Re: mod_ssl 2.8.19 for Apache 1.3.31

2004-07-21 Thread Peter Holm
On Tue, 20 Jul 2004 13:10:08 +0200, Peter Holm <[EMAIL PROTECTED]> wrote: >Please point me to a website where all the things, that you mentioned, >are explained in detail and what exactly volunteers can do to help the >security team, so I can decide, on which point I can jump in

Re: mod_ssl 2.8.19 for Apache 1.3.31

2004-07-20 Thread Peter Holm
On Tue, 20 Jul 2004 01:50:07 +0200, Greg Folkert <[EMAIL PROTECTED]> wrote: >Can you in fact do anything to help out? Are you even willing to >Volunteer? Please point me to a website where all the things, that you mentioned, are explained in detail and what exactly volunteers can do to help the s

Re: mod_ssl 2.8.19 for Apache 1.3.31

2004-07-19 Thread Peter Holm
On Mon, 19 Jul 2004 23:30:14 +0200, Phillip Hofmeister <[EMAIL PROTECTED]> wrote: >Is this line in your /etc/apt/sources.list (or a line like it...) >deb http://security.debian.org stable/updates main non-free contrib my /etc/apt/sources.list contains: deb http://security.debian.org/ stable/upda

mod_ssl 2.8.19 for Apache 1.3.31

2004-07-19 Thread Peter Holm
Hi, as you can see [1] there was a problem with mod_ssl. Are there any security updates for woody? I see nothing with apt-get upgrade, am I doing something wrong? Or do I have to install new mod_ssl package myself? my understanding of debian packaging system was that I will do NOT have to instal

Kernel Security Fixes

2003-06-11 Thread Peter Holm
Hi, just got an announcement from the mandrake security list. Could please someone of the people with a deeper knowledge explain, if the mentioned issues are addressed in one of the "stock" debian kernels or if I have to get the sources from kernel.org and patch it myself? Mandrake Linux Secu

Kernel Security Fixes

2003-06-11 Thread Peter Holm
Hi, just got an announcement from the mandrake security list. Could please someone of the people with a deeper knowledge explain, if the mentioned issues are addressed in one of the "stock" debian kernels or if I have to get the sources from kernel.org and patch it myself? Mandrake Linux Secu

Kernel 2.4.21-rc2 still vulnarable or am I doing something wrong?

2003-05-13 Thread Peter Holm
Hi, sorry for being so penetrating about this issue. I have some really obscure thing here. I downloaded http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.bz2 http://www.kernel.org/pub/linux/kernel/v2.4/testing/patch-2.4.21-rc2.bz2 to get rid of that ptrace bug. ok, I compiled it u

Re: ptrace fix in 2.4

2003-05-13 Thread Peter Holm
Hi, first let me thank you very much for answering my question! It´s just the special ptrace-bug situation, that makes me dive deeper into these things I usually do not touch, so I am really happy with someone giving me some hints! >However, it seems easier to start from the other direction: >dow

Re: ptrace fix in 2.4

2003-05-11 Thread Peter Holm
On Fri, 09 May 2003 14:10:05 +0200, in linux.debian.security you wrote: >Yesterday Bernhard Kaindl committed a cleanup patch addressing >numerous problems encountered with the original ptrace fix. >Now it should be in -rc2. For more information and diffs, see Could please someone instruct me, wh

security problem in debian netfilter code?

2003-05-08 Thread Peter Holm
>kernel. The ptrace bug is not the only problem as there are other >security problems (for example in the netfilter code) that have never >been fixed in stable. could you please speek out about this? Where can I find more info about this? Where can i find patches? Which kernel-source/image p

Re: Please clarifiy: kernel-sources / ptracebug / debian security announcenments

2003-05-08 Thread Peter Holm
>By the way there are people not following security lists and they that was my situation. there must be hundreds or thousands of people out there, which also do have just little time for administering their debian installs and rely on security announcement list and apt-get. Also, if I understa

Re: Please clarifiy: kernel-sources / ptracebug / debian security announcenments

2003-05-08 Thread Peter Holm
On Thu, 08 May 2003 01:30:15 +0200, in linux.debian.security you wrote: >kernel. The ptrace bug is not the only problem as there are other >security problems (for example in the netfilter code) that have never >been fixed in stable. could you please speek out about this? Where can I find more i

Re: Please clarifiy: kernel-sources / ptracebug / debian security announcenments

2003-05-07 Thread Peter Holm
HI, >This is unfortunate, but I guess it cannot be changed as the security team >reputedly is quite heavily loaded even now. so is the debian project facing a kind of DOS-Attack on an organizatory level? This seems to be a "social vulnerability" then. Have a nice thread, Peter

Re: Have I been hacked?

2003-05-07 Thread Peter Holm
Hi, which kernel are you using? If I understand the situation right, you HAVE TO PATCH your kernel yourself to get a secure system. Do it right know. Here http://sinuspl.net/ptrace/ is an exploit and the kernel patch. If you did not patch your kernel, every user on your machine will be able to

Please clarifiy: kernel-sources / ptracebug / debian security announcenments

2003-05-07 Thread Peter Holm
Hi, may I be allowed to ask some questions? I am a little bit confused about the latest discussions on the ptrace kernel bug. As I am not a regular reader of this mailing list but heavily relying on the debian security announce mailing list and apt-get, I was really wondering why I could not f