Advisories: March 25, 2005

Fedora Legacy

---

Fedora Legacy Update Advisory

Synopsis: Updated mysql packages fix security issues
Advisory ID: FLSA:2129
Issue date: 2005-03-24
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2129

CVE Names: CAN-2004-0381 CAN-2004-0388 CAN-2004-0457 CAN-2004-0835
CAN-2004-0836 CAN-2004-0837 CAN-2004-0957 CAN-2005-0004

---

---

1. Topic:

Updated mysql packages that fix various security issues are now
available.

MySQL is a multi-user, multi-threaded SQL database server.

2. Relevant releases/architectures:

Red Hat Linux 7.3 – i386
Red Hat Linux 9 – i386
Fedora Core 1 – i386

3. Problem description:

This update fixes a number of potential security problems
associated with careless handling of temporary files. The Common
Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names
CAN-2004-0381, CAN-2004-0388, CAN-2004-0457, and CAN-2005-0004 to
these issues.

Oleksandr Byelkin discovered that “ALTER TABLE … RENAME”
checked the CREATE/INSERT rights of the old table instead of the
new one. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the
mysql_real_connect function. In order to exploit this issue an
attacker would need to force the use of a malicious DNS server
(CAN-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same
(or different) MERGE tables to change the UNION could cause the
server to crash or stall (CAN-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges
to a database with a name containing an underscore (“_”), the user
also gains the ability to grant privileges to other databases with
similar names (CAN-2004-0957).

All users of mysql should upgrade to these updated packages,
which resolve these issues.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.

Please note that this update is also available via yum and apt.
Many people find this an easier way to apply updates. To use yum
issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that
you have yum or apt-get configured for obtaining Fedora Legacy
content. Please visit http://www.fedoralegacy.org/docs
for directions on how to configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us – bug
#2129 – MySQL Remote Buffer Overflow

6. RPMs required:

Red Hat Linux 7.3:

SRPM:

http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mysql-3.23.58-1.73.5.legacy.src.rpm

i386:

http://download.fedoralegacy.org/redhat/7.3/updates/i386/mysql-3.23.58-1.73.5.legacy.i386.rpm

http://download.fedoralegacy.org/redhat/7.3/updates/i386/mysql-devel-3.23.58-1.73.5.legacy.i386.rpm

http://download.fedoralegacy.org/redhat/7.3/updates/i386/mysql-server-3.23.58-1.73.5.legacy.i386.rpm

Red Hat Linux 9:

SRPM:

http://download.fedoralegacy.org/redhat/9/updates/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm

i386:

http://download.fedoralegacy.org/redhat/9/updates/i386/mysql-3.23.58-1.90.5.legacy.i386.rpm

http://download.fedoralegacy.org/redhat/9/updates/i386/mysql-devel-3.23.58-1.90.5.legacy.i386.rpm

http://download.fedoralegacy.org/redhat/9/updates/i386/mysql-server-3.23.58-1.90.5.legacy.i386.rpm

Fedora Core 1:

SRPM:

http://download.fedoralegacy.org/fedora/1/updates/SRPMS/mysql-3.23.58-4.3.legacy.src.rpm

i386:

http://download.fedoralegacy.org/fedora/1/updates/i386/mysql-3.23.58-4.3.legacy.i386.rpm

http://download.fedoralegacy.org/fedora/1/updates/i386/mysql-bench-3.23.58-4.3.legacy.i386.rpm

http://download.fedoralegacy.org/fedora/1/updates/i386/mysql-devel-3.23.58-4.3.legacy.i386.rpm

http://download.fedoralegacy.org/fedora/1/updates/i386/mysql-server-3.23.58-4.3.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name

---

04ef0f04b389f7f9fc5bb46f35f81e8503a463ba
redhat/7.3/updates/i386/mysql-3.23.58-1.73.5.legacy.i386.rpm
879f133178898835609ec305988b473e7221f825
redhat/7.3/updates/i386/mysql-devel-3.23.58-1.73.5.legacy.i386.rpm

9258ee1dd63f878c376a4e8a4f28e6dc8be11600
redhat/7.3/updates/i386/mysql-server-3.23.58-1.73.5.legacy.i386.rpm

f8dfbc8e8992bb56c1f8ba9f6917ab0fb11d0e80
redhat/7.3/updates/SRPMS/mysql-3.23.58-1.73.5.legacy.src.rpm
246af76de738268375fee9c066efdabdc5a01f73
redhat/9/updates/i386/mysql-3.23.58-1.90.5.legacy.i386.rpm
22b584c92e81cd29086fa2335910ba5b67d22711
redhat/9/updates/i386/mysql-devel-3.23.58-1.90.5.legacy.i386.rpm

4fe21cae92371b5a3ed79858ec5432807bf2cee4
redhat/9/updates/i386/mysql-server-3.23.58-1.90.5.legacy.i386.rpm

106480fe6f5d56513a4fd77592d5a8e88a9c4825
redhat/9/updates/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm
509f1caeef89bb626334be27e13c4269cc00ca75
fedora/1/updates/i386/mysql-3.23.58-4.3.legacy.i386.rpm
7e0bf52038d1ccb3e56f8f2e48f32846e9cb52ec
fedora/1/updates/i386/mysql-bench-3.23.58-4.3.legacy.i386.rpm
08c25d36193f30dceb4d3f81fbdd69f713fd94b7
fedora/1/updates/i386/mysql-devel-3.23.58-4.3.legacy.i386.rpm
8fa58175f2d1baf7d45e8c19939928d3faa113ba
fedora/1/updates/i386/mysql-server-3.23.58-4.3.legacy.i386.rpm
291ec6bb776126c3726dc7dfc067afad520300af
fedora/1/updates/SRPMS/mysql-3.23.58-4.3.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security. Our
key is available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

rpm –checksig -v <filename>

If you only wish to verify that each package has not been
corrupted or tampered with, examine only the sha1sum with the
following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0381

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0388

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0457

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0835

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0836

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0837

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0957

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0004

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>.
More project details at http://www.fedoralegacy.org

---

---

Fedora Legacy Update Advisory

Synopsis: Updated sharutils package fixes security issues
Advisory ID: FLSA:2155
Issue date: 2005-03-24
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2155

CVE Names: N/A

---

---

1. Topic:

Updated sharutils packages that fix several security issues are
now available.

The sharutils package contains a set of tools for encoding and
decoding packages of files in binary or text format.

2. Relevant releases/architectures:

Red Hat Linux 7.3 – i386
Red Hat Linux 9 – i386
Fedora Core 1 – i386

3. Problem description:

Ulf Harnhammar discovered a buffer overflow in shar.c, where the
length of data returned by the wc command is not checked. Florian
Schilhabel discovered another buffer overflow in unshar.c. Shaun
Colley discovered a stack-based buffer overflow vulnerability in
the -o command-line option handler. An attacker could exploit these
vulnerabilities to execute arbitrary code as the user running one
of the sharutils programs.

All users of sharutils should upgrade to these packages, which
resolve these issues.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.

Please note that this update is also available via yum and apt.
Many people find this an easier way to apply updates. To use yum
issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that
you have yum or apt-get configured for obtaining Fedora Legacy
content. Please visit http://www.fedoralegacy.org/docs
for directions on how to configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us – bug
#2155 – GNU Sharutils Multiple Buffer Overflows

6. RPMs required:

Red Hat Linux 7.3:

SRPM:

http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/sharutils-4.2.1-12.7.x.legacy.src.rpm

i386:

http://download.fedoralegacy.org/redhat/7.3/updates/i386/sharutils-4.2.1-12.7.x.legacy.i386.rpm

Red Hat Linux 9:

SRPM:

http://download.fedoralegacy.org/redhat/9/updates/SRPMS/sharutils-4.2.1-16.9.1.legacy.src.rpm

i386:

http://download.fedoralegacy.org/redhat/9/updates/i386/sharutils-4.2.1-16.9.1.legacy.i386.rpm

Fedora Core 1:

SRPM:

http://download.fedoralegacy.org/fedora/1/updates/SRPMS/sharutils-4.2.1-17.2.legacy.src.rpm

i386:

http://download.fedoralegacy.org/fedora/1/updates/i386/sharutils-4.2.1-17.2.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name

---

192306ce2a6cecb89a950040b850f86a28b26998
redhat/7.3/updates/i386/sharutils-4.2.1-12.7.x.legacy.i386.rpm
25fdf9cb3237bb9a7f9cd5fd211412d74f4f05c6
redhat/7.3/updates/SRPMS/sharutils-4.2.1-12.7.x.legacy.src.rpm
d6f2e705ae07f48f5dbbc742f44cbc4dea4c446d
redhat/9/updates/i386/sharutils-4.2.1-16.9.1.legacy.i386.rpm
678acff4ea03db0aa8bc8f8d90630ffe51d27625
redhat/9/updates/SRPMS/sharutils-4.2.1-16.9.1.legacy.src.rpm
457f8c7a9bc795c5d33bd8bb3e508e2b1e884df0
fedora/1/updates/i386/sharutils-4.2.1-17.2.legacy.i386.rpm
7fad3189ab60428f22869daf15304aa1c24b3037
fedora/1/updates/SRPMS/sharutils-4.2.1-17.2.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security. Our
key is available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

rpm –checksig -v <filename>

If you only wish to verify that each package has not been
corrupted or tampered with, examine only the sha1sum with the
following command:

sha1sum <filename>

8. References:

http://www.securityfocus.com/advisories/7268

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>.
More project details at http://www.fedoralegacy.org

---

---

Fedora Legacy Update Advisory

Synopsis: Updated spamassassin package fixes security issues
Advisory ID: FLSA:2268
Issue date: 2005-03-24
Product: Fedora Core
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2268

CVE Names: CAN-2004-0796

---

1. Topic:

An updated spamassassin package that fixes a denial of service
bug when parsing malformed messages is now available.

SpamAssassin provides a way to reduce unsolicited commercial
email (SPAM) from incoming email.

2. Relevant releases/architectures:

Fedora Core 1 – i386

3. Problem description:

A denial of service bug has been found in SpamAssassin versions
below 2.64. A malicious attacker could construct a message in such
a way that would cause spamassassin to stop responding, potentially
preventing the delivery or filtering of email. The Common
Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2004-0796 to this issue.

Users of SpamAssassin should update to these updated packages
which contain a backported patch and is not vulnerable to this
issue.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.

Please note that this update is also available via yum and apt.
Many people find this an easier way to apply updates. To use yum
issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that
you have yum or apt-get configured for obtaining Fedora Legacy
content. Please visit http://www.fedoralegacy.org/docs
for directions on how to configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us – bug
#2268 – SpamAssassin Message Handling DoS

6. RPMs required:

Fedora Core 1:

SRPM:

http://download.fedoralegacy.org/fedora/1/updates/SRPMS/spamassassin-2.63-0.2.2.legacy.src.rpm

i386:

http://download.fedoralegacy.org/fedora/1/updates/i386/spamassassin-2.63-0.2.2.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name

---

e76200ac598d6cb56ec18b92cfe6ce6af0181683
fedora/1/updates/i386/spamassassin-2.63-0.2.2.legacy.i386.rpm
21e17d5e33e8ba6bf76c288544719169982bb415
fedora/1/updates/SRPMS/spamassassin-2.63-0.2.2.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security. Our
key is available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

rpm –checksig -v <filename>

If you only wish to verify that each package has not been
corrupted or tampered with, examine only the sha1sum with the
following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0796

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>.
More project details at http://www.fedoralegacy.org

---

Gentoo Linux

---

Gentoo Linux Security Advisory GLSA 200503-30

---

http://security.gentoo.org/

---

Severity: Normal
Title: Mozilla Suite: Multiple vulnerabilities
Date: March 25, 2005
Bugs: #84074
ID: 200503-30

---

Synopsis

The Mozilla Suite is vulnerable to multiple issues ranging from
the remote execution of arbitrary code to various issues allowing
to trick the user into trusting fake web sites or interacting with
privileged content.

Background

The Mozilla Suite is a popular all-in-one web browser that
includes a mail and news reader.

Affected packages

---

     Package                 /  Vulnerable  /               Unaffected

---

  1  www-client/mozilla           < 1.7.6                     >= 1.7.6
  2  www-client/mozilla-bin       < 1.7.6                     >= 1.7.6
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.

---

Description

The following vulnerabilities were found and fixed in the
Mozilla Suite:

• Mark Dowd from ISS X-Force reported an exploitable heap overrun
  in the GIF processing of obsolete Netscape extension 2
  (CAN-2005-0399)
• Michael Krax reported that plugins can be used to load
  privileged content and trick the user to interact with it
  (CAN-2005-0232, CAN-2005-0527)
• Michael Krax also reported potential spoofing or
  cross-site-scripting issues through overlapping windows, image or
  scrollbar drag-and-drop, and by dropping javascript: links on tabs
  (CAN-2005-0230, CAN-2005-0231, CAN-2005-0401, CAN-2005-0591)
• Daniel de Wildt and Gael Delalleau discovered a memory
  overwrite in a string library (CAN-2005-0255)
• Wind Li discovered a possible heap overflow in UTF8 to Unicode
  conversion (CAN-2005-0592)
• Eric Johanson reported that Internationalized Domain Name (IDN)
  features allow homograph attacks (CAN-2005-0233)
• Mook, Doug Turner, Kohei Yoshino and M. Deaudelin reported
  various ways of spoofing the SSL “secure site” indicator
  (CAN-2005-0593)
• Georgi Guninski discovered that XSLT can include stylesheets
  from arbitrary hosts (CAN-2005-0588)
• Secunia discovered a way of injecting content into a popup
  opened by another website (CAN-2004-1156)
• Phil Ringnalda reported a possible way to spoof Install source
  with user:pass@host (CAN-2005-0590)
• Jakob Balle from Secunia discovered a possible way of spoofing
  the Download dialog source (CAN-2005-0585)
• Christian Schmidt reported a potential spoofing issue in HTTP
  auth prompt tab (CAN-2005-0584)
• Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team
  discovered that Mozilla insecurely creates temporary filenames in
  /tmp/plugtmp (CAN-2005-0578)

Impact

• The GIF heap overflow could be triggered by a malicious GIF
  image that would end up executing arbitrary code with the rights of
  the user running Mozilla. The other overflow issues, while not
  thought to be exploitable, would have the same impact
• By setting up malicious websites and convincing users to follow
  untrusted links or obey very specific drag-and-drop or download
  instructions, attackers may leverage the various spoofing issues to
  fake other websites to get access to confidential information, push
  users to download malicious files or make them interact with their
  browser preferences
• The temporary directory issue allows local attackers to
  overwrite arbitrary files with the rights of another local
  user

Workaround

There is no known workaround at this time.

Resolution

All Mozilla Suite users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.6"

All Mozilla Suite binary users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.6"

References

[ 1 ] CAN-2004-1156

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1156

[ 2 ] CAN-2005-0230

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0230

[ 3 ] CAN-2005-0231

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0231

[ 4 ] CAN-2005-0232

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0232

[ 5 ] CAN-2005-0233

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0233

[ 6 ] CAN-2005-0255

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0255

[ 7 ] CAN-2005-0399

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0399

[ 8 ] CAN-2005-0401

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0401

[ 9 ] CAN-2005-0527

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0527

[ 10 ] CAN-2005-0578

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0578

[ 11 ] CAN-2005-0584

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0584

[ 12 ] CAN-2005-0585

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0585

[ 13 ] CAN-2005-0588

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0588

[ 14 ] CAN-2005-0590

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0590

[ 15 ] CAN-2005-0591

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0591

[ 16 ] CAN-2005-0592

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0592

[ 17 ] CAN-2005-0593

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0593

[ 18 ] Mozilla Security Advisories

http://www.mozilla.org/projects/security/known-vulnerabilities.html

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200503-30.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

---

Gentoo Linux Security Advisory GLSA 200503-33

---

http://security.gentoo.org/

---

Severity: Normal
Title: IPsec-Tools: racoon Denial of Service
Date: March 25, 2005
Bugs: #84479
ID: 200503-33

---

Synopsis

IPsec-Tools’ racoon is affected by a remote Denial of Service
vulnerability.

Background

IPsec-Tools is a port of KAME’s implementation of the IPsec
utilities. It contains a collection of network monitoring tools,
including racoon, ping, and ping6.

Affected packages

---

     Package                   /  Vulnerable  /             Unaffected

---

  1  net-firewall/ipsec-tools      < 0.5-r1                 *>= 0.4-r1
                                                             >= 0.5-r1

Description

Sebastian Krahmer has reported a potential remote Denial of
Service vulnerability in the ISAKMP header parsing code of
racoon.

Impact

An attacker could possibly cause a Denial of Service of racoon
using a specially crafted ISAKMP packet.

Workaround

There is no known workaround at this time.

Resolution

All IPsec-Tools users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-firewall/ipsec-tools-0.4-r1"

References

[ 1 ] CAN-2005-0398

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0398

[ 2 ] ipsec-tools-devel posting

http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200503-33.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0