Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: jahlewis on March 19, 2004, 04:31:28 PM

Title: New openssl vulnerabilities
Post by: jahlewis on March 19, 2004, 04:31:28 PM: Is this applicable to us?

http://www.us-cert.gov/cas/techalerts/TA04-078A.html

Is this our first contribs.org update test? Do we hope that someone will step up to the plate and inform us what we need to update (I have no clue what the dependencies are etc.)

I don't see any updated RPM's on fedoralegacy.org, any idea on where else we can find updated RH7.3 rpms?
Title: New openssl vulnerabilities
Post by: smeghead on March 21, 2004, 04:30:57 AM: Hmm, looks like it might be relevant.

SME 6.0 uses openssl-0.9.6b-35.7 so would be vulnerable based on the stated info.

I would suggest you report it as a bug and get one of the bugteam to look into it a little further.
Title: New openssl vulnerabilities
Post by: guest22 on March 21, 2004, 02:42:42 PM: Please mail all potential security issues to security@lists.contribs.org.

The above issue has already been received that way.

Thanks,
RequestedDeletion
Title: New openssl vulnerabilities
Post by: Anonymous on March 21, 2004, 10:55:57 PM: Quote from: "guest22"
Please mail all potential security issues to security@lists.contribs.org.

The above issue has already been received that way.

Thanks,
RequestedDeletion

What is this(?), sorry RequestedDeletion but your reply reads like you don't want any discussion of security issues. Is there no public forum for security issues?

Is there someplace here that deals with what is required to keep the current release secure and up to date with or without talking about security issues?

If there is an unsolved security issue there could at least be some where to read about it, and to point people to when they miss it.

I could be wrong here but I thought security was a public issue.
Title: New openssl vulnerabilities
Post by: Anonymous on March 22, 2004, 06:15:51 AM: The above post says to report it as a bug. It thing RequestedDeletion is just letting the poster know not to post it as a bug, but to send it the the security email address to it could be dealt this appropriately. Also, I don't think there is nothing wrong with a discussion, but that post didn't seem like they wanted to start a discussion on what the issue and/or vulnerabilities were.
Title: New openssl vulnerabilities
Post by: Michiel on March 24, 2004, 10:53:27 PM: Quote from: "smeghead"
SME 6.0 uses openssl-0.9.6b-35.7 so would be vulnerable based on the stated info.

One of the stated vulnerabilities applies indeed to the openssl package shipped with SME 6.0. The other vulnerabilities apply to later versions :hammer:

The impact of the vulnerability is a DOS attack. Whether a DOS attack is really a threat or merely an annoyance depends on your particular situation, but I don't think we should immediately start upgrading. Before implementing a new package like openssl it must be thorougly tested for its impact on other applications. I'm planning to test 0.9.7d early next week and would welcome comments from other users.

Michiel
Title: New openssl vulnerabilities
Post by: guest22 on March 25, 2004, 12:09:14 AM: Thanks for the feedback and thoughts guys.

The following was intended by my post:
- Post all possible security concerns to security@lists.contribs.org first before any public announcement. This is common practice, thus giving the 'authors' a chance to prepare and react on any issue.

- All public discussions are welcomed, just not the ones that _could_ possiblibily endanger other users or could give 'evil' people a 'great potential market', before the authors can react on it.

So we _kindly_ ask you to report _any_ possible security issue to security@lists.contribs.org and give contribs.org a reasonable amount of time to react before 'flames' start or unnessecary discussions start.

Once again, the above issue is under investigation. It's the polcy of contribs.org to react ASAP on ANY issue and provide the community with feedback and/or solutions. (And we DO need help with that!)

Thanks,
RequestedDeletion
Title: good summary of policy
Post by: patrickthickey on March 25, 2004, 02:32:06 PM: Thanks for clarifying this issue.

I sense there is a core of developers who have hashed this out and are working within a framework.

What is missing is sharing this framework outside your group. Many of us are not developers, but neither are we Luddites.

Simply explaining how you wish this process to operate goes a long way to assuage us all and imparts perspective.

Thanks for your efforts.

regards,

patrick
Title: New openssl vulnerabilities
Post by: Anonymous on March 25, 2004, 10:42:55 PM: So? Is this something to worry about? Do we need to shut off ssh for a while?

I have been looking for the documentation on what is vulnerable in each version and how to fix it, anyone seen it.

Is the current release up to date, what about 6.3?

I seem to remember on the old e-smith.com site there was a table with links to the versions and what needed updating or turning off. Anyone remember this?
Title: New openssl vulnerabilities
Post by: Anonymous on March 25, 2004, 10:57:16 PM: This link is from the e-smith.org site. It is broken now but is this what you wanted?

http://www.e-smith.org/faq.php3#8q1
Title: And yet
Post by: Guest on March 29, 2004, 01:41:04 AM: No new kernel, no new OpenSSL patch (hardly childs play) and no secured Apache build.

Really very unimpressive stuff isnt it ?

Thought you guys had a handle on this stuff - wanting to poll us for $99 per server patch subs when you can't even get a basic rpm out isn't that impressive :(
Title: Re: And yet
Post by: Anonymous on March 29, 2004, 10:02:47 AM: Quote from: "Guest"
No new kernel, no new OpenSSL patch (hardly childs play) and no secured Apache build.

Really very unimpressive stuff isnt it ?

Thought you guys had a handle on this stuff - wanting to poll us for $99 per server patch subs when you can't even get a basic rpm out isn't that impressive :(

Considering this is now a community distro - Feel free to roll out the basic rpm.
Title: New openssl vulnerabilities
Post by: Anonymous on April 06, 2004, 05:32:54 PM: Quote from: "Anonymous"
So? Is this something to worry about? Do we need to shut off ssh for a while?

If you can live without ssh, you don't need to worry about a *possible* Denial of Service, do you?