Gentoo Linux
Gentoo Linux Security Advisory GLSA 200506-20
Severity: High
Title: Cacti: Several vulnerabilities
Date: June 22, 2005
Bugs: #96243
ID: 200506-20
Synopsis
Cacti is vulnerable to several SQL injection and file inclusion
vulnerabilities.
Background
Cacti is a complete web-based frontend to rrdtool.
Affected packages
Package / Vulnerable / Unaffected
1 net-analyzer/cacti < 0.8.6e >= 0.8.6e
Description
Cacti fails to properly sanitize input which can lead to SQL
injection as well as PHP file inclusion.
Impact
An attacker could potentially exploit the file inclusion to
execute arbitrary code with the permissions of the web server. An
attacker could exploit the SQL injection to gain information from
the database. Only systems with register_globals set to “On” are
vulnerable to the file inclusion bugs. Gentoo Linux ships with
register_globals set to “Off” by default.
Workaround
There is no known workaround at this time.
Resolution
All Cacti users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6e"
Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.
References
[ 1 ] Cacti Release Notes
http://www.cacti.net/release_notes_0_8_6e.php
[ 2 ] iDEFENSE SQL injection advisory
http://www.idefense.com/application/poi/display?id=267&type=vulnerabilities&flashstatus=false
[ 3 ] iDEFENSE config_settings advisory
http://www.idefense.com/application/poi/display?id=266&type=vulnerabilities&flashstatus=false
[ 4 ] iDEFENSE remote file inclusion advisory
http://www.idefense.com/application/poi/display?id=265&type=vulnerabilities&flashstatus=false
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200506-20.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
Gentoo Linux Security Advisory GLSA 200506-21
Severity: Normal
Title: Trac: File upload vulnerability
Date: June 22, 2005
Bugs: #96572
ID: 200506-21
Synopsis
Trac may allow remote attackers to upload files, possibly
leading to the execution of arbitrary code.
Background
Trac is a minimalistic web-based project management, wiki and
bug tracking system including a Subversion interface.
Affected packages
Package / Vulnerable / Unaffected
1 www-apps/trac < 0.8.4 >= 0.8.4
Description
Stefan Esser of the Hardened-PHP project discovered that Trac
fails to validate the “id” parameter when uploading attachments to
the wiki or the bug tracking system.
Impact
A remote attacker could exploit the vulnerability to upload
arbitrary files to a directory where the webserver has write access
to, possibly leading to the execution of arbitrary code.
Workaround
There is no known workaround at this time.
Resolution
All Trac users should upgrade to the latest available
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/trac-0.8.4"
References
[ 1 ] Hardened PHP Advisory 012005
http://www.hardened-php.net/advisory-012005.php
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200506-21.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
Mandriva Linux
Mandriva Linux Security Update Advisory
Package name: sudo
Advisory ID: MDKSA-2005:103
Date: June 21st, 2005
Affected versions: 10.0, 10.1, 10.2, Corporate 3.0, Corporate
Server 2.1
Problem Description:
A race condition was discovered in sudo by Charles Morris. This
could lead to the escalation of privileges if /etc/sudoers allowed
a user to execute selected programs that were then followed by
another line containing the pseudo-command “ALL”. By creating
symbolic links at a certain time, that user could execute arbitrary
commands.
The updated packages have been patched to correct this
problem.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1993
http://www.sudo.ws/sudo/alerts/path_race.html
Updated Packages:
Mandrakelinux 10.0:
0fdbddfa1ca2298a05261c77c2eb0b43
10.0/RPMS/sudo-1.6.7-0.p5.2.2.100mdk.i586.rpm
523d0cfc297e81c3381d5df89078b3bc
10.0/SRPMS/sudo-1.6.7-0.p5.2.2.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
69b25ae195069271c0a037aaa1912722
amd64/10.0/RPMS/sudo-1.6.7-0.p5.2.2.100mdk.amd64.rpm
523d0cfc297e81c3381d5df89078b3bc
amd64/10.0/SRPMS/sudo-1.6.7-0.p5.2.2.100mdk.src.rpm
Mandrakelinux 10.1:
07e35abe22a51cbb66d8969cb6cd7738
10.1/RPMS/sudo-1.6.8p1-1.2.101mdk.i586.rpm
5d636e00903aa9f1e954b658754379f0
10.1/SRPMS/sudo-1.6.8p1-1.2.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
3fe900becdac7248053415e5c37029ca
x86_64/10.1/RPMS/sudo-1.6.8p1-1.2.101mdk.x86_64.rpm
5d636e00903aa9f1e954b658754379f0
x86_64/10.1/SRPMS/sudo-1.6.8p1-1.2.101mdk.src.rpm
Mandrakelinux 10.2:
fa3d69895a19bd321666c565e9919cdb
10.2/RPMS/sudo-1.6.8p1-2.1.102mdk.i586.rpm
c9abd9d5ad76e4c5d8da20af10ba4601
10.2/SRPMS/sudo-1.6.8p1-2.1.102mdk.src.rpm
Mandrakelinux 10.2/X86_64:
56cba44d316f3d1623f20a3e5c102721
x86_64/10.2/RPMS/sudo-1.6.8p1-2.1.102mdk.x86_64.rpm
c9abd9d5ad76e4c5d8da20af10ba4601
x86_64/10.2/SRPMS/sudo-1.6.8p1-2.1.102mdk.src.rpm
Corporate Server 2.1:
0574ea8f264d1ac850bc7401da9dfd46
corporate/2.1/RPMS/sudo-1.6.6-2.2.C21mdk.i586.rpm
7520cfd6be4d4d2ce87787ebf1dccca2
corporate/2.1/SRPMS/sudo-1.6.6-2.2.C21mdk.src.rpm
Corporate Server 2.1/X86_64:
e971d73a7bd06d23d40d102bf113af75
x86_64/corporate/2.1/RPMS/sudo-1.6.6-2.2.C21mdk.x86_64.rpm
7520cfd6be4d4d2ce87787ebf1dccca2
x86_64/corporate/2.1/SRPMS/sudo-1.6.6-2.2.C21mdk.src.rpm
Corporate 3.0:
551c661042bae4c9da2fab38fcfbf08a
corporate/3.0/RPMS/sudo-1.6.7-0.p5.2.2.C30mdk.i586.rpm
ded9307a4c361548d164765a421e0f9e
corporate/3.0/SRPMS/sudo-1.6.7-0.p5.2.2.C30mdk.src.rpm
Corporate 3.0/X86_64:
f392eecc2886cf8c73a4c27c3d86112d
x86_64/corporate/3.0/RPMS/sudo-1.6.7-0.p5.2.2.C30mdk.x86_64.rpm
ded9307a4c361548d164765a421e0f9e
x86_64/corporate/3.0/SRPMS/sudo-1.6.7-0.p5.2.2.C30mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
Slackware Linux
[slackware-security] sudo (SSA:2005-172-01)
New Sudo packages are available for Slackware 8.1, 9.0, 9.1,
10.0, 10.1, and -current to fix a security issue. A race condition
could allow a user with Sudo privileges to run arbitrary
commands.
For more details, see:
http://www.courtesan.com/sudo/alerts/path_race.html
Here are the details from the Slackware 10.1 ChangeLog:
+————————–+
patches/packages/sudo-1.6.8p9-i486-1.tgz: Upgraded to
sudo-1.6.8p9.
This new version of Sudo fixes a race condition in command pathname
handling that could allow a user with Sudo privileges to run
arbitrary commands.
For full details, see the Sudo site:
http://www.courtesan.com/sudo/alerts/path_race.html
(* Security fix *)
+————————–+
Where to find the new
packages:
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/sudo-1.6.8p9-i386-1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/sudo-1.6.8p9-i386-1.tgz
Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/sudo-1.6.8p9-i486-1.tgz
Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/sudo-1.6.8p9-i486-1.tgz
Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/sudo-1.6.8p9-i486-1.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/sudo-1.6.8p9-i486-1.tgz
MD5 signatures:
Slackware 8.1 package:
d224ba8c2c7de90db45aa6f011d4e00f sudo-1.6.8p9-i386-1.tgz
Slackware 9.0 package:
d6f9623360ba84a9ff9b5fc550654a85 sudo-1.6.8p9-i386-1.tgz
Slackware 9.1 package:
6a63970c021da407741e082cde5082fc sudo-1.6.8p9-i486-1.tgz
Slackware 10.0 package:
5b37f465d3a55845e1fca06140f04804 sudo-1.6.8p9-i486-1.tgz
Slackware 10.1 package:
8b89c8935bc74b23cb85fedbfacd6fd1 sudo-1.6.8p9-i486-1.tgz
Slackware -current package:
7e85716217c1fc8f8fdf2b89c76f189b sudo-1.6.8p9-i486-1.tgz
Installation instructions:
Upgrade the packages as root:
# upgradepkg sudo-1.6.8p9-i486-1.tgz
+—–+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
SUSE Linux
SUSE Security Announcement
Package: java2
Announcement ID: SUSE-SA:2005:032
Date: Wed, 22 Jun 2005 13:00:00 +0000
Affected Products: 8.2, 9.0, 9.1, 9.2, 9.3 SUSE Linux Desktop 1.0
SUSE Linux Enterprise Server 9 Open Enterprise Server 9 Novell
Linux Desktop 9
Vulnerability Type: remote code execution
Severity (1-10): 8
SUSE Default Package: yes
Cross-References: CAN-2005-0836 CAN-2005-1974
Content of This Advisory:
- Security Vulnerability Resolved: java applet and java webstart
security problems Problem Description - Solution or Work-Around
- Special Instructions and Notes
- Package Location and Checksums
- Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE
Security Summary Report. - Authenticity Verification and Additional Information
1) Problem Description and Brief Discussion
Two security bugs in the SUN Java implementation have been
fixed.
Java Web Start can be exploited remotely due to an error in
input validation of tags in JNLP files, so an attacker can pass
arbitrary command-line options to the virtual machine to disable
the sandbox and get access to files.
This is tracked by the Mitre CVE ID CAN-2005-0836.
The second bug is equal to the first one but can also triggered
by untrusted applets.
This is tracked by the Mitre CVE ID CAN-2005-1974.
2) Solution or Work-Around
Install the updated packages.
A possible workaround is to disable Java Applets in your web
browser.
3) Special Instructions and Notes
None.
4) Package Location and Checksums
The preferred method for installing security updates is to use
the YaST Online Update (YOU) tool. YOU detects which updates are
required and automatically performs the necessary steps to verify
and install them. Alternatively, download the update packages for
your distribution manually and verify their integrity by the
methods listed in Section 6 of this announcement. Then install the
packages using the command
rpm -Fhv <file.rpm>
to apply the update, replacing <file.rpm> with the file
name of the downloaded RPM package.
Our maintenance customers are notified individually. The
packages are offered for installation from the maintenance web.
x86 Platform:
SUSE Linux 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-1.4.2.08-0.1.i586.rpm
fbc21570966da99cd3bb7f1c1fd636c8
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-alsa-1.4.2.08-0.1.i586.rpm
82f310e66597d11099f61364945b48ce
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-demo-1.4.2.08-0.1.i586.rpm
f7bb684e9fe2aaa5a683957afc8b6517
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-devel-1.4.2.08-0.1.i586.rpm
76f6a5edc2c3994548c2ddcbe3a4484f
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-jdbc-1.4.2.08-0.1.i586.rpm
729c184ea79b88bdc5a63b08160d7315
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-plugin-1.4.2.08-0.1.i586.rpm
34656e90494245d8d024ce4c62a9514d
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.rpm
5435cecd1ac5b765a0be01548af7d718
SUSE Linux 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-1.4.2.08-0.1.i586.rpm
2441a70049233806e65f2628ef43d8e7
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-alsa-1.4.2.08-0.1.i586.rpm
794e45b4c1ee93d7afcfcc764699cce0
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-demo-1.4.2.08-0.1.i586.rpm
4fb798a547e358259da3cc9eb4e3a787
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-devel-1.4.2.08-0.1.i586.rpm
7ac2e1fdb86be84452f43fe7d0226ba7
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-jdbc-1.4.2.08-0.1.i586.rpm
29f7be94acb971a69037a8816baec070
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-plugin-1.4.2.08-0.1.i586.rpm
72d6c05a072e85f23d8a0ba2a8d44bab
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.rpm
a4c9c005e71e95a5badf98d0cfcdbf27
SUSE Linux 9.1:
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.14.i586.rpm
258293f19eb8d7abf6909651711dfa7d
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-jre-1.4.2-129.14.i586.rpm
48bb99e7d8dd272b1f49d5d65bf036e7 source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/java2-1.4.2-129.14.src.rpm
0316bc3bfaef1261fdb7a1a7c880ff34
SUSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/java2-1.4.2-144.i586.rpm
1560a3e8be7d9864443d68a1ece7ac5a
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/java2-jre-1.4.2-144.i586.rpm
9c516cde514e8d851abbd6ec0419ac7a source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/java2-1.4.2-144.src.rpm
0b541e9798ef1f228b421fa1f0d53c95
SUSE Linux 8.2:
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/java2-1.4.2-144.i586.rpm
7ac58793edd29e2aa4279dd3de3d0546
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/java2-jre-1.4.2-144.i586.rpm
ad7221fed4a7b9331b0acf74f4d718ca source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/java2-1.4.2-144.src.rpm
8369799cf74b347d7eff109cd1aa1e2e
x86-64 Platform:
SUSE Linux 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-1.4.2.08-0.1.x86_64.rpm
5535a1d570e5f5b5876a3855ce7c0cd1
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-alsa-1.4.2.08-0.1.x86_64.rpm
fbfb7f90e6a069a3f87d30ac12f32456
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-demo-1.4.2.08-0.1.x86_64.rpm
c2f6ce7ed3163c03543d9ef1b5144e43
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-devel-1.4.2.08-0.1.x86_64.rpm
aefcbe8faf1ccb5f8484f7a22567a612
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-jdbc-1.4.2.08-0.1.x86_64.rpm
3cc3c8e8abe89894f5424c113213c754
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-plugin-1.4.2.08-0.1.x86_64.rpm
0d919e446ba1867344cc1c4c49279520
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/java-1_4_2-sun-src-1.4.2.08-0.1.x86_64.rpm
2a0e661ba41ac15889b44a943042660f source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/java-1_4_2-sun-1.4.2.08-0.1.src.rpm
00fcd6dceed29ab0c76b8124ae1879f3
SUSE Linux 9.1:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/java2-1.4.2-129.14.x86_64.rpm
d0952fab911d27d6d471a703f871835a
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/java2-jre-1.4.2-129.14.x86_64.rpm
1d69b379938d15e7ebd193caf84c85d7 source rpm(s):
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/java2-1.4.2-129.14.src.rpm
d135ff25b45cd7d788b6500ec67b29d9
SUSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/java2-1.4.2-144.x86_64.rpm
74ed54181741b8a573be44e0f194b796
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/java2-jre-1.4.2-144.x86_64.rpm
91550144e9bda42c9694b21ec217de19 source rpm(s):
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/java2-1.4.2-144.src.rpm
036cdd6520123345a3a32617c227bc27
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and
on Web sites. The authenticity and integrity of a SUSE security
announcement is guaranteed by a cryptographic signature in each
announcement. All SUSE security announcements are published with a
valid signature.To verify the signature of the announcement, save it as text
into a file and run the commandgpg –verify <file>
replacing <file> with the name of the file where you saved
the announcement. The output for a valid signature looks like:gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from “SuSE Security Team <security@suse.de>”where <DATE> is replaced by the date the document was
signed.If the security team’s key is not contained in your key ring,
you can import it from the first installation CD. To import the
key, use the commandgpg –import gpg-pubkey-3d25d3d9-36e12d04.asc
- Package authenticity verification:
SUSE update packages are available on many mirror FTP servers
all over the world. While this service is considered valuable and
important to the free and open source software community, the
authenticity and the integrity of a package needs to be verified to
ensure that it has not been tampered with.There are two verification methods that can be used
independently from each other to prove the authenticity of a
downloaded file or RPM package:- Using the internal gpg signatures of the rpm package
- MD5 checksums as provided in this announcement
- The internal rpm package signatures provide an easy way to
verify the authenticity of an RPM package. Use the commandrpm -v –checksig <file.rpm>
to verify the signature of the package, replacing
<file.rpm> with the filename of the RPM package downloaded.
The package is unmodified if it contains a valid signature from
build@suse.de with the key ID
9C800ACA. This key is automatically imported into the RPM database
(on RPMv4-based distributions) and the gpg key ring of ‘root’
during installation. You can also find it on the first installation
CD and at the end of this announcement. - If you need an alternative means of verification, use the
md5sumcommand to verify the authenticity of the packages. Execute the
commandmd5sum <filename.rpm>
after you downloaded the file from a SUSE FTP server or its
mirrors. Then compare the resulting md5sum with the one that is
listed in the SUSE security announcement. Because the announcement
containing the checksums is cryptographically signed (by security@suse.de), the checksums show
proof of the authenticity of the package if the signature of the
announcement is valid. Note that the md5 sums published in the SUSE
Security Announcements are valid for the respective packages only.
Newer versions of these packages cannot be verified.
- The internal rpm package signatures provide an easy way to
- SUSE runs two security mailing lists to which any interested
party may subscribe: - General Linux and SUSE security discussion. All SUSE security
announcements are sent to this list. To subscribe, send an e-mail
to - SUSE’s announce-only mailing list.
Only SUSE’s security announcements are sent to this list. To
subscribe, send an e-mail to<suse-security-announce-subscribe@suse.com>.
For general information or the frequently asked questions (FAQ),
send mail to <suse-security-info@suse.com>
or <suse-security-faq@suse.com>.
SUSE’s security contact is <security@suse.com> or
<security@suse.de>. The
<security@suse.de>
public key is listed below.
The information in this advisory may be distributed or
reproduced, provided that the advisory is not modified in any way.
In particular, the clear text signature should show proof of the
authenticity of the text.
SUSE Linux Products GmbH provides no warranties of any kind
whatsoever with respect to the information contained in this
security advisory.
Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>