Linuxers April 2003

linuxers@mm.ilug-bom.org.in

123 participants
170 discussions

Mandrake Linux 9.x
by Rahul Pilani 09 Apr '03

09 Apr '03

Hi all .. new to this mailing list.. had just one query.. anyone living in the andheri area has mandrake linux 9.x cds that i can borrow.. too long a download to be downloaded.. and otherwise it is difficult to find.. sorry if I bothered you.. Rahul Pilani ________________________________________________________________________ Missed your favourite TV serial last night? Try the new, Yahoo! TV. visit http://in.tv.yahoo.com

6 6

Redhat 9.0 required...
by Kalpesh M. Vyas 09 Apr '03

09 Apr '03

Hi All, I need Redhat 9.0. Does anyone have it ??? Thanks & Warm Regards, Kalpesh M. Vyas

1 0

Ruparel college students at matunga road (western ) need help in GNU/Linux
by jayaram shastri 09 Apr '03

09 Apr '03

The college (TYBSC Computers GNU/Linux course) requires 1-2 experts who can help the students in linux. The experts may have to visit the college once or twice to solve the problems of the students. Those interested may please contact Mr. Raosaheb Vice Principal at the college immediately. Tel no: 24303081. J D Shastri __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com

1 0

Needed Help on Display..for RedHat 2.1 Advanced server
by Aswin Bhupalam 09 Apr '03

09 Apr '03

Hello e'body, Firstly, I'd like to thank u all for the support u gave for my previous querries... The Problem is, we successfully installed RedHat 2.1 Advanced server with GUI on my box. It was running properly. we were installing Oracle 9i... and after that installation we rebooted the system. Now, the system boots in command mode only. I tried "startx"...failed. I tried configuring with "setup" , it tests the resolution and stuff successfully(i'll be able to see the GUI while it probes), didnt work out... again startx fails after reboot. please tell me how to proceed.. Thanks & Regards, Aswin Bhupalam

4 3

April GLUG meet
by Kapil Karekar 09 Apr '03

09 Apr '03

Hi everybody, The April GLUG meet is to be held at HBCSE on 13th april at 04:30 p.m. For directions to reach HBCSE please visit: http://mm.ilug-bom.org.in/pipermail/linuxers/Week-of-Mon-20021104/006987.ht… As far as I know nobody has volunteered to give any tech talks. If you have learned something new ... please come forward to share it with everyone. The other things that can be discussed during the GLUG meet are: 1. The workshop at SAKEC. Lets identify the topics that can be handled at the workshop. lets get volunteers to give lectures. Divide ourselves into teams to prepare slides for each topic that is to be handled during the workshop. This will ensure that the speakers have some breathing space. 2. Discuss how everybody can contribute towards making our GLUG list and site the best. 3. Discuss any new ideas that any of us may have. This is just a tentative list of topics that I could think of. Please add to this list so that we can have a fruitful evening. It would be nice if Trevor could tell everybody about the belgaum and hubli workshops. keep mailing, Kapil Karekar

1 0

upgrading from 2.2.15 to 2.4
by akr!linux-delhi.org＠linux-delhi.org 09 Apr '03

09 Apr '03

thanks to all for the responses. (yes, potato and woody refer to debian releases - and don't have anything to do with kernel versions. thanks for correcting. it's just that i have started mentally identifying 2.4 with woody.) also, upgrading kernel from 2.2 to 2.4 is not like any other upgrade since it crosses the lakhman rekha from filesystem ext2 to ext3 (as supreet pointed out). thus in some ways there's no going back! that's why i wanted specific advice. of course, i could simply install the new system from scratch. but that would be too time consuming, etc etc. that's the last resort anyway. so, my qs again - has anyone actually done the kernel upgrade using apt? someone also suggested downloading the binary image and adding one more entry in lilo.conf. i don't know if that will work though. regds ajit ranade. -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ .

5 7

[Fwd: [DDI-1013] Buffer Overflow in Samba allows remote root compromise]
by Trevor Warren 08 Apr '03

08 Apr '03

-----Forwarded Message----- From: Erik Parker <erik.parker(a)digitaldefense.net> To: bugtraq(a)securityfocus.com Subject: [DDI-1013] Buffer Overflow in Samba allows remote root compromise Date: 07 Apr 2003 07:45:16 +0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 |------------------------------------------------------------------------------| Digital Defense Inc. Security Advisory DDI-1013 labs(a)digitaldefense.net http://www.digitaldefense.net/ |------------------------------------------------------------------------------| Synopsis : Buffer Overflow in Samba allows remote root compromise Package : Samba, Samba-TNG Type : Remote Root Compromise Issue date : 04-07-2003 Versions Affected : < Samba 2.2.8a, <= Samba 2.0.10, < Samba-TNG 0.3.2 Not Affected : Samba 3.0 Alpha Versions, CVS Versions of Samba-TNG CVE Id : CAN-2003-0201 |------------------------------------------------------------------------------| o Product description: Samba is an Open Source/Free Software suite that provides seamless file and print services to SMB/CIFS clients. Samba-TNG was originally a fork off of the Samba source tree, and aims at being a substitute for a Windows NT domain controller. o Problem description: An anonymous user can gain remote root access due to a buffer overflow caused by a StrnCpy() into a char array (fname) using a non-constant length (namelen). StrnCpy(fname,pname,namelen); /* Line 252 of smbd/trans2.c */ In the call_trans2open function in trans2.c, the Samba StrnCpy function copies pname into fname using namelen. The variable namelen is assigned the value of strlen(pname)+1, which causes the overflow. The variable 'fname' is a _typedef_ pstring, which is a char with a size of 1024. If pname is greater than 1024, you can overwrite almost anything you want past the 1024th byte that fits inside of sizeof(pname), or the value returned by SVAL(inbuf,smbd_tpscnt) in function reply_trans2(), which should be around 2000 bytes. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0201 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. o Testing Environment: Tested against source compiles and binary packages of Samba from version 2.2.5 to 2.2.8 on the following x86 platforms: Redhat Linux 7.1, 7.3, 8.0 Gentoo Linux 1.4-rc3 SuSe Linux 7.3 FreeBSD 4.6, 4.8, 5.0 Solaris 9 o Solutions and Workarounds: Upgrading to the latest version of Samba or Samba-TNG is the recommended solution to this vulnerability. Samba version 2.2.8a, and Samba-TNG version 0.3.2 are not vulnerable. There will be no new releases for the 2.0 line of Samba code. The only fix for Samba 2.0 is to apply the patches that Samba is providing. A workaround in the current source code for this specific vulnerability would be to modify the StrnCpy line found at line 250 in smbd/trans2.c in the Samba 2.2.8 source code: -StrnCpy(fname,pname,namelen); +StrnCpy(fname,pname,MIN(namelen, sizeof(fname)-1)); As a result of this vulnerability being identified at least three others have also been found by the Samba team after reviewing similar usages in the source tree. One is a static overflow and the other two are heap overflows. Applying the fix above will only protect against the specific problem identified in this advisory. To fully protect yourself, you must apply the patches from Samba, or upgrade to 2.2.8a. Samba is available for download from: http://www.samba.org/ Samba-TNG is available for download from: http://www.samba-tng.org/ o Exploit: An exploit named trans2root.pl has been posted on the Digital Defense, Inc. website. A quick udp based based scanner named nmbping.pl has also been posted to assist you in identifying Samba servers on your network. Both are available for download from the following URL: http://www.digitaldefense.net/labs/securitytools.html This exploit works against all distributions listed in the testing environment section. Usage is as follows: trans2root.pl <options> -t <target type> -H <your ip> -h <target ip> This exploit should work against all x86 Linux, Solaris, and FreeBSD hosts running the 2.2.x branch of Samba. Hosts with a non-executable stack are not vulnerable to this particular exploit. The exploit will cause the target host to connect back to the host running the exploit and spawn a root shell on the defined port (default is 1981). The scanner is very easy to use, and should detect and identify Samba and Windows SMB services. Usage is as follows: nmbping.pl <network/cidr> o Forced Release: This vulnerability is being actively exploited in the wild. Digital Defense, Inc. discovered this bug by analyzing a packet capture of an attack against a host running Samba 2.2.8. The attack captured was performed on April 1st, 2003. Samba users are urged to check their Samba servers for signs of compromise. Samba and Digital Defense, Inc. decided to release their advisories before all vendors had a chance to update their packages due to this vulnerability being actively exploited. o Revision History: 04-07-2003 Initial public release Latest revision available at: http://www.digitaldefense.net/labs/advisories.html o Vendor Contact Information: 04-03-2003 security(a)samba.org notified 04-03-2003 elrond(a)samba-tng.org notified. 04-03-2003 Samba Team responds via telephone, acknowledges vulnerability 04-03-2003 Elrond of Samba-TNG responds and acknowledges vulnerability 04-04-2003 Samba Team notifies vendorsec mailing list 04-07-2003 Initial public release o Thanks to: Elrond of Samba-TNG, The Samba Security Team, and everyone on the Digital Defense Inc., SECOPS team. -----BEGIN PGP SIGNATURE----- iD8DBQE+kT/5jB+XO4ZKjSARAsJpAJsH05MqOIqauWrK1kKOAkwmCsXorgCeK92r eDEmOgRY4z7Y0b7HecHyf+A= =Af+n -----END PGP SIGNATURE-----

4 3

[OT] Debian (unstable) CDs
by Abhir Joshi 08 Apr '03

08 Apr '03

Does anyone living in Mumbai have recent Debian (unstable) distro on CD? If yes, and willing to share, I would like to have the CDs for one day. Please reply to this off the mailing list. -- Abhir Joshi http://education.vsnl.com/abhir/

2 1

Problem with Fonts using gtk
by Rajen M. Parekh 08 Apr '03

08 Apr '03

Hi all, I an using Red Hat Linux 8.0. I have installed True Type Fonts (http://corefonts.sourceforge.net). The fonts work perfectly fine with all applications (Mozilla, Open Office, KDE applications, etc., but application based on gtk+ don't use these fonts. For example, Abiword. While using Abiword, the fonts list doesn't show the true type fonts that I have installed. Same with applications like Gedit, Gnumeric, Nautilus, etc. I can't figure out the problem. I tried deleting old cache files, old configuration files, of these applications, including .gnome, .gtkrc, etc. I also tried rebooting, but somehow these applications refuse to show these fonts. Any clues, pointers? Regards, Rajen. -- Open WebMail Project (http://openwebmail.org)

2 1

Re: [ILUG-BOM] Issues with Linksys wireless LAN card
by Nikhil D. Kikkeri 08 Apr '03

08 Apr '03

hi again-- well i dont know what the problem was, but i plugged in the card again to see if it works and all i can say is tht THE FREAKIN CARD WORKS!!! its cool to have wireless LAN access on Linux. And I dont see why it wouldnt have worked, after all my Linksys card is based on a Prism2 chipset which has been supported by Linux. regds -NDK _________________________________________________________________ Catch the Oscar fever. See winners & losers. http://server1.msn.co.in/MSNSpecials/oscar2003/index.asp Right here

3 2

← Newer
1
...
9
10
11
12
13
14
15
16
17
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Linuxers April 2003