security [ARCHIVED] April 2006

security@lists.fedoraproject.org

21 participants
14 discussions

Minor security-related issue with denyhosts
by Jason L Tibbitts III 05 Apr '06

05 Apr '06

I have nowhere to announce this I thought it should at least be mentioned. A minor vulnerability was found in denyhosts: when running in daemon mode (the default for the Extras package) hosts which time out of the blocked list (due to the PURGE_DENY setting) and then generate additional failed login attempts will not be re-added to the blocked list. This is fixed in version 2.3, which I built and pushed last night and seems to have made it out to all of the mirrors. - J<

1 0

New FE vulnerabilities
by Hans de Goede 05 Apr '06

05 Apr '06

Hi, Below the results of checking todays lwn.net's new vulnerabilities against FE. Since no-one seems to be doing it and since the FE security SIG seems to be not getting anywhere (Am I the only one who cares, I though there were some other takers?) I've taken this initiative: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=184507 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=184509 Regards, Hans

7 16

Flaw discovered in Sendmail 8.13.5
by Ronald Nissley 05 Apr '06

05 Apr '06

A security flaw has been found in Sendmail 8.13.5. The flaw is resolved in 8.13.6 or by patching 8.13.5. You can read more at http://www.sendmail.org under Recent News. What is Fedora's response for issues like this? Are users expected to install the patch, compile/install the fixed version, or will Fedora release 8.13.6 rpms shortly? Thank you, Ronald Nissley

5 6

Fedora and External Product Vulnerabilities (Bugzilla #185499, RHSA-2006-0268 (Macromedia Flash))
by David Eisenstein 05 Apr '06

05 Apr '06

Hello, The other week, I sent a notice to fedora-legacy-list and fedora- security-list regarding the Macromedia Flash critical vulnerability (CVE-2006-0024, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0024) thinking that, even though it is proprietary and therefore Fedora Core, Legacy, & Extras do not distribute it nor provide any support for it, that I could tell my friends on both lists about it, since this bug has the alleged possibility to run abitrary code remotely and so is critical. Here's the post: <http://www.redhat.com/archives/fedora-legacy-list/2006-March/msg00107.html> Some reservations were expressed to me privately about using our mailing list(s) to broadcast such information, after I already sent the thing out. Yet I sent it out, because I felt it would be important for folks who don't get Red Hat Enterprise Linux's security errata to be aware of the issue so they can protect their computers. Perhaps this needs more discussion, however. As participating members of the Fedora Project team, are there things we should not say on the mailing list(s)? I keep reading things about the wiki, for example, that say we mustn't talk (at least on Fedora's official web-pages) about things that aren't "pure" open-source or that violate some standard of open- sourciness; nor should we use the wiki resource to point to outside resources that may have (Linux) software that is proprietary or use features that in some of many jurisdictions might violate patents or other intellectual property laws. If that is so (and it's unclear to me exactly what those boundaries should be), it is unclear to me whether the instance of the buggy Flash player is one of those "no-nos" to talk about on Fedora mailing lists or wiki pages. I would have liked to suggest that someone who is a member of <fedora-list@ redhat.com> make a post there about this issue like that which I posted to fedora-legacy-list and fedora-security-list, to help inform more of the Fedora community about this critical bug. But I am not sure now that sug- gesting or doing that is appropriate? Can any of you offer any insight into this? Thank you. Thanks and Regards, David Eisenstein

8 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] April 2006