SUSE Linux
SUSE Security Announcement
Package: permissions
Announcement ID: SUSE-SA:2005:062
Date: Mon, 24 Oct 2005 08:00:00 +0000
Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2
SUSE LINUX 9.1 SuSE Linux 9.0 SuSE Linux Desktop 1.0 SuSE Linux
Enterprise Server 8 SUSE SLES 9 UnitedLinux 1.0
Vulnerability Type: information disclosure
Severity (1-10): 4
SUSE Default Package: yes
Cross-References: –
Content of This Advisory:
- Security Vulnerability Resolved: information disclosure via
permissions package Problem Description - Solution or Work-Around
- Special Instructions and Notes
- Package Location and Checksums
- Pending Vulnerabilities, Solutions, and Work-Arounds:
- See SUSE Security Summary Report
- Authenticity Verification and Additional Information
1) Problem Description and Brief Discussion
SUSE LINUX ships with three pre defined sets of permissions,
‘easy’, ‘secure’ and ‘paranoid’. The chkstat program contained in
the permissions package is used to set those permissions to the
chosen level. Level ‘easy’ which is the default allows some world
writeable directories. /usr/src/packages/RPMS and subdirectories is
among them. To prevent users from playing tricks in there e.g.
linking to /etc/shadow chkstat doesn’t touch symlinks or files with
an hardlink count != 1.
Stefan Nordhausen discovered a way to trick this check. To gain
access to e.g. /etc/shadow a malicious user has to place a hardlink
to that file at a place that is modified by chkstat. chkstat will
not touch the file because it has a hardlink count of two. However,
if the administrator modifies the user database the original
/etc/shadow gets deleted and replaced by a new one. That means the
hardlink count of the file created by the malicious user drops to
one. At this point chkstat will modify the file’s permissions so
anyone can read it. So it’s technically impossible for chkstat to
modify permissions of files in world writeable directories in a
secure way.
One such world writeable directoy in level ‘easy’ is
/usr/src/packages/RPMS. Only subdirectories need to be adjusted in
this case. Since normal users cannot create hard links to
directories the problem can be solved by telling chkstat to not
accept regular files. Another problematic directory is /var/games.
Only members of group ‘games’ may write to it but it’s likely that
games with setgid ‘games’ are exploitable to allow user to gain
group ‘games’ membership.
The updated permissions package now tells chkstat when to only
accept directories and no longer touches anything below /var/games
to solve the described problems. On SUSE Linux 9.0 xmcd contained
world writeable directories that suffered from the same problems.
Updated xmcd packages for SUSE Linux 9.0 are therefore provided as
well.
We like to thank Stefan Nordhausen for pointing out the
problems.
2) Solution or Work-Around
In permissions level ‘secure’ no games are setgid ‘games’ and
/usr/src/packages is not world writeable. You are safe if you
switched to that level before any potentially malicious users could
log in.
3) Special Instructions and Notes
None
4) Package Location and Checksums
The preferred method for installing security updates is to use
the YaST Online Update (YOU) tool. YOU detects which updates are
required and automatically performs the necessary steps to verify
and install them. Alternatively, download the update packages for
your distribution manually and verify their integrity by the
methods listed in Section 6 of this announcement. Then install the
packages using the command
rpm -Fhv <file.rpm>
to apply the update, replacing <file.rpm> with the
filename of the downloaded RPM package.
x86 Platform:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/filesystem-10.0-4.2.i586.rpm
5f634cb4cd45ad3283e6055c3794ecff
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/permissions-2005.10.20-0.1.i586.rpm
7e9beef0e8df0ba419ff64ac96ad57e1
SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/permissions-2005.10.20-0.1.i586.rpm
216afa8469276198015e5fff177580d2
SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/permissions-2005.10.20-0.1.i586.rpm
3d61d27c7bf81889a321972ac12dcaab
SUSE LINUX 9.1:
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/permissions-2005.10.20-0.2.i586.rpm
72d9a0b5b0b750fb656aa54eb7c6ebdd
SuSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/permissions-2005.10.20-3.i586.rpm
cf8c022048e93fc6d159913ad7824e6a
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/xmcd-3.0.2-552.i586.rpm
f3e82cf342c45ab46fca16c98587b22d
Power PC Platform:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/filesystem-10.0-4.2.ppc.rpm
f0077c15af6a95edbd7aa25055668967
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/permissions-2005.10.20-0.1.ppc.rpm
7f6552f5450b98821912c8703c580b38
x86-64 Platform:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/filesystem-10.0-4.2.x86_64.rpm
214b7d7fc6dfdac3e07eff2ad4abf0e9
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/permissions-2005.10.20-0.1.x86_64.rpm
7b15cb94762ae6bc1cd7e441a08c39b4
SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/permissions-2005.10.20-0.1.x86_64.rpm
0d11d64965eee2cefeb56edfe258fee4
SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/permissions-2005.10.20-0.1.x86_64.rpm
4f2373ed4a93e3974b919e595a9490b7
SUSE LINUX 9.1:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/permissions-2005.10.20-0.2.x86_64.rpm
3ca12f4aae9b7a1b484e6a0e4f8f658d
SuSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/permissions-2005.10.20-3.x86_64.rpm
853503b8868c1d2a34d05aaf6824cf83
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/xmcd-3.0.2-552.x86_64.rpm
fd95ac5dd3980af5308abe7062849149
Sources:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/filesystem-10.0-4.2.src.rpm
1784328035be5507b20737a2edfce8d8
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/permissions-2005.10.20-0.1.src.rpm
0fc7ffe7a9688f04c916c50709db08da
SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/permissions-2005.10.20-0.1.src.rpm
0a856cadf3b65db9434f20203413aba3
SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/permissions-2005.10.20-0.1.src.rpm
57c3240513c9861634e79547df4f8cf0
SUSE LINUX 9.1:
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/permissions-2005.10.20-0.2.src.rpm
b47b5e76f759227d325a33dbbcb5ae96
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/permissions-2005.10.20-0.2.src.rpm
f98fa35639b7d118e6aed1ecb99c4cbb
SuSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/permissions-2005.10.20-3.src.rpm
8fa2759f6d2012aee4571e5830ea26eb
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/xmcd-3.0.2-552.src.rpm
44f64e89f871fd07bd6291d88277b327
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/permissions-2005.10.20-3.src.rpm
48857a183ff120bc39ebb280eaca8764
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/xmcd-3.0.2-552.src.rpm
9e961bdfaf2c935857eb86bd64b74c83
Our maintenance customers are notified individually. The
packages are offered for installation from the maintenance web:
http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/f91efcfdcc1e3f92b382d1725439765d.html
http://portal.suse.com/psdb/f91efcfdcc1e3f92b382d1725439765d.html
http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/5811be293ad9fa388c6d368261df375d.html
http://portal.suse.com/psdb/5811be293ad9fa388c6d368261df375d.html
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
- See SUSE Security Summary Report
6) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and
on Web sites. The authenticity and integrity of a SUSE security
announcement is guaranteed by a cryptographic signature in each
announcement. All SUSE security announcements are published with a
valid signature.To verify the signature of the announcement, save it as text
into a file and run the commandgpg –verify <file>
replacing <file> with the name of the file where you saved
the announcement. The output for a valid signature looks like:gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg:
Good signature from “SuSE Security Team <security@suse.de>”where <DATE> is replaced by the date the document was
signed.If the security team’s key is not contained in your key ring,
you can import it from the first installation CD. To import the
key, use the commandgpg –import gpg-pubkey-3d25d3d9-36e12d04.asc
- Package authenticity verification:
SUSE update packages are available on many mirror FTP servers
all over the world. While this service is considered valuable and
important to the free and open source software community, the
authenticity and the integrity of a package needs to be verified to
ensure that it has not been tampered with.There are two verification methods that can be used
independently from each other to prove the authenticity of a
downloaded file or RPM package:- Using the internal gpg signatures of the rpm package
- MD5 checksums as provided in this announcement
- The internal rpm package signatures provide an easy way to
verify the authenticity of an RPM package. Use the commandrpm -v –checksig <file.rpm>
to verify the signature of the package, replacing
<file.rpm> with the filename of the RPM package downloaded.
The package is unmodified if it contains a valid signature from
build@suse.de with the key ID
9C800ACA. This key is automatically imported into the RPM database
(on RPMv4-based distributions) and the gpg key ring of ‘root’
during installation. You can also find it on the first installation
CD and at the end of this announcement. - If you need an alternative means of verification, use the
md5sumcommand to verify the authenticity of the packages. Execute the
commandmd5sum <filename.rpm>
after you downloaded the file from a SUSE FTP server or its
mirrors. Then compare the resulting md5sum with the one that is
listed in the SUSE security announcement. Because the announcement
containing the checksums is cryptographically signed (by security@suse.de), the checksums show
proof of the authenticity of the package if the signature of the
announcement is valid. Note that the md5 sums published in the SUSE
Security Announcements are valid for the respective packages only.
Newer versions of these packages cannot be verified.
- SUSE runs two security mailing lists to which any interested
party may subscribe: - General Linux and SUSE security discussion. All SUSE security
announcements are sent to this list. To subscribe, send an e-mail
to - SUSE’s announce-only mailing list. Only SUSE’s security
announcements are sent to this list. To subscribe, send an e-mail
to<suse-security-announce-subscribe@suse.com>.
For general information or the frequently asked questions (FAQ),
send mail to <suse-security-info@suse.com>
or <suse-security-faq@suse.com>.
SUSE’s security contact is <security@suse.com> or
<security@suse.de>. The
<security@suse.de>
public key is listed below.
The information in this advisory may be distributed or
reproduced, provided that the advisory is not modified in any way.
In particular, the clear text signature should show proof of the
authenticity of the text.
SUSE Linux Products GmbH provides no warranties of any kind
whatsoever with respect to the information contained in this
security advisory.
Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>
Trustix Secure Linux
Trustix Secure Linux Security Advisory #2005-0059
Package names: apache, lynx, mod_php4, openssl, php4, php,
squid, texinfo, wget
Summary: Multiple vulnerabilities
Date: 2005-10-21
Affected versions: Trustix Secure Linux 2.2 Trustix Secure Linux
3.0 Trustix Operating System – Enterprise Server 2
Package description:
apache
Apache is a full featured web server that is freely available, and
also happens to be the most widely used.
lynx
Lynx is a text-based Web browser. Lynx does not display any
images,but it does support frames, tables and most other HTML tags.
Lynx’s advantage over graphical browsers is its speed: Lynx starts
and exits quickly and swiftly when displaying Web pages.
mod_php4
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP
also offers built-in database integration for several commercial
and non-commercial database management systems, so writing a
database-enabled web page with PHP is fairly simple. The most
common use of PHP coding is probably as a replacement for CGI
scripts. The mod_php module enables the Apache web server to
understand and process the embedded PHP language in web pages.
openssl
A C library that provides various crytographic algorithms and
protocols, including DES, RC4, RSA, and SSL. Includes shared
libraries.
php4
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP
also offers built-in database integration for several commercial
and non-commercial database management systems, so writing a
database-enabled web page with PHP is fairly simple. The most
common use of PHP coding is probably as a replacement for CGI
scripts. The mod_php module enables the Apache web server to
understand and process the embedded PHP language in web pages.
php
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP
also offers built-in database integration for several commercial
and non-commercial database management systems, so writing a
database-enabled web page with PHP is fairly simple. The most
common use of PHP coding is probably as a replacement for CGI
scripts. The mod_php module enables the Apache web server to
understand and process the embedded PHP language in web pages.
squid
Squid is a high-performance proxy caching server for Web clients,
supporting FTP, gopher, and HTTP data objects. Unlike traditional
caching software, Squid handles all requests in a single,
non-blocking, I/O-driven process. Squid keeps meta data and
especially hot objects cached in RAM, caches DNS lookups, supports
non-blocking DNS lookups, and implements negative caching of failed
requests.
texinfo
Texinfo is a documentation system that can produce both online
information and printed output from a single source file. Normally,
you’d have to write two separate documents: one for online help or
other online information and the other for a typeset manual or
other printed work. Using Texinfo, you only need to write one
source document. Then when the work needs revision, you only have
to revise one source document. The GNU Project uses the Texinfo
file format for most of its documentation.
wget
GNU Wget is a file retrieval utility which can use either the HTTP
or FTP protocols. Wget features include the ability to work in the
background while you’re logged out, recursive retrieval of
directories, file name wildcard matching, remote file timestamp
storage and comparison, use of Rest with FTP servers and Range with
HTTP servers to retrieve files over slow or unstable connections,
support for Proxy servers, and configurability.
Problem description:
apache < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- New Upstream and Multiple Vendor Security Fixes
- SECURITY Fix: CVE-2005-2700, CVE-2005-2491, CVE-2005-2088,
CVE-2005-2728, CVE-2005-2088, CVE-2005-1268 . - Fix core dump if mod_auth_ldap’s mod_authldapauth_checker() was called even if
mod_authldap_checkuser_id() was not (or if
it didn’t succeed) for non-authoritative cases. - mod_proxy: Fix over-eager handling of ‘%’ for reverse
proxies. - mod_ldap: Fix various shared memory cache handling bugs.
lynx < TSL 2.2 > < TSEL 2 >
- SECURITY Fix: Fix Stack-based buffer overflow in the HTrjis
function in Lynx 2.8.6 and earlier allows remote NNTP servers to
execute arbitrary code via certain article headers that cause Lynx
to add extra escape (ESC) characters.
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CVE-2005-3120
mod_php4 < TSEL 2 >
- SECURITY Fix: A vulnerability has been identified in PHP, which
could be exploited by malicious users to bypass security policies.
This flaw is due to an error in “fopen_wrappers.c” that does not
properly restrict access to other directories when the
“open_basedir” directive includes a trailing slash, which could
allow certain scripts in a directory (e.g.”/user/test2/) to access
files in other directories whose names are substrings of the
original directory (e.g. “/user/test22/).
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CVE-2005-3054
openssl < TSL 3.0 >
- New Upstream
- SECURITY Fix: Remove the functionality of SSL_OPMSIE_SSLV2RSA_PADDING (part of SSL_OP_ALL). This option
used to disable the countermeasure against man-in-the-middle
protocol-version rollback in the SSL 2.0 server implementation,
which is a bad idea.
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CVE-2005-2969
php4 < TSL 2.2 >
- SECURITY Fix: A vulnerability has been identified in PHP, which
could be exploited by malicious users to bypass security policies.
This flaw is due to an error in “fopen_wrappers.c” that does not
properly restrict access to other directories when the
“open_basedir” directive includes a trailing slash, which could
allow certain scripts in a directory (e.g.”/user/test2/) to access
files in other directories whose names are substrings of the
original directory (e.g. “/user/test22/).
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CVE-2005-3054
php < TSL 3.0 > < TSL 2.2 >
- New Upstream
- SECURITY Fix: A vulnerability has been identified in PHP, which
could be exploited by malicious users to bypass security policies.
This flaw is due to an error in “fopen_wrappers.c” that does not
properly restrict access to other directories when the
“open_basedir” directive includes a trailing slash, which could
allow certain scripts in a directory (e.g.”/user/test2/) to access
files in other directories whose names are substrings of the
original directory (e.g. “/user/test22/).
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CVE-2005-3054
squid < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- New Upstream and Multiple Vendor Security Fixes
texinfo < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- SECURITY Fix: Frank Lichtenheld discovered that the “texindex”
program created temporary files in an insecure manner. This could
allow a symlink attack to create or overwrite arbitrary files with
the privileges of the user running texindex.
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2005-3011
wget < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- New upstream.
- SECURITY Fix: Stack-based buffer overflow in the ntlm_output
function in http-ntlm.c. when NTLM authentication is enabled,
allows remote servers to execute arbitrary code via a long NTLM
username.
The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2005-3185
Action:
We recommend that all systems with this package installed be
upgraded. Please note that if you do not need the functionality
provided by this package, you may want to remove it from your
system.
Location:
All Trustix Secure Linux updates are available from
<URI:http://http.trustix.org/pub/trustix/updates/>;
<URI:ftp://ftp.trustix.org/pub/trustix/updates/>
About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers.
With focus on security and stability, the system is painlessly kept
safe and up to date from day one using swup, the automated software
updater.
Automatic updates:
Users of the SWUP tool can enjoy having updates automatically
installed using ‘swup –upgrade’.
Questions?
Check out our mailing lists:
<URI:http://www.trustix.org/support/>;
Verification:
This advisory along with all Trustix packages are signed with the
TSL sign key.
This key is available from:
<URI:http://www.trustix.org/TSL-SIGN-KEY>;
The advisory itself is available from the errata pages at
<URI:http://www.trustix.org/errata/trustix-2.2/>;
and
<URI:http://www.trustix.org/errata/trustix-3.0/>;
or directly at
<URI:http://www.trustix.org/errata/2005/0059/>;
MD5sums of the packages:
308b171c54af53ca69fbd311584ec724
2.2/rpms/apache-2.0.55-1tr.i586.rpm
d22246cbb3e71354e6153902c8ec1fe9
2.2/rpms/apache-dbm-2.0.55-1tr.i586.rpm
5f4c3c81d43f0d5ca32ccb3c30f314c8
2.2/rpms/apache-devel-2.0.55-1tr.i586.rpm
2adad928656dd80b58cdfbf6ceea7c76
2.2/rpms/apache-html-2.0.55-1tr.i586.rpm
c97a5903d9ee7111498937c2ec82915e
2.2/rpms/apache-manual-2.0.55-1tr.i586.rpm
9b5c3c1dc65a92539e93af9915f39177
2.2/rpms/apache-suexec-2.0.55-1tr.i586.rpm
e21367f7e8eba231e780d592a46ac2ef
2.2/rpms/lynx-2.8.5-3tr.i586.rpm
d7f72636202044256732cf5aa3f5a456
2.2/rpms/php-5.0.5-1tr.i586.rpm
be9e6c6eef2e6cdb41d7284c78e2b215
2.2/rpms/php-cli-5.0.5-1tr.i586.rpm
cb634e70926928e7e8fd44f72ccce560
2.2/rpms/php-curl-5.0.5-1tr.i586.rpm
459c599f18af14ad72328333131dee78
2.2/rpms/php-devel-5.0.5-1tr.i586.rpm
e933a67389c55ee9b9bd22b114d1bb78
2.2/rpms/php-exif-5.0.5-1tr.i586.rpm
898cf72bed0e6efd1e7f8e56511056ac
2.2/rpms/php-fcgi-5.0.5-1tr.i586.rpm
7d2a3e09100f36ad3a0742ad193bfe77
2.2/rpms/php-gd-5.0.5-1tr.i586.rpm
a29e527b3a1d6925a1ead30070c42c8a
2.2/rpms/php-imap-5.0.5-1tr.i586.rpm
c4b2af1eb8ebd9fea150fb703b60238a
2.2/rpms/php-ldap-5.0.5-1tr.i586.rpm
8e58a96709c890d117a61083ca3cdca3
2.2/rpms/php-mhash-5.0.5-1tr.i586.rpm
80b2bc354ddfcbe1dabc7539ff2c4b01
2.2/rpms/php-mysql-5.0.5-1tr.i586.rpm
32d6befe9a92cd74462e7cef9bd6dd07
2.2/rpms/php-mysqli-5.0.5-1tr.i586.rpm
21005dd2d46c17ee43211da816fada73
2.2/rpms/php-pgsql-5.0.5-1tr.i586.rpm
003ea235528c40cbb201e2bb7233a264
2.2/rpms/php-zlib-5.0.5-1tr.i586.rpm
238e983cdf2456dd74be19aeb8632a28
2.2/rpms/php4-4.4.0-6tr.i586.rpm
11398dce9d02adc7db5cc5fd40522008
2.2/rpms/php4-cli-4.4.0-6tr.i586.rpm
0ebf0c95e1b0e837e7099e4f1cc37ca2
2.2/rpms/php4-curl-4.4.0-6tr.i586.rpm
ceb17c5eb5125e657cc77f796ce8569a
2.2/rpms/php4-devel-4.4.0-6tr.i586.rpm
bd4b900b4698b58682c791fc9594fcc4
2.2/rpms/php4-domxml-4.4.0-6tr.i586.rpm
676a8deb3b89c6ec0cb3335d1662b1a9
2.2/rpms/php4-exif-4.4.0-6tr.i586.rpm
a30682de1a7496e00504a64d92805cf7
2.2/rpms/php4-fcgi-4.4.0-6tr.i586.rpm
51585b634c5f4fa8536dc6548c52b0c1
2.2/rpms/php4-gd-4.4.0-6tr.i586.rpm
42b97fbf30841216d14329de331def51
2.2/rpms/php4-imap-4.4.0-6tr.i586.rpm
4465021897297d2f77f6d7a305b77adc
2.2/rpms/php4-ldap-4.4.0-6tr.i586.rpm
a0b1353fea968890386498f5bae5381f
2.2/rpms/php4-mhash-4.4.0-6tr.i586.rpm
4dd3ef7f1ff7c5eb17b179a803a25051
2.2/rpms/php4-mysql-4.4.0-6tr.i586.rpm
57a952d4a679c022eb6b068fc3eb8203
2.2/rpms/php4-pgsql-4.4.0-6tr.i586.rpm
38a7b2a2af002f7178f85dceee63a483
2.2/rpms/php4-test-4.4.0-6tr.i586.rpm
bec3cba7e234674a113be8d9d8531a5c
2.2/rpms/squid-2.5.STABLE11-1tr.i586.rpm
109ff17cb00b7446c75bc48a529742a8
2.2/rpms/texinfo-4.7-2tr.i586.rpm
46343428fe4e0831098727f877020fdb 2.2/rpms/wget-1.10.2-1tr.i586.rpm
3395c3b84ee9966d8bbf30065f0e630a
3.0/rpms/apache-2.0.55-2tr.i586.rpm
73917049e2250742496118de92c87b21
3.0/rpms/apache-dbm-2.0.55-2tr.i586.rpm
edd4e9aa3afaa18d284a627cd76efed5
3.0/rpms/apache-devel-2.0.55-2tr.i586.rpm
4c37c211cf64f45c1439ec3714fd8938
3.0/rpms/apache-html-2.0.55-2tr.i586.rpm
d5a886712855264b54e0258a2c39a552
3.0/rpms/apache-manual-2.0.55-2tr.i586.rpm
9755d7ba05b083095f1e6ec8280f9c4e
3.0/rpms/apache-suexec-2.0.55-2tr.i586.rpm
4b499c65ece0377d4e5c402af1b23609
3.0/rpms/openssl-0.9.7i-1tr.i586.rpm
93dbd422a4c28733b6e90b158348c3c3
3.0/rpms/openssl-devel-0.9.7i-1tr.i586.rpm
99de13687137116ac13ce3a23c67b444
3.0/rpms/openssl-support-0.9.7i-1tr.i586.rpm
63d897ffe0950c09460b7216701419ad
3.0/rpms/php-5.0.5-1tr.i586.rpm
34eca9c935f672e0cbf84391ba9f3b70
3.0/rpms/php-calendar-5.0.5-1tr.i586.rpm
384779d4c5ee34f62596accc579993ce
3.0/rpms/php-cli-5.0.5-1tr.i586.rpm
dd173818f7ba684c8e0426d58987668e
3.0/rpms/php-curl-5.0.5-1tr.i586.rpm
7527dfa50ca73a278512cd398b58e189
3.0/rpms/php-devel-5.0.5-1tr.i586.rpm
fb7a469048594adda7989c014d26a569
3.0/rpms/php-exif-5.0.5-1tr.i586.rpm
375a30351593da9fe907d08bbdab9e2d
3.0/rpms/php-fcgi-5.0.5-1tr.i586.rpm
d140161d7d0f2a07d9890fccbd3c9496
3.0/rpms/php-gd-5.0.5-1tr.i586.rpm
30dec126230b4b9eb4a57c85d08e6c97
3.0/rpms/php-imap-5.0.5-1tr.i586.rpm
5cde38799cb1f3438ac308dc25310600
3.0/rpms/php-ldap-5.0.5-1tr.i586.rpm
10d467eb33d7db3637db769e674cdf16
3.0/rpms/php-mhash-5.0.5-1tr.i586.rpm
c6d4099e9761b33f8878695ab435fd9f
3.0/rpms/php-mysql-5.0.5-1tr.i586.rpm
144b0c9f2856aa658ecce822dc1fbc51
3.0/rpms/php-mysqli-5.0.5-1tr.i586.rpm
8c208c65bf8a5b97b16c941f4cd6522f
3.0/rpms/php-pgsql-5.0.5-1tr.i586.rpm
9c78572b45947c534badd8827689b183
3.0/rpms/php-pspell-5.0.5-1tr.i586.rpm
5701a41a41d579dba344ef891e7f716f
3.0/rpms/php-snmp-5.0.5-1tr.i586.rpm
072c14983025f5580abc03a988f2ebc5
3.0/rpms/php-zlib-5.0.5-1tr.i586.rpm
0d08fd0117f1d68eb3d384cc0fd192af
3.0/rpms/squid-2.5.STABLE11-1tr.i586.rpm
a3b76833d8fa775af53cd22040938c91
3.0/rpms/texinfo-4.8-5tr.i586.rpm
5291e67f84de20d4d5e9892996546719
3.0/rpms/wget-1.10.2-1tr.i586.rpm
Trustix Security Team