHP3+postgres+apache shipped with > Potato. > > Correct me if I'm wrong, but the following code should support any $var. > If you uncomment the client_encoding line, I&#

Re: Security problem in PHP3+Postgres with Potato?

2002-03-25 Thread Benoît Sibaud
> > What's the normal way to make a security bug report? > apt-get install bug The 'bug' package is for "normal" bugs. [EMAIL PROTECTED] seems to be the good place to report security problems. Sorry for my previous post. -- Benoît Sibaud R&D Engineer - France Telecom -- To UNSUBSCRIBE, email

RE: Security problem in PHP3+Postgres with Potato?

2002-03-25 Thread Gergely Trifonov
-Original Message- From: Benoît Sibaud [mailto:[EMAIL PROTECTED] Sent: Monday, March 25, 2002 4:55 PM To: debian-security@lists.debian.org Subject: Security problem in PHP3+Postgres with Potato? > What's the normal way to make a security bug report? apt-get ins

Security problem in PHP3+Postgres with Potato?

2002-03-25 Thread Benoît Sibaud
Hi, I think I found a security problem in PHP3+postgres+apache shipped with Potato. Correct me if I'm wrong, but the following code should support any $var. If you uncomment the client_encoding line, I'm able to execute any request I want with the

Re: Security problem in PHP3+Postgres with Potato?

2002-03-25 Thread Benoît Sibaud
> > What's the normal way to make a security bug report? > apt-get install bug The 'bug' package is for "normal" bugs. [EMAIL PROTECTED] seems to be the good place to report security problems. Sorry for my previous post. -- Benoît Sibaud R&D Engineer - France Telecom -- To UNSUBSCRIBE, email

RE: Security problem in PHP3+Postgres with Potato?

2002-03-25 Thread Gergely Trifonov
-Original Message- From: Benoît Sibaud [mailto:[EMAIL PROTECTED]] Sent: Monday, March 25, 2002 4:55 PM To: [EMAIL PROTECTED] Subject: Security problem in PHP3+Postgres with Potato? > What's the normal way to make a security bug report? apt-get ins

Security problem in PHP3+Postgres with Potato?

2002-03-25 Thread Benoît Sibaud
Hi, I think I found a security problem in PHP3+postgres+apache shipped with Potato. Correct me if I'm wrong, but the following code should support any $var. If you uncomment the client_encoding line, I'm able to execute any request I want with the

An PHP exploit with Potato?

2002-02-26 Thread Antti Tolamo
Hello, Is there an PHP exploit in Potato? I really don't know, below message in Dshield mailing lists claims so: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I finally got my hands on an exploit that will provide a remote shell (not root) for php < 4.0.6. It claims to expl

An PHP exploit with Potato?

2002-02-26 Thread Antti Tolamo
Hello, Is there an PHP exploit in Potato? I really don't know, below message in Dshield mailing lists claims so: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > I finally got my hands on an exploit that will provide a > remote shell (not root) for ph

Re: What is the status with wu-ftpd updated potato packages?

2001-11-29 Thread Nicole Zimmerman
Read this: http://lists.debian.org/debian-changes/2001/debian-changes-200111/msg00085.html > What is the status with the wu-ftpd updated potato packages?

What is the status with wu-ftpd updated potato packages?

2001-11-29 Thread Federico Grau
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I just signed up with the debian-security mailing list so I am not up to speed with all the discussions. What is the status with the wu-ftpd updated potato packages? I could find no mention of it on the debian main or security web pages

Re: What is the status with wu-ftpd updated potato packages?

2001-11-29 Thread Nicole Zimmerman
Read this: http://lists.debian.org/debian-changes/2001/debian-changes-200111/msg00085.html > What is the status with the wu-ftpd updated potato packages? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

What is the status with wu-ftpd updated potato packages?

2001-11-29 Thread Federico Grau
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I just signed up with the debian-security mailing list so I am not up to speed with all the discussions. What is the status with the wu-ftpd updated potato packages? I could find no mention of it on the debian main or security web pages

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-24 Thread Blars Blarson
In article <[EMAIL PROTECTED]> [EMAIL PROTECTED] writes: >On Wed, Oct 24, 2001 at 01:18:52AM +, Martin WHEELER wrote: >> On Tue, 23 Oct 2001, Ethan Benson wrote: >> > kernels are never upgraded automatically by apt, you have to do it >> > yourself: >> That's not quite true -- should you recom

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-24 Thread Ethan Benson
On Wed, Oct 24, 2001 at 01:18:52AM +, Martin WHEELER wrote: > On Tue, 23 Oct 2001, Ethan Benson wrote: > > > kernels are never upgraded automatically by apt, you have to do it > > yourself: > > That's not quite true -- should you recompile your own kernel, and for > whatever reason, NOT give

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-24 Thread Blars Blarson
In article <[EMAIL PROTECTED]> [EMAIL PROTECTED] writes: >On Wed, Oct 24, 2001 at 01:18:52AM +, Martin WHEELER wrote: >> On Tue, 23 Oct 2001, Ethan Benson wrote: >> > kernels are never upgraded automatically by apt, you have to do it >> > yourself: >> That's not quite true -- should you reco

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-24 Thread Nicole Zimmerman
sense if you have a lot of boxes that are very similar in hardware. -nicole At 19:09 on Oct 23, eim combined all the right letters to say: > Actually I'm runnning Potato 2.2r2 on some Debian Boxes which > I've upgraded to 2.2r3, the Kernel which powers the system is > still 2.2.18

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Ethan Benson
On Wed, Oct 24, 2001 at 01:18:52AM +, Martin WHEELER wrote: > On Tue, 23 Oct 2001, Ethan Benson wrote: > > > kernels are never upgraded automatically by apt, you have to do it > > yourself: > > That's not quite true -- should you recompile your own kernel, and for > whatever reason, NOT give

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Nicole Zimmerman
sense if you have a lot of boxes that are very similar in hardware. -nicole At 19:09 on Oct 23, eim combined all the right letters to say: > Actually I'm runnning Potato 2.2r2 on some Debian Boxes which > I've upgraded to 2.2r3, the Kernel which powers the system is > still 2.

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Martin WHEELER
On Tue, 23 Oct 2001, Ethan Benson wrote: > kernels are never upgraded automatically by apt, you have to do it > yourself: That's not quite true -- should you recompile your own kernel, and for whatever reason, NOT give that new kernel a debian-style name which conforms *exactly* to the debian nam

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Ethan Benson
kernels are never upgraded automatically by apt, you have to do it yourself: apt-get install kernel-image-2.2.19 On Tue, Oct 23, 2001 at 07:09:43PM +0200, eim wrote: > Actually I'm runnning Potato 2.2r2 on some Debian Boxes which > I've upgraded to 2.2r3, the Kernel which powe

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Martin WHEELER
On Tue, 23 Oct 2001, Ethan Benson wrote: > kernels are never upgraded automatically by apt, you have to do it > yourself: That's not quite true -- should you recompile your own kernel, and for whatever reason, NOT give that new kernel a debian-style name which conforms *exactly* to the debian na

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Ethan Benson
kernels are never upgraded automatically by apt, you have to do it yourself: apt-get install kernel-image-2.2.19 On Tue, Oct 23, 2001 at 07:09:43PM +0200, eim wrote: > Actually I'm runnning Potato 2.2r2 on some Debian Boxes which > I've upgraded to 2.2r3, the Kernel which powe

Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread eim
Actually I'm runnning Potato 2.2r2 on some Debian Boxes which I've upgraded to 2.2r3, the Kernel which powers the system is still 2.2.18pre21 while for the 2.2r3 Release of Potato it should be version 2.2.19 So, correct me if I'm wrong but Debian Potato 2.2r3 comes out with Kerne

Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread eim
Actually I'm runnning Potato 2.2r2 on some Debian Boxes which I've upgraded to 2.2r3, the Kernel which powers the system is still 2.2.18pre21 while for the 2.2r3 Release of Potato it should be version 2.2.19 So, correct me if I'm wrong but Debian Potato 2.2r3 comes out with Kerne

Re: Running/Compiling latest snort on potato

2001-09-03 Thread Vladislav
Hello, --- Shane Machon <[EMAIL PROTECTED]> wrote: > I dont have to have 1.81 of snort (would be nice > though!), just db > support (1.7 or above) > > Any success stories? I used compiled from sources snort for 2 month. Then, I decide to add db support and try to recompile it. But it depends on

Re: Running/Compiling latest snort on potato

2001-09-03 Thread sjk
Compiled and ran fine for me with libpcap 0.4a6. --sjk On 4 Sep, Shane Machon wrote: > Greetings, > > Anyone had success compiling snort 1.81 on a stable potato box? > > Looking at the snort website, there is a question regarding libpcap < > 0.5 under Redhat that will

Re: Running/Compiling latest snort on potato

2001-09-03 Thread Vladislav
Hello, --- Shane Machon <[EMAIL PROTECTED]> wrote: > I dont have to have 1.81 of snort (would be nice > though!), just db > support (1.7 or above) > > Any success stories? I used compiled from sources snort for 2 month. Then, I decide to add db support and try to recompile it. But it depends on

  1   2   3   >