• info
• discussion
• exploit
• solution
• references

SuSE YaST Online Update Script Signature Verification Bypass Vulnerability

Solution:
Please see the referenced vendor advisories for details on obtaining and applying fixes.


S.u.S.E. Linux Professional 10.0

• SuSE liby2util-2.12.9-0.4.i586.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/liby2util-2.12.9 -0.4.i586.rpm


• SuSE liby2util-2.12.9-0.4.ppc.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/liby2util-2.12.9- 0.4.ppc.rpm


• SuSE liby2util-2.12.9-0.4.x86_64.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/liby2util-2.12 .9-0.4.x86_64.rpm


• SuSE liby2util-devel-2.12.9-0.4.i586.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/liby2util-devel- 2.12.9-0.4.i586.rpm


• SuSE liby2util-devel-2.12.9-0.4.ppc.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/liby2util-devel-2 .12.9-0.4.ppc.rpm


• SuSE liby2util-devel-2.12.9-0.4.x86_64.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/liby2util-deve l-2.12.9-0.4.x86_64.rpm

S.u.S.E. Linux Professional 9.1

• SuSE gpg-1.2.4-68.10.i586.rpm
  SUSE LINUX 9.1:
  ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gpg-1.2.4-68.10.i 586.rpm


• SuSE gpg-1.2.4-68.10.x86_64.rpm
  SUSE LINUX 9.1:
  ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gpg-1.2.4-68. 10.x86_64.rpm


• SuSE liby2util-2.9.27-0.7.i586.rpm
  SUSE LINUX 9.1:
  ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/liby2util-2.9.27- 0.7.i586.rpm


• SuSE liby2util-2.9.27-0.7.x86_64.rpm
  SUSE LINUX 9.1:
  ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/liby2util-2.9 .27-0.7.x86_64.rpm


• SuSE liby2util-devel-2.9.27-0.7.i586.rpm
  SUSE LINUX 9.1:
  ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/liby2util-devel-2 .9.27-0.7.i586.rpm


• SuSE liby2util-devel-2.9.27-0.7.x86_64.rpm
  SUSE LINUX 9.1:
  ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/liby2util-dev el-2.9.27-0.7.x86_64.rpm

S.u.S.E. Linux Professional 9.2

• SuSE gpg-1.2.5-3.4.i586.rpm
  SUSE LINUX 9.2:
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gpg-1.2.5-3.4.i58 6.rpm


• SuSE gpg-1.2.5-3.4.x86_64.rpm
  SUSE LINUX 9.2:
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/gpg-1.2.5-3.4.x 86_64.rpm


• SuSE liby2util-2.10.7-0.3.i586.rpm
  SUSE LINUX 9.2:
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/liby2util-2.10.7- 0.3.i586.rpm


• SuSE liby2util-2.10.7-0.3.x86_64.rpm
  SUSE LINUX 9.2:
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/liby2util-2.10. 7-0.3.x86_64.rpm


• SuSE liby2util-devel-2.10.7-0.3.i586.rpm
  SUSE LINUX 9.2:
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/liby2util-devel-2 .10.7-0.3.i586.rpm


• SuSE liby2util-devel-2.10.7-0.3.x86_64.rpm
  SUSE LINUX 9.2:
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/liby2util-devel -2.10.7-0.3.x86_64.rpm

S.u.S.E. Linux Professional 9.3

• SuSE liby2util-2.11.7-0.3.i586.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/liby2util-2.11.7- 0.3.i586.rpm


• SuSE liby2util-2.11.7-0.3.x86_64.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/liby2util-2.11. 7-0.3.x86_64.rpm


• SuSE liby2util-devel-2.11.7-0.3.i586.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/liby2util-devel-2 .11.7-0.3.i586.rpm


• SuSE liby2util-devel-2.11.7-0.3.x86_64.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/liby2util-devel -2.11.7-0.3.x86_64.rpm