- cypherpunks-legacy - lists.cpunks.org

[Mac_crypto] "Security Update 2002-08-02 for OpenSSL, Sun RPC,
by Fearghas McKay 06 Jul '18

06 Jul '18

mod_ssl" does not verify Sender: mac_crypto-admin(a)vmeng.com Date: Sat, 3 Aug 2002 08:38:50 +0100 **A verification of this security announcement mail fails** The key is signed by Vinnie Moscaritolo - vinnie(a)vmeng.com which is a good thing even if Vinnie is no longer at Apple ( which is a bad thing ), it is also signed by someone who does not appear on any of the public keyservers that I can find which is a bit disappointing. Verified version is at the bottom. f --- begin forwarded text

1 0

Security Update 2002-08-02 for OpenSSL, Sun RPC, mod_ssl
by Product Security 06 Jul '18

06 Jul '18

<security-announce.lists.apple.com> List-Post: <mailto:security-announce@lists.apple.com> List-Help: <mailto:security-announce-request@lists.apple.com?subject=help> List-Subscribe: <http://www.lists.apple.com/mailman/listinfo/security-announce>, <mailto:security-announce-request@lists.apple.com?subject=subscribe> List-Archive: <http://www.lists.apple.com/archives/security-announce/> Date: Fri, 2 Aug 2002 15:45:34 -0700 -----BEGIN PGP SIGNED MESSAGE----- Security Update 2002-08-02 is now available. It contains fixes for recent vulnerabilities in: OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in the mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 Affected systems: Mac OS X client and Mac OS X Server Note: Mac OS X client is configured by default to have these services turned off, and is only vulnerable if the user has enabled network services which rely on the affected components. It is still recommended for Mac OS X client users to apply this security update to their system. System requirements: Mac OS X 10.1.5 Security Update 2002-08-02 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://docs.info.apple.com/article.html?artnum=120139 SSL server: https://depot.info.apple.com/security/129403bc5e184e3b7367.html To help verify the integrity of Security Update 2002-08-02 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-02.dmg Its SHA-1 digest is: 54f6eebe0398181db8f1129403bc5e184e3b7367 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPUsLOiFlYNdE6F9oAQGAigf+JV+lazuko1g4oZSNFTd2puXCtOGQ0M8c 2cZ/BdaEBA8jLGrPkhWuvmMwpN9z6G9chnN8s9EXiavcBG5e/ejtTo3ZHoOGP7bg 789zLQLK2JTB75nc0fNyx2CdfHlEIM00v8c2jXySLlnqF+kzwqVnjUL7i2O97Fk5 tWXLc2dWK2Nf2SUk0/yLgfjceZKEPCPXTpuKYuah/w9NwzL+LsbPcfXA/H1f4ngc vRPc2sn2HYu9IJw/BrMEsDlS8IWHf6ozXdZ9qaVCVRrZlsd9gSSmB2Jba4be/MRX FauTTepMF9+JfCkx+2wtpwWhBcXoJnjwIZXOXwbbRjqXHmzzgu8D/Q== =fdGO -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. --- end forwarded text Verified version with verification failure ---

1 0

Security Update 2002-08-02 for OpenSSL, Sun RPC, mod_ssl
by Product Security 06 Jul '18

06 Jul '18

<security-announce.lists.apple.com> List-Post: <mailto:security-announce@lists.apple.com> List-Help: <mailto:security-announce-request@lists.apple.com?subject=help> List-Subscribe: <http://www.lists.apple.com/mailman/listinfo/security-announce>, <mailto:security-announce-request@lists.apple.com?subject=subscribe> List-Archive: <http://www.lists.apple.com/archives/security-announce/> Date: Fri, 2 Aug 2002 15:45:34 -0700 *** PGP SIGNATURE VERIFICATION *** *** Status: Bad Signature *** Alert: Signature did not verify. Message has been altered. *** Signer: Apple Product Security <product-security(a)apple.com> (0x44E85F68) *** Signed: 08/02/2002 11:44:10 PM *** Verified: 08/03/2002 08:34:01 AM *** BEGIN PGP VERIFIED MESSAGE *** Security Update 2002-08-02 is now available. It contains fixes for recent vulnerabilities in: OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in the mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 Affected systems: Mac OS X client and Mac OS X Server Note: Mac OS X client is configured by default to have these services turned off, and is only vulnerable if the user has enabled network services which rely on the affected components. It is still recommended for Mac OS X client users to apply this security update to their system. System requirements: Mac OS X 10.1.5 Security Update 2002-08-02 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://docs.info.apple.com/article.html?artnum=120139 SSL server: https://depot.info.apple.com/security/129403bc5e184e3b7367.html To help verify the integrity of Security Update 2002-08-02 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-02.dmg Its SHA-1 digest is: 54f6eebe0398181db8f1129403bc5e184e3b7367 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html *** END PGP VERIFIED MESSAGE *** _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. --- _______________________________________________ mac_crypto mailing list mac_crypto(a)vmeng.com http://www.vmeng.com/mailman/listinfo/mac_crypto --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Tom 06 Jul '18

06 Jul '18

>"Roy M. Silvernail" wrote: >> >> A quote from http://www.thestandard.com/article/display/0,1151,20985,00.html: >> >> " Criminal organizations appear to be using the proceeds of >> IP-infringing products to facilitate a variety of enterprises, >> including guns, drugs, pornography and even terrorism. Invariably, >> when there is intellectual property crime, there is tax evasion and >> money laundering." >> >> Note that last sentence. > >she forgot to mention child abuse. Merely not mentioned in the Standard article. See: http://www.whitehouse.gov/WH/EOP/NSC/html/documents/pub45270/pub45270chap1.h tml#4

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 11:17 AM -0800 11/23/2000, Lynn.Wheeler(a)firstdata.com wrote: >Basically cetificates are an implementation of R/O partial replicated >distributed data that were intended to address availability of >information in a >predominately offline environment. > >In the SSL server certificates, distribution of CRLs tend to create a problem >for consumers because they aren't likely to want to see >99.99999999999999999999% >of the CRLs distributed and/or they aren't online at the time the CRLs are >distributed (and/or if done via email would create a horrible spam issue ... >every possible consumer in the world receiving email CRLs from every >possile SSL >server certificate issuing CA). Sounds like a job for Usenet. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

[Mac_crypto] "Security Update 2002-08-02 for OpenSSL, Sun RPC,
by Fearghas McKay 06 Jul '18

06 Jul '18

mod_ssl" does not verify Sender: mac_crypto-admin(a)vmeng.com Date: Sat, 3 Aug 2002 08:38:50 +0100 **A verification of this security announcement mail fails** The key is signed by Vinnie Moscaritolo - vinnie(a)vmeng.com which is a good thing even if Vinnie is no longer at Apple ( which is a bad thing ), it is also signed by someone who does not appear on any of the public keyservers that I can find which is a bit disappointing. Verified version is at the bottom. f --- begin forwarded text

1 0

Security Update 2002-08-02 for OpenSSL, Sun RPC, mod_ssl
by Product Security 06 Jul '18

06 Jul '18

<security-announce.lists.apple.com> List-Post: <mailto:security-announce@lists.apple.com> List-Help: <mailto:security-announce-request@lists.apple.com?subject=help> List-Subscribe: <http://www.lists.apple.com/mailman/listinfo/security-announce>, <mailto:security-announce-request@lists.apple.com?subject=subscribe> List-Archive: <http://www.lists.apple.com/archives/security-announce/> Date: Fri, 2 Aug 2002 15:45:34 -0700 -----BEGIN PGP SIGNED MESSAGE----- Security Update 2002-08-02 is now available. It contains fixes for recent vulnerabilities in: OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in the mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 Affected systems: Mac OS X client and Mac OS X Server Note: Mac OS X client is configured by default to have these services turned off, and is only vulnerable if the user has enabled network services which rely on the affected components. It is still recommended for Mac OS X client users to apply this security update to their system. System requirements: Mac OS X 10.1.5 Security Update 2002-08-02 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://docs.info.apple.com/article.html?artnum=120139 SSL server: https://depot.info.apple.com/security/129403bc5e184e3b7367.html To help verify the integrity of Security Update 2002-08-02 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-02.dmg Its SHA-1 digest is: 54f6eebe0398181db8f1129403bc5e184e3b7367 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPUsLOiFlYNdE6F9oAQGAigf+JV+lazuko1g4oZSNFTd2puXCtOGQ0M8c 2cZ/BdaEBA8jLGrPkhWuvmMwpN9z6G9chnN8s9EXiavcBG5e/ejtTo3ZHoOGP7bg 789zLQLK2JTB75nc0fNyx2CdfHlEIM00v8c2jXySLlnqF+kzwqVnjUL7i2O97Fk5 tWXLc2dWK2Nf2SUk0/yLgfjceZKEPCPXTpuKYuah/w9NwzL+LsbPcfXA/H1f4ngc vRPc2sn2HYu9IJw/BrMEsDlS8IWHf6ozXdZ9qaVCVRrZlsd9gSSmB2Jba4be/MRX FauTTepMF9+JfCkx+2wtpwWhBcXoJnjwIZXOXwbbRjqXHmzzgu8D/Q== =fdGO -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. --- end forwarded text Verified version with verification failure ---

1 0

Security Update 2002-08-02 for OpenSSL, Sun RPC, mod_ssl
by Product Security 06 Jul '18

06 Jul '18

<security-announce.lists.apple.com> List-Post: <mailto:security-announce@lists.apple.com> List-Help: <mailto:security-announce-request@lists.apple.com?subject=help> List-Subscribe: <http://www.lists.apple.com/mailman/listinfo/security-announce>, <mailto:security-announce-request@lists.apple.com?subject=subscribe> List-Archive: <http://www.lists.apple.com/archives/security-announce/> Date: Fri, 2 Aug 2002 15:45:34 -0700 *** PGP SIGNATURE VERIFICATION *** *** Status: Bad Signature *** Alert: Signature did not verify. Message has been altered. *** Signer: Apple Product Security <product-security(a)apple.com> (0x44E85F68) *** Signed: 08/02/2002 11:44:10 PM *** Verified: 08/03/2002 08:34:01 AM *** BEGIN PGP VERIFIED MESSAGE *** Security Update 2002-08-02 is now available. It contains fixes for recent vulnerabilities in: OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in the mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 Affected systems: Mac OS X client and Mac OS X Server Note: Mac OS X client is configured by default to have these services turned off, and is only vulnerable if the user has enabled network services which rely on the affected components. It is still recommended for Mac OS X client users to apply this security update to their system. System requirements: Mac OS X 10.1.5 Security Update 2002-08-02 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://docs.info.apple.com/article.html?artnum=120139 SSL server: https://depot.info.apple.com/security/129403bc5e184e3b7367.html To help verify the integrity of Security Update 2002-08-02 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-02.dmg Its SHA-1 digest is: 54f6eebe0398181db8f1129403bc5e184e3b7367 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html *** END PGP VERIFIED MESSAGE *** _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. --- _______________________________________________ mac_crypto mailing list mac_crypto(a)vmeng.com http://www.vmeng.com/mailman/listinfo/mac_crypto --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Tom 06 Jul '18

06 Jul '18

>"Roy M. Silvernail" wrote: >> >> A quote from http://www.thestandard.com/article/display/0,1151,20985,00.html: >> >> " Criminal organizations appear to be using the proceeds of >> IP-infringing products to facilitate a variety of enterprises, >> including guns, drugs, pornography and even terrorism. Invariably, >> when there is intellectual property crime, there is tax evasion and >> money laundering." >> >> Note that last sentence. > >she forgot to mention child abuse. Merely not mentioned in the Standard article. See: http://www.whitehouse.gov/WH/EOP/NSC/html/documents/pub45270/pub45270chap1.h tml#4

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 11:17 AM -0800 11/23/2000, Lynn.Wheeler(a)firstdata.com wrote: >Basically cetificates are an implementation of R/O partial replicated >distributed data that were intended to address availability of >information in a >predominately offline environment. > >In the SSL server certificates, distribution of CRLs tend to create a problem >for consumers because they aren't likely to want to see >99.99999999999999999999% >of the CRLs distributed and/or they aren't online at the time the CRLs are >distributed (and/or if done via email would create a horrible spam issue ... >every possible consumer in the world receiving email CRLs from every >possile SSL >server certificate issuing CA). Sounds like a job for Usenet. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0