It has been pointed out that there is another bug in the signature
verification code of GnuPG.
* This can easily lead to false positives *
All versions of GnuPG released before today are vulnerable!
To check a detached singature you normally do this:
gpg --verify foo.sig foo.txt
The problem here is that someone may replace foo.sig with a standard
signature containing some arbitrary signed text and its signature,
and then modify foo.txt - GnuPG does not detect this - Ooops.
The solution for this problem ist not easy and needs a change in the
semantics of the --verify command: It will not any longer be
possible to do this:
gpg --verify foo.sig <foo.txt
Instead you have to use this
gpg --verify foo.sig - <foo.txt
The difference here is that gpg sees 2 files on the command lines
and thereby knows that it should check a detached signature. We
really need this information and there is no way to avoid that
change, sorry. You should make sure that you never use the first
form, because this will lead to false positives when foo.sig is not
a detached signature - gnupg does detect the other case and warns
you, but this is not sufficient. If you use GnuPG from other
applications, please change it.
ok markus@
it's so seldom used now).
Remove a few targets that are not really needed (mirror-distfiles, use
mirror-maker instead).
More changes to fake to come, once they've been properly tested.
"Nano 0.9.24 is released. This versions contains the last of the
security fixes for writing files, as well as for a nasty segfault
when nano is unable to open a file for reading, among other fixes.
Nano also now cowardly refuses to open device files, to stop silly
things like trying to open /dev/zero. New features include being
able to use Meta-Meta-<key> as Control-<key>, and some new flags
have been added for Pico compatibility."
Version 3.9, 2000.12.13:
* Updated temporary key generation:
- stunnel is now honoring requested key-lengths correctly,
- temporary key is changed every hour.
* transfer() no longer hangs on some platforms.
Special thanks to Peter Wagemans for the patch.
* Potential security problem with syslog() call fixed.
2000-12-18 13:25 knu
* TODO.knu, cvsweb.cgi: Revert MFZ: 1.103 -> 1.104 which introduced
a bogus bug. As noone seems to need to use 0.X revisions, I'd just
drop it. This should fix the "show only tags" feature.
2000-12-18 12:47 knu
* cvsweb.cgi: Silence the warnings.
2000-12-18 11:48 knu
* cvsweb.cgi: Add meta tags to prevent WWW robots from crawling
over the cvsweb.
Extract from RELEASE_NOTES:
===========================
Major changes with snapshot-20001217
====================================
This release involves little change in functionality and a lot of
small changes to lots of files. The code is put out as a separate
snapshot release so that I have a tested baseline for further work.
All time-related configuration parameters now accept a one-letter
suffix to indicate the time unit (s: second, m: minute, h: hour,
d: day, w: week). The exceptions are the LDAP and MYSQL modules
which are maintained separately.
The mysql client was partially rewritten in order to elimimate some
memory allocation/deallocation problems. The code needs more work,
and needs to be tested in a real production environment.
The local_transport and default_transport configuration parameters
can now be specified in transport:destination notation, just like
the mailbox_transport and fallback_transport parameters. The
:destination part is optional. However, these parameters take only
one destination, unlike relayhost and fallback-relay which take
any number of destinations.
`Proof of concept', port doesn't really work yet.
- kpresenter crashes,
- all parts only run under koshell control,
- closing any document will crash koffice.
Apart from that, this looks usable.
