July 2018 - cypherpunks-legacy

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0

Re: [cryptography] bitcoin scalability to high transaction rates
by James A. Donald 06 Jul '18

06 Jul '18

On 2011-06-17 4:35 AM, Sampo Syreeni wrote: > Since I've been forced to take yet another look into BitCoin and > algorithmic (high frequency) trading within a short timespan, I began to > wonder how they would work together. What precisely would happen to > BitCoin if we had tens to tens of thousands of high frequency traders > (thousands of transactions per second per trader) within the network? The obvious next step is to have chaumian money and account money which has rapid low cost transactions, which money is converted into bitcoins at leisure, analogous to having gold, and account money and banknotes backed by gold. We should have accounts backed by bitcoins, and banknotes (chaumian money) backed by bitcoins. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] [OT] Reworked Version of Stuxnet Relative Duqu Found in Iran
by Marsh Ray 06 Jul '18

06 Jul '18

On 03/28/2012 10:39 PM, Jeffrey Walton wrote: > Hi Guys, > > From "Reworked Version of Stuxnet Relative Duqu Found in Iran," > http://www.securitynewsdaily.com/1642-stuxnet-duqu-iran.html: > > Duqu's builders also changed its encryption algorithm and > rigged the malware loader to pose as a Microsoft driver. > (The old driver was signed with a stolen Microsoft certificate.) I hadn't heard about a driver signed with a "stolen Microsoft certificate. I suspect it's imperfect reporting. That article links to http://www.symantec.com/connect/blogs/new-duqu-sample-found-wild Which says: "Another difference is the old driver file was signed with a stolen certificateband this one is not." > Is the stolen certificate related to Diginotar or some other incident? > Microsoft claims Diginotar issued certificates are inert > (http://www.computerworld.com/s/article/9219729/Microsoft_Stolen_SSL_certs_c…) Right. The legitimate Windows Update system application won't recognize certs from random CAs like DigiNotar. (Code signing PKI appears good enough for everyone except the vendors themselves.) But it might be possible to silently pwn MSIE users who checked the box "Always trust ActiveX controls from microsoft.com" and the sky's the limit on how you might use something like that for social engineering. > Perhaps "Stolen encryption key the source of compromised certificate > problem, Symantec says," > http://computerworld.co.nz/news.nsf/security/stolen-encryption-key-the-sour… Anyone can sign up to get a code signing cert for basic driver signing, there is no test of purity of heart involved. Probably the only reason the bad guys used a stolen one is that it was easier to steal or buy a private key than to set up a temporary identity and pay a few hundred bucks for an official one. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by None 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: Key validity bug in GnuPG 1.2.1 and earlier Advisory number: CSSA-2003-034.0 Issue date: 2003 November 17 Cross reference: sr883602 fz528211 erg712405 CAN-2003-0255 ______________________________________________________________________________ 1. Problem Description As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. CAN-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org) which standardizes names for security problems. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to gnupg-1.2.2-1.i386.rpm OpenLinux 3.1.1 Workstation prior to gnupg-1.2.2-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/RPMS 4.2 Packages d6da27be5c407641dc29f753d96e41fc gnupg-1.2.2-1.i386.rpm 4.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-034.0/SRPMS 4.5 Source Packages b1ab55790186abd7997af751b3032721 gnupg-1.2.2-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/R… 5.2 Packages 5469dcefe0be50d4d99d4b925a58d453 gnupg-1.2.2-1.i386.rpm 5.3 Installation rpm -Fvh gnupg-1.2.2-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-034.0/S… 5.5 Source Packages be6338d319f84f139e8363f64bc6673a gnupg-1.2.2-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883602 fz528211 erg712405. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank The GnuPG Team (David, Stefan, Timo and Werner) ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+5JjYACgkQbluZssSXDTGX9gCg++EK6pUrwQRfZl54wqUCinB8 itcAniMWmXByl7LyjfSP4chsEK2RcfXa =nik3 -----END PGP SIGNATURE-----

1 0