Re: [SECURITY] [DSA 536-1] New libpng, libpng3 packages fix multiple vulnerabilities

2004-08-05 Thread Norbert Tretkowski
* Josselin Mouette wrote: > On mer, 2004-08-04 at 19:10 -0700, Matt Zimmerman wrote: > > For the unstable distribution (sid), these problems will be fixed > > soon. > > I've just uploaded fixed packages for unstable; however I've noticed > mozilla still crashes on the crafted PNG provided by Chris

Re: On Mozilla-* updates

2005-08-04 Thread Norbert Tretkowski
* Matthias Westphal wrote: > 2) why wasnt firefox 1.04 removed off the package list immediately > if the problem couldnt be fixed in time ? Read this thread again. Norbert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Security fixes for mozilla and firefox in Sarge?

2005-08-24 Thread Norbert Tretkowski
* Paul Gear wrote: > Sam Morris wrote: > > I'm attaching a diff against mozilla-firefox_1.0.6-1.diff that > > makes Firefox 1.0.6 build on Sarge. > > I've been trying to build Firefox 1.06 based on the current unstable > sources (1.0.6-3 instead of 1.0.6-1), but i'm not sure where your > patch sho

Re: Unusual incoming traffic detected from klecker.debian.org and sou rce.rfc822.org

2005-09-14 Thread Norbert Tretkowski
* Mathieu JANIN wrote: > I detected some unexpected incoming traffic from klecker.debian.org > (ports TCP 4672, 4668), and source.rfc822.org (port TCP 1794), all > coming from port 80 at 12:17 yesterday. > > I was updating my system at that time, but klecker.debian.org is not > in my sources (or pe

Re: [SECURITY] [DSA 879-1] New gallery packages fix privilege escalation

2005-11-02 Thread Norbert Tretkowski
* Martin Schulze wrote: > A bug in gallery has been discoverd that grants all registrated > postnuke users full access to the gallery. Huh? Norbert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: What is a security bug?

2005-11-25 Thread Norbert Tretkowski
* Michelle Konzack wrote: > Unfortunatly it is not possibel to open two instances of mozilla. You can run multiple instances of mozilla using different profiles. Norbert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: PTRACE Fixed?

2003-03-22 Thread Norbert Tretkowski
* Matteo Moro <[EMAIL PROTECTED]> wrote: > "Laurent Tickle" <[EMAIL PROTECTED]> wrote: > > [...] a patch who work on Kernel 2.2.X and 2.4.X ;) > > It's 2.4.20 only... :-P That bug was the reason why 2.2.25 was released.

Re: Kernel 2.4.21+grsecurity+p-o-m

2003-09-07 Thread Norbert Tretkowski
* Federico Lazcano <[EMAIL PROTECTED]> wrote: > Hi, i'm using the official kernel 2.4.21, and I've patched it with the > following > > + IPSEC patch from Debian > + patch-omatic H.323 patch from www.netfilter.org > + grsecurity patch para kernel 2.4.21 > > Anyone knows conflicts or problems? Dep

Re: Will Bind9 in stable get patched?

2003-09-25 Thread Norbert Tretkowski
* Phillip Hofmeister <[EMAIL PROTECTED]> wrote: > On Sun, 21 Sep 2003 at 12:58:54PM +0200, J.H.M. Dassen (Ray) wrote: > > On Sat, Sep 20, 2003 at 11:13:35 -0700, Bill Moseley wrote: > > > Will Bind9 in stable get the delegation-only patch? > > > > Probably not. Stable only gets updated for secur

new open udp port with bind 9.2.3rc

2003-09-29 Thread Norbert Tretkowski
I've upgraded to bind 9.2.3rc4 because of that new delegation-only feature, and I noticed that bind is opening a new udp port. , | udp0 0 0.0.0.0:43338 0.0.0.0:* 22720/named ` This is new, and didn't happen with 9.2.2. If I restart named,

Re: new open udp port with bind 9.2.3rc

2003-09-29 Thread Norbert Tretkowski
* Mark Ferlatte <[EMAIL PROTECTED]> wrote: > Norbert Tretkowski said on Mon, Sep 29, 2003 at 03:34:16PM +0200: > > I've upgraded to bind 9.2.3rc4 because of that new delegation-only > > feature, and I noticed that bind is opening a new udp port. > > > > ,

Re: new open udp port with bind 9.2.3rc

2003-09-29 Thread Norbert Tretkowski
* Christoph Moench-Tegeder wrote: > BIND binds to a socket for outgoing querys. But he already did that in > 9.2.2 (at least he does here). Looks like BIND doesn't open a socket for outgoing queries when it's running only as a forwarder. -- - nobse

Re: Debian servers "hacked"?

2003-11-21 Thread Norbert Tretkowski
* Thomas Sjögren wrote: [...] > Server security mishap - you think?! http://luonnotar.infodrom.org/~joey/debian-announce.txt -- - nobse

Re: What will be old configurations if new kernel installed

2003-12-04 Thread Norbert Tretkowski
* E&Erdem wrote: > I have not upgraded kernel before this. What will be my > configurations? For example my old modules (sound, eth, USB, > iptables etc.) will been changed? They are still available with the new kernel. If you have added them to /etc/modules they will be loaded while booting the

Re: Faked samba packages / rootkit?

2003-12-27 Thread Norbert Tretkowski
* Markus Schabel wrote: > Does anybody know of these samba packages? > > http://ftp.cvut.cz/samba/samba-latest.tar.gz > > AFAICS they are faked and contain some kind of rootkit (you can see > this in the history below. the server this history is from is taken > offline for security reasons, and n

Re: Antivirus for proxy

2004-02-27 Thread Norbert Tretkowski
* Raffaele D'Elia wrote: > This antivirus should protect web clients, not the proxy itself: I'm > quite sure I've already protected the server choosing debian... Try mod_clamav, it's a apache2 module, and it works quite well here. The only bad news is that there's currently no Debian package for

Re: mozilla - the forgotten package?

2004-03-10 Thread Norbert Tretkowski
* Sven Hoexter wrote: > On Wed, Mar 10, 2004 at 08:48:02PM +0100, Florian Weimer wrote: [...] > > Okay, if that's the case, I'm going to start a campaign for > > including Mozilla 1.4 (plus fixes) in stable. > > Well why just include 1.4 and not 1.6? I know that the backports.org > mozilla package

Re: Backporting SELinux to woody

2004-03-11 Thread Norbert Tretkowski
* Milan P. Stanic wrote: > Can I put in version something like libselinux1_1.6-0.1-bp.mps_i386.deb > instead of libselinux1_1.6-0.1_i386.deb? Well, if 1.6-0.1 will be in our next stable release, your backport will not be replaced with the version from stable. I'd suggest using libselinux1_1.6-0.0

Re: PTRACE Fixed?

2003-03-22 Thread Norbert Tretkowski
* Matteo Moro <[EMAIL PROTECTED]> wrote: > "Laurent Tickle" <[EMAIL PROTECTED]> wrote: > > [...] a patch who work on Kernel 2.2.X and 2.4.X ;) > > It's 2.4.20 only... :-P That bug was the reason why 2.2.25 was released. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscrib

Re: Kernel 2.4.21+grsecurity+p-o-m

2003-09-07 Thread Norbert Tretkowski
* Federico Lazcano <[EMAIL PROTECTED]> wrote: > Hi, i'm using the official kernel 2.4.21, and I've patched it with the > following > > + IPSEC patch from Debian > + patch-omatic H.323 patch from www.netfilter.org > + grsecurity patch para kernel 2.4.21 > > Anyone knows conflicts or problems? Dep

Re: Will Bind9 in stable get patched?

2003-09-25 Thread Norbert Tretkowski
* Phillip Hofmeister <[EMAIL PROTECTED]> wrote: > On Sun, 21 Sep 2003 at 12:58:54PM +0200, J.H.M. Dassen (Ray) wrote: > > On Sat, Sep 20, 2003 at 11:13:35 -0700, Bill Moseley wrote: > > > Will Bind9 in stable get the delegation-only patch? > > > > Probably not. Stable only gets updated for secur

new open udp port with bind 9.2.3rc

2003-09-29 Thread Norbert Tretkowski
I've upgraded to bind 9.2.3rc4 because of that new delegation-only feature, and I noticed that bind is opening a new udp port. , | udp0 0 0.0.0.0:43338 0.0.0.0:* 22720/named ` This is new, and didn't happen with 9.2.2. If I restart named,

Re: new open udp port with bind 9.2.3rc

2003-09-29 Thread Norbert Tretkowski
* Mark Ferlatte <[EMAIL PROTECTED]> wrote: > Norbert Tretkowski said on Mon, Sep 29, 2003 at 03:34:16PM +0200: > > I've upgraded to bind 9.2.3rc4 because of that new delegation-only > > feature, and I noticed that bind is opening a new udp port. > > > > ,

Re: new open udp port with bind 9.2.3rc

2003-09-29 Thread Norbert Tretkowski
* Christoph Moench-Tegeder wrote: > BIND binds to a socket for outgoing querys. But he already did that in > 9.2.2 (at least he does here). Looks like BIND doesn't open a socket for outgoing queries when it's running only as a forwarder. -- - nobse -- To UNSUBSCRIBE, email to [EMAIL PROTECTE

Re: Debian servers "hacked"?

2003-11-21 Thread Norbert Tretkowski
* Thomas Sjögren wrote: [...] > Server security mishap - you think?! http://luonnotar.infodrom.org/~joey/debian-announce.txt -- - nobse -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: What will be old configurations if new kernel installed

2003-12-04 Thread Norbert Tretkowski
* E&Erdem wrote: > I have not upgraded kernel before this. What will be my > configurations? For example my old modules (sound, eth, USB, > iptables etc.) will been changed? They are still available with the new kernel. If you have added them to /etc/modules they will be loaded while booting the

Re: Faked samba packages / rootkit?

2003-12-27 Thread Norbert Tretkowski
* Markus Schabel wrote: > Does anybody know of these samba packages? > > http://ftp.cvut.cz/samba/samba-latest.tar.gz > > AFAICS they are faked and contain some kind of rootkit (you can see > this in the history below. the server this history is from is taken > offline for security reasons, and n

Re: Antivirus for proxy

2004-02-27 Thread Norbert Tretkowski
* Raffaele D'Elia wrote: > This antivirus should protect web clients, not the proxy itself: I'm > quite sure I've already protected the server choosing debian... Try mod_clamav, it's a apache2 module, and it works quite well here. The only bad news is that there's currently no Debian package for

Re: mozilla - the forgotten package?

2004-03-10 Thread Norbert Tretkowski
* Sven Hoexter wrote: > On Wed, Mar 10, 2004 at 08:48:02PM +0100, Florian Weimer wrote: [...] > > Okay, if that's the case, I'm going to start a campaign for > > including Mozilla 1.4 (plus fixes) in stable. > > Well why just include 1.4 and not 1.6? I know that the backports.org > mozilla package

Re: Backporting SELinux to woody

2004-03-11 Thread Norbert Tretkowski
* Milan P. Stanic wrote: > Can I put in version something like libselinux1_1.6-0.1-bp.mps_i386.deb > instead of libselinux1_1.6-0.1_i386.deb? Well, if 1.6-0.1 will be in our next stable release, your backport will not be replaced with the version from stable. I'd suggest using libselinux1_1.6-0.0

Re: woody kernel image

2005-01-29 Thread Norbert Tretkowski
* Michelle Konzack wrote: > Am 2005-01-29 14:45:37, schrieb Harald Krammer: > > You are right, but why is the kernel image from woody not up-to > > date ? > > There are Security Updates for kernel 2.4.18 The last update for kernel-source-2.4.18 in stable was in April 2004. Norbert -- To UNSUB

Re: {Spam?} Re: woody kernel image

2005-01-30 Thread Norbert Tretkowski
* Michelle Konzack wrote: > There will be no new version of 2.4.XX Wrong. Message-ID: <[EMAIL PROTECTED]> Norbert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 715-1] New cvs packages fix unauthorised repository access

2005-04-27 Thread Norbert Tretkowski
* Martin Schulze wrote: > For the unstable distribution (sid) these problems have been fixed > in version 1.12.9-11. This should be 1.12.9-12, which was never uploaded (-13 was uploaded today). Norbert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Cont

Re: mysql-dfsg-5.0 CVE-2007-6303

2008-09-29 Thread Norbert Tretkowski
Am Mon, 29 Sep 2008 15:08:10 +0200 schrieb Jan Christoph Ebersbach: > I was looking at the security issues regarding the mysql-server and I'm > wondering why CVE-2007-6303 does not seem to be fixed in Debian but in > all other major distributions. Fixed since 5.0.45-5, 5.0.32 from etch was not aff

Re: MySQL Bug#21074 fixed in 5.0.32-7etch8 ?

2008-11-06 Thread Norbert Tretkowski
Am Thu, 06 Nov 2008 14:24:24 +0100 schrieb Janosch Siller: > sorry but i did not find any information if the MySQL Bug #21074 (Large > query_cache freezes mysql server sporadically under heavy load) is fixed > in 5.0.32-7etch8 . > Can anybody please confirm if this is fixed or not? It's not fixed

Re: the slrn-0.9.6.2 -hole

2001-09-29 Thread Norbert Tretkowski
* Juha Jäykkä wrote: > I have a woody which would need slrn removed if woody's newest > version (that is, 0.9.7.2-4) is vulnerable. Use 0.9.7.2-6 from unstable. pgpsG51eOWdLu.pgp Description: PGP signature