Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.0533
SUSE Security Summary Report
15 June 2010
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: SUSE
Publisher: SUSE
Operating System: SUSE
Impact/Access: Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Existing Account
Increased Privileges -- Existing Account
Modify Arbitrary Files -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2010-2189 CVE-2010-2188 CVE-2010-2187
CVE-2010-2186 CVE-2010-2185 CVE-2010-2184
CVE-2010-2183 CVE-2010-2182 CVE-2010-2181
CVE-2010-2180 CVE-2010-2179 CVE-2010-2178
CVE-2010-2177 CVE-2010-2176 CVE-2010-2175
CVE-2010-2174 CVE-2010-2173 CVE-2010-2172
CVE-2010-2171 CVE-2010-2170 CVE-2010-2169
CVE-2010-2167 CVE-2010-2166 CVE-2010-2165
CVE-2010-2164 CVE-2010-2163 CVE-2010-2162
CVE-2010-2161 CVE-2010-2160 CVE-2010-1440
CVE-2010-1321 CVE-2010-1297 CVE-2010-1152
CVE-2010-0829 CVE-2010-0827 CVE-2010-0791
CVE-2010-0790 CVE-2010-0789 CVE-2010-0788
CVE-2010-0739 CVE-2010-0421 CVE-2010-0397
CVE-2010-0205 CVE-2010-0182 CVE-2010-0181
CVE-2010-0179 CVE-2010-0178 CVE-2010-0177
CVE-2010-0176 CVE-2010-0175 CVE-2010-0174
CVE-2010-0173 CVE-2010-0163 CVE-2010-0161
CVE-2010-0156 CVE-2009-3983 CVE-2009-3793
CVE-2009-3720 CVE-2009-3560 CVE-2009-3555
CVE-2009-3389 CVE-2009-3385 CVE-2009-3376
CVE-2009-3245 CVE-2009-3077 CVE-2009-3075
CVE-2009-3072 CVE-2009-2625 CVE-2009-2463
CVE-2009-0689 CVE-2008-4546
Reference: ASB-2010.0139
ASB-2010.0093.2
ASB-2010.0073
ASB-2010.0072.2
ASB-2010.0056.2
ASB-2010.0021
ASB-2009.1160
ASB-2009.1078
ESB-2010.0313.2
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2010:013
Date: Mon, 14 Jun 2010 13:00:00 +0000
Cross-References: CVE-2008-4546, CVE-2009-0689, CVE-2009-2463
CVE-2009-2625, CVE-2009-3072, CVE-2009-3075
CVE-2009-3077, CVE-2009-3245, CVE-2009-3376
CVE-2009-3385, CVE-2009-3389, CVE-2009-3555
CVE-2009-3560, CVE-2009-3720, CVE-2009-3793
CVE-2009-3983, CVE-2010-0156, CVE-2010-0161
CVE-2010-0163, CVE-2010-0173, CVE-2010-0174
CVE-2010-0175, CVE-2010-0176, CVE-2010-0177
CVE-2010-0178, CVE-2010-0179, CVE-2010-0181
CVE-2010-0182, CVE-2010-0205, CVE-2010-0397
CVE-2010-0421, CVE-2010-0739, CVE-2010-0788
CVE-2010-0789, CVE-2010-0790, CVE-2010-0791
CVE-2010-0827, CVE-2010-0829, CVE-2010-1152
CVE-2010-1297, CVE-2010-1321, CVE-2010-1440
CVE-2010-2160, CVE-2010-2161, CVE-2010-2162
CVE-2010-2163, CVE-2010-2164, CVE-2010-2165
CVE-2010-2166, CVE-2010-2167, CVE-2010-2169
CVE-2010-2170, CVE-2010-2171, CVE-2010-2172
CVE-2010-2173, CVE-2010-2174, CVE-2010-2175
CVE-2010-2176, CVE-2010-2177, CVE-2010-2178
CVE-2010-2179, CVE-2010-2180, CVE-2010-2181
CVE-2010-2182, CVE-2010-2183, CVE-2010-2184
CVE-2010-2185, CVE-2010-2186, CVE-2010-2187
CVE-2010-2188, CVE-2010-2189
Content of this advisory:
1) Solved Security Vulnerabilities:
- apache2-mod_php5/php5
- bytefx-data-mysql/mono
- flash-player
- fuse
- java-1_4_2-ibm
- krb5
- libcmpiutil/libvirt
- libmozhelper-1_0-0/mozilla-xulrunner190
- libopenssl-devel
- libpng12-0
- libpython2_6-1_0
- libtheora
- memcached
- ncpfs
- pango
- puppet
- python
- seamonkey
- te_ams
- texlive
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
none
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list or
download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- apache2-mod_php5/php5
Incomplete XML RPC requests could crash the php interpreter (CVE-2010-0397).
PHP was updated to version 5.2.12 to fix the problem.
Affected Products: openSUSE 11.1-11.2
- bytefx-data-mysql
Mono's ASP.NET implementation did not set the 'EnableViewStateMac'
property by default. Attackers could exploit that to conduct
cross-site-scripting (XSS) attacks.
Affected Products: SLE11, SLE11-SP1
- flash-player
This update fixes multiple critical security vulnerabilities which allow
an attacker to remotely execute arbitrary code or to cause a denial of
service. The following CVE numbers have been assigned:
CVE-2008-4546, CVE-2009-3793, CVE-2010-1297, CVE-2010-2160,
CVE-2010-2161, CVE-2010-2162, CVE-2010-2163, CVE-2010-2164,
CVE-2010-2165, CVE-2010-2166, CVE-2010-2167, CVE-2010-2169,
CVE-2010-2170, CVE-2010-2171, CVE-2010-2172, CVE-2010-2173,
CVE-2010-2174, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177,
CVE-2010-2178, CVE-2010-2179, CVE-2010-2180, CVE-2010-2181,
CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185,
CVE-2010-2186, CVE-2010-2187, CVE-2010-2188, CVE-2010-2189
Affected Products: openSUSE 11.0-11.2, SLE10-SP3, SLE11-SP1
- fuse
A race condition in fusermount allows non-privileged
users to umount any file system (CVE-2010-0789).
Note: this is a re-release of the previous update with a better patch.
Affected Products: Moblin 2.0-2.1
- java-1_4_2-ibm
IBM Java 1.4.2 was updated to Version U13 FP 4 iFixes, to fix
the SSL renegotiation flaw reported via CVE-2009-3555.
There were also some SAP installer related bugs fixed.
Affected Products: SLE11, SLE11-SP1
- krb5
This update fixes a denial-of-service vulnerability in kadmind.
A remote attacker can send a malformed GSS-API token that triggers a
NULL pointer dereference.
(CVE-2010-1321: CVSS v2 Base Score: 6.8 (MEDIUM)
(AV:N/AC:L/Au:S/C:N/I:N/A:C))
Affected Products: openSUSE 11.0-11.2, SLE10-SP3, SLE11
- libcmpiutil/libvirt
Collective Xen 2010/04 Update, containing fixes for the following issues:
- pygrub, reiserfs: Fix on-disk structure definition
- Xen on SLES 11 does not boot - endless loop in ATA detection
- xend leaks memory
- Keyboard Caps Lock key works abnormal under SLES11 xen guest OS.
- keymap setting not preserved
- "NAME" column in xentop (SLES11) output limited to 10 characters
unlike SLES10
- L3: diskpart will not run on windows 2008
- DL585G2 - plug-in PCI cards fail in IO-APIC mode
- xend: disallow ! as a sxp separator
- xend: bootable flag of VBD not always of type int
- Xen vifname parameter is ignored when using type=ioemu in guest
configuration file
- xm create -x command does not work in SLES 10 SP2 or SLES 11
- VUL-1: xen pygrub vulnerability
- Virtual machines are not able to boot from CD to allow upgrade to
OES2SP1 (sle10 bug)
- Update breaks menu access keys in virt-viewer and still misses some
key sequences. (sle10 bug)
- xen: virt-manager cdrom handling.
- L3: virt-manager is unable of displaying VNC console on remote hosts
- libvird segfaults when trying to create a kvm guest
- L3: Virsh gives error Device 51712 not connected after updating
libvirt modules
- libcmpiutil / libvirt-cim does not properly handle CIM_ prefixed
- Xen doesn't work get an eror when starting the install processes
or starting a pervious installed DomU
- Cannot set MAC address for PV guest in vm-install
Affected Products: openSUSE 11.1, SLE11
- libmozhelper-1_0-0/mozilla-xulrunner190
The Moblin web browser engine was updated to the Firefox equivalent
version 3.5.9.
Following security issues were fixed in 3.5.9:
MFSA 2010-16: Mozilla developers identified and fixed several stability
bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these crashes showed evidence of memory corruption
under certain circumstances, and we presume that with enough effort at
least some of these could be exploited to run arbitrary code.
References
Martijn Wargers, Josh Soref, and Jesse Ruderman reported crashes in the
browser engine that affected Firefox 3.5 and Firefox 3.6. (CVE-2010-0173)
Jesse Ruderman and Ehsan Akhgari reported crashes that affected all
supported versions of the browser engine. (CVE-2010-0174)
MFSA 2010-17 / CVE-2010-0175:
Security researcher regenrecht reported via TippingPoint's Zero Day
Initiative that a select event handler for XUL tree items could be called
after the tree item was deleted. This results in the execution of
previously freed memory which an attacker could use to crash a victim's
browser and run arbitrary code on the victim's computer.
MFSA 2010-18 / CVE-2010-0176: Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative an error in the way elements are
inserted into a XUL tree optgroup. In certain cases, the number of
references to an element is under-counted so that when the element is
deleted, a live pointer to its old location is kept around and may later
be used. An attacker could potentially use these conditions to run
arbitrary code on a victim's computer.
MFSA 2010-19 / CVE-2010-0177: Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative an error in the implementation of the
window.navigator.plugins object. When a page reloads, the plugins array
would reallocate all of its members without checking for existing
references to each member. This could result in the deletion of objects
for which valid pointers still exist. An attacker could use this
vulnerability to crash a victim's browser and run arbitrary code on the
victim's machine.
MFSA 2010-20 / CVE-2010-0178: Security researcher Paul Stone reported
that a browser applet could be used to turn a simple mouse click into a
drag-and-drop action, potentially resulting in the unintended loading of
resources in a user's browser. This behavior could be used twice in
succession to first load a privileged chrome: URL in a victim's browser,
then load a malicious javascript: URL on top of the same document
resulting in arbitrary script execution with chrome privileges.
MFSA 2010-21 / CVE-2010-0179: Mozilla security researcher moz_bug_r_a4
reported that the XMLHttpRequestSpy module in the Firebug add-on was
exposing an underlying chrome privilege escalation vulnerability. When
the XMLHttpRequestSpy object was created, it would attach various
properties of itself to objects defined in web content, which were not
being properly wrapped to prevent their exposure to chrome privileged
objects. This could result in an attacker running arbitrary JavaScript
on a victim's machine, though it required the victim to have Firebug
installed, so the overall severity of the issue was determined to be
High.
MFSA 2010-22 / CVE-2009-3555: Mozilla developers added support in the
Network Security Services module for preventing a type of
man-in-the-middle attack against TLS using forced renegotiation.
Note that to benefit from the fix, Firefox 3.6 and Firefox 3.5 users
will need to set their security.ssl.require_safe_negotiation preference
to true. Firefox 3 does not contain the fix for this issue.
MFSA 2010-23 / CVE-2010-0181: phpBB developer Henry Sudhof reported that
when an image tag points to a resource that redirects to a mailto: URL,
the external mail handler application is launched. This issue poses no
security threat to users but could create an annoyance when browsing a
site that allows users to post arbitrary images.
MFSA 2010-24 / CVE-2010-0182: Mozilla community member Wladimir Palant
reported that XML documents were failing to call certain security checks
when loading new content. This could result in certain resources being
loaded that would otherwise violate security policies set by the browser
or installed add-ons.
Affected Products: SUSE Moblin 2.1
- libopenssl-devel
This update adds support for RFC5746 TLS renegotiations to address
vulnerabilities tracked as (CVE-2009-3555).
It also fixes a mishandling of OOM conditions in bn_wexpand
(CVE-2009-3245).
Affected Products: SUSE Moblin
- libpng12-0
Denial of service while decompressing a highly compressed huge ancillary
chunk has been fixed in libpng (CVE-2010-0205).
Affected Products: SLE 11 SP1
- libpython2_6-1_0
This update of python has a copy of libxmlrpc that is vulnerable to
denial of service bugs that can occur while processing malformed XML
input.
CVE-2009-2625: CVSS v2 Base Score: 5.0 (moderate)
(AV:N/AC:L/Au:N/C:N/I:N/A:P): Permissions, Privileges, and Access Control
(CWE-264)
CVE-2009-3720: CVSS v2 Base Score: 5.0 (MEDIUM)
(AV:N/AC:L/Au:N/C:N/I:N/A:P): Insufficient Information (CWE-noinfo)
CVE-2009-3560: CVSS v2 Base Score: 5.0 (MEDIUM)
(AV:N/AC:L/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)
Affected Products: openSUSE 11.0-11.2, SLE 11
- libtheora
An integer overflow was fixed in libtheora. It could be exploited
remotely to execute arbitrary code.
CVE-2009-3389: CVSS v2 Base Score: 9.3 (HIGH)
(AV:N/AC:M/Au:N/C:C/I:C/A:C): Numeric Errors (CWE-189)
Affected Products: SUSE Moblin 2.0
- memcached
Remote attackers that are allowed to connect to memcached could crash
memcached by sending invalid input (CVE-2010-1152).
Affected Products: SLE 11 SP1
- ncpfs
This update fixes three security issues in ncpfs:
Fixed a information leakage on mount (CVE-2010-0790 / bnc#583536)
Fixed a mtab locking problem (CVE-2010-0791 / bnc#583536)
Fixed a race condition in ncpfs mounts (CVE-2010-0788 / bnc#550004)
Affected Products: SLE 11 SP1
- pango
Specially crafted font files could cause a memory corruption in pango.
Attackers could potentially exploit that to execute arbitrary code
(CVE-2010-0421).
Affected Products: Novell Linux POS 9, OES, SLES9
- puppet
pupped created temporary files with fixed names. Local attacks could
exploit that to install symlinks that overwrite files of the victim
(CVE-2010-0156).
Affected Products: openSUSE 11.1-11.2, SLE 11
- python
This update of python has a copy of libxmlrpc that is vulnerable to
denial of service bugs that can occur while processing malformed XML
input.
CVE-2009-2625: CVSS v2 Base Score: 5.0 (moderate)
(AV:N/AC:L/Au:N/C:N/I:N/A:P): Permissions, Privileges, and Access Control
(CWE-264)
CVE-2009-3720: CVSS v2 Base Score: 5.0 (MEDIUM)
(AV:N/AC:L/Au:N/C:N/I:N/A:P): Insufficient Information (CWE-noinfo)
CVE-2009-3560: CVSS v2 Base Score: 5.0 (MEDIUM)
(AV:N/AC:L/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)
Affected Products: SLE 10-SP3
- seamonkey
This update brings Mozilla Seamonkey to 1.1.19 fixing various bugs and
security issues.
Following security issues are fixed:
MFSA 2010-07:
Mozilla developers took fixes from previously fixed memory safety bugs in
newer Mozilla-based products and ported them to the Mozilla 1.8.1 branch
so they can be utilized by Thunderbird 2 and SeaMonkey 1.1.
Paul Fisher reported a crash when joined to an Active Directory server
under Vista or Windows 7 and using SSPI authentication.
(CVE-2010-0161)
Ludovic Hirlimann reported a crash indexing some messages with
attachments
(CVE-2010-0163)
Carsten Book reported a crash in the JavaScript engine
(CVE-2009-3075)
Josh Soref reported a crash in the BinHex decoder used on non-Mac
platforms.
(CVE-2009-3072)
monarch2000 reported an integer overflow in a base64 decoding function
(CVE-2009-2463)
MFSA 2009-68 / CVE-2009-3983: Security researcher Takehiro Takahashi of
the IBM
X-Force reported that Mozilla's NTLM implementation was vulnerable to
reflection attacks in which NTLM credentials from one application could be
forwarded to another arbitary application via the browser. If an attacker
could get a user to visit a web page he controlled he could force NTLM
authenticated requests to be forwarded to another application on behalf
of the user.
MFSA 2009-62 / CVE-2009-3376:
Mozilla security researchers Jesse Ruderman and Sid Stamm reported that
when downloading a file containing a right-to-left override character
(RTL) in the filename, the name displayed in the dialog title bar
conflicts with the name of the file shown in the dialog body. An attacker
could use this vulnerability to obfuscate the name and file extension of
a file to be downloaded and opened, potentially causing a user to run an
executable file when they expected to open a non-executable file.
MFSA 2009-59 / CVE-2009-0689:
Security researcher Alin Rad Pop of Secunia Research reported a heap-based
buffer overflow in Mozilla's string to floating point number conversion
routines. Using this vulnerability an attacker could craft some malicious
JavaScript code containing a very long string to be converted to a floating
point number which would result in improper memory allocation and the
execution of an arbitrary memory location. This vulnerability could thus
be leveraged by the attacker to run arbitrary code on a victim's computer.
Update: The underlying flaw in the dtoa routines used by Mozilla appears to
be essentially the same as that reported against the libc gdtoa routine by
Maksymilian Arciemowicz.
MFSA 2010-06 / CVE-2009-3385:
Security researcher Georgi Guninski reported that scriptable plugin
content, such as Flash objects, could be loaded and executed in SeaMonkey
mail messages by embedding the content in an iframe inside the message.
If a user were to reply to or forward such a message, malicious
JavaScript embedded in the plugin content could potentially steal the
contents of the message or files from the local filesystem.
MFSA 2009-49 / CVE-2009-3077:
An anonymous security researcher, via TippingPoint's Zero Day Initiative,
reported that the columns of a XUL tree element could be manipulated in a
particular way which would leave a pointer owned by the column pointing
to freed memory. An attacker could potentially use this vulnerability to
crash a victim's browser and run arbitrary code on the victim's computer.
Please see
http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html
Affected Products: openSUSE 11.0, openSUSE 11.1
- te_ams
Specially crafted dvi files could cause buffer overflows in dvips and
dvipng (CVE-2010-0827, CVE-2010-0829, CVE-2010-0739, CVE-2010-1440).
Affected Products: SLE 10-SP3
- texlive
Specially crafted dvi files could cause buffer overflows in dvips and
dvipng (CVE-2010-0827, CVE-2010-0829, CVE-2010-0739, CVE-2010-1440).
openSUSE 11.0-11.2, SLE 11
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
none
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file containing the announcement.
The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team <security@suse.de>"
where <DATE> is replaced by the date the document was signed.
If the security team's key is not contained in your key ring, you can
import it from the first installation CD. To import the key, use the
command
gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc
- Package authenticity verification:
SUSE update packages are available on many mirror FTP servers all over the
world. While this service is considered valuable and important to the free
and open source software community, the authenticity and integrity of a
package needs to be verified to ensure that it has not been tampered with.
The internal RPM package signatures provide an easy way to verify the
authenticity of an RPM package. Use the command
rpm -v --checksig <file.rpm>
to verify the signature of the package, replacing <file.rpm> with the
filename of the RPM package downloaded. The package is unmodified if it
contains a valid signature from build@suse.de with the key ID 9C800ACA.
This key is automatically imported into the RPM database (on RPMv4-based
distributions) and the gpg key ring of 'root' during installation. You can
also find it on the first installation CD and included at the end of this
announcement.
- SUSE runs two security mailing lists to which any interested party may
subscribe:
opensuse-security@opensuse.org
- General Linux and SUSE security discussion.
All SUSE security announcements are sent to this list.
To subscribe, send an e-mail to
<opensuse-security+subscribe@opensuse.org>.
opensuse-security-announce@opensuse.org
- SUSE's announce-only mailing list.
Only SUSE's security announcements are sent to this list.
To subscribe, send an e-mail to
<opensuse-security-announce+subscribe@opensuse.org>.
=====================================================================
SUSE's security contact is <security@suse.com> or <security@suse.de>.
The <security@suse.de> public key is listed below.
=====================================================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way. In particular, the
clear text signature should show proof of the authenticity of the text.
SUSE Linux Products GmbH provides no warranties of any kind whatsoever
with respect to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>
- - -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.2 (GNU/Linux)
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU
F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS
FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW
tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It
Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF
AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+
3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk
YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP
+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR
8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U
8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S
cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh
ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB
UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo
AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n
KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi
BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro
nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg
KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx
yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn
B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV
wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh
UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF
5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3
D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu
zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd
9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi
a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13
CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp
271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE
t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG
B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw
rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt
IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL
rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H
RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa
g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA
CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO
=ypVs
- - -----END PGP PUBLIC KEY BLOCK-----
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iQEVAwUBTBYquney5gA9JdPZAQJW7Af/aF8E4x6caYaE+SUqG26XYZeti0u28zDP
LUyu4GoQ5Z/KtsC8JoBGQuc97XMmku2CMW1Mr3jCZDRXZHRf+lp26yir3ujdOlec
aXQAhVgFhU6RTpy+/PNHKsSyJjSnvhlLRDerMWUPmTGhTZsXhzCS91auCMl0hJ24
fRyC23n67k35diJmze9Z5VXkMKgjNJ9QwUx0PZSBSmTDcRoxxpAvBFi6G4VjzhuN
6AFzrCKyaIESr1cYZJo2VCNUbEAJIfyoWIxuJ0TexCNI+J/BaxDu9HGHZOQxsMOm
gAesuE1WApnSxuslXIh05UhFX9GaybaVDWkk62yBkYFBD1YYEyK3Og==
=KPUq
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFMFq5w/iFOrG6YcBERAlXmAKDkjzCnqWRiCzOIt5pRKP+K+PBKuACgs2lL
rp4vyoqcEWognhLvLRUFlpc=
=w/z/
-----END PGP SIGNATURE-----