Puppy Linux Discussion Forum Forum Index Puppy Linux Discussion Forum
Puppy HOME page : puppylinux.com
"THE" alternative forum : puppylinux.info
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

The time now is Thu 24 Jul 2014, 23:46
All times are UTC - 4
 Forum index » Off-Topic Area » Security
How to patch libgnutls26?
Post_new_topic   Reply_to_topic View_previous_topic :: View_next_topic
Page 1 of 1 Posts_count  
Author Message
Graf_Koks

Joined: 21 Jan 2014
Posts: 20

PostPosted: Thu 06 Mar 2014, 02:39    Post_subject:  How to patch libgnutls26?
Sub_title: Ubuntu fraudulent security certificates patch
 

Hi,

Anyone any idea how to patch libgnutls26 using the following source:

http://www.ubuntu.com/usn/usn-2127-1/

Regards,
GK
http://www.zeit.de/digital/datenschutz/2014-03/gnutls-linux-sicherheitsluecke
Back to top
View user's profile Send_private_message 
Semme

Joined: 07 Aug 2011
Posts: 3543
Location: World_Hub

PostPosted: Thu 06 Mar 2014, 21:00    Post_subject:  

As Mick's the dev, we'll limit any confusion to a single response.
Edited_time_total
Back to top
View user's profile Send_private_message 
01micko


Joined: 11 Oct 2008
Posts: 7782
Location: qld

PostPosted: Thu 06 Mar 2014, 22:30    Post_subject:  

In slacko the update manager *should* work. But the version is patched from upstream so shows as the same version but a different build number.

To get the patched version:

1. Run updates manager form setup menu
2. go tp PPM and use the configuration utility to enable the Patches repo
3. Restart PPM
4, In the search box type gnutls
5. select the version from Patches repo and install
6. Restart your computer

_________________
Woof Mailing List | keep the faith Cool |
Back to top
View user's profile Send_private_message Visit_website 
Terryphi


Joined: 02 Jul 2008
Posts: 759
Location: West Wales, Britain.

PostPosted: Sat 08 Mar 2014, 03:15    Post_subject:  

Has anyone tried to patch Racy/Wary?

LATER: Racy and Wary do not include gnutls so no fix required. Smile

_________________
Classic Opera 12.16 browser SFS package for Precise, Slacko, Racy, Wary, Lucid, Quirky, etc available here Smile
Back to top
View user's profile Send_private_message Visit_website 
Karl Godt


Joined: 20 Jun 2010
Posts: 3953
Location: Kiel,Germany

PostPosted: Sat 08 Mar 2014, 14:32    Post_subject:  

Quote:
If a remote attacker were able to
perform a man-in-the-middle attack,
this flaw could be exploited with
specially crafted certificates to view sensitive information.


So it affects mainly WIFI wireless connections to a router .?

The Zeit newspaper article mentiones only two lines .
But might be more .
I don't know if programs would need to be recompiled that use gnuTLS shared libraries .
Static compiles at least would need .
Back to top
View user's profile Send_private_message Visit_website 
Graf_Koks

Joined: 21 Jan 2014
Posts: 20

PostPosted: Sun 23 Mar 2014, 06:04    Post_subject: Seems to be patched  

So what I did two weeks ago was downloading

https://launchpad.net/ubuntu/+archive/primary/+files/libgnutls26-dbg_2.12.14-5ubuntu3.7_i386.deb

from

https://launchpad.net/ubuntu/+source/gnutls26

(click the triangle at "The Precise Pangolin" -> "2.12.14-5ubuntu3.7 updates, security (main)" and select the correct OS)

Then I extracted the deb-file and copied the libraries by hand to the corresponding locations.

The old file libgnutls.so.26.21.8 was of size 79xxxx byte (cannot remember, and are using another OS in the moment), the new file is of size 801644 byte so the two files differ at last.

Due to a reinstallation of puppy precise, I realized that reinstalling libgnutls using the package manager, i.e. simply clicking on the libgnutls item in ppm even though it is already installed, resulted in the same libgnutls.so.26.21.8 801644 byte file (I did no diff). So it seems the patched version is already in the repositories.

Regards,
GK
Back to top
View user's profile Send_private_message 
Display_posts:   Sort by:   
Page 1 of 1 Posts_count  
Post_new_topic   Reply_to_topic View_previous_topic :: View_next_topic
 Forum index » Off-Topic Area » Security
Jump to:  

Rules_post_cannot
Rules_reply_cannot
Rules_edit_cannot
Rules_delete_cannot
Rules_vote_cannot
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
[ Time: 0.0521s ][ Queries: 11 (0.0051s) ][ GZIP on ]