[15944] in bugtraq
Re: Package xzx-2.9.2-2.i386.rpm spies - SuSE Linux 6.4
daemon@ATHENA.MIT.EDU (Roman Drahtmueller)
Mon Jul 24 22:36:32 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=ISO-8859-1
Content-Transfer-Encoding: 8BIT
Message-Id: <Pine.LNX.4.21.0007242014440.11899-100000@dent.suse.de>
Date: Mon, 24 Jul 2000 20:23:20 +0200
Reply-To: Roman Drahtmueller <draht@SUSE.DE>
From: Roman Drahtmueller <draht@SUSE.DE>
X-To: "Gunadi, Prana" <pranalukas@GMX.DE>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <29303.964416516@www26.gmx.net>
> System affected:
> =====================
> SuSE Linux 6.4
Not at all. The SuSE xzx package on SuSE-6.4 or other versions don't
contain the said postinstall script. See below.
> Homepage:
> http://www.suse.de/en/produkte/susesoft/linux/Pakete/paket_xzx.html
>
> Package name:
> =====================
> xzx-2.9.2-2.i386.rpm
> XZX is a portable emulator of ZX Spectrum 48K/128K/+3
>
> Problem:
> =====================
> This program tries to send an unauthorized e-mail during its RPM
> installation (PRIVACY problem) to <install@fantasy.muc.de>
The script from Prana's mail belongs to the rpm package that is supplied
by the author and is available at http://www.philosys.de/~kunze/xzx/?dl .
There is not the slightest connection between the package on the
distribution and the one on (Erik Kunze <Erik.Kunze@fantasy.muc.de>)'s
website. If there are any reproaches then direct them to the author. I
must confirm that this script isn't state of the art in terms of good
manners.
"PROOF:"
Download the rpm and verify the postinstall script using
rpm -qp --scripts xzx-2.9.2-2.i386.rpm
Compare this with the postinstall script in the SuSE package.
By consequence, the "Solution" suggestion below is exactly the contrary to
what would be advisable.
*
First off, it would have been good style to contact SuSE security under
security@suse.de _prior_ to spread such information. This didn't happen,
and possible damage could have been avoided.
Secondly, reputation is very fragile in this business. This is also the
case for private persons who don't use half-anonymous freemail providers
to voice themselves. Please be fair with your statements and double-check
each word. A statement is difficult to retract as soon as it's written and
published.
Thanks,
Roman Drahtm|ller,
SuSE Security.
--
- -
| Roman Drahtm|ller <draht@suse.de> "Caution: Cape does not |
SuSE GmbH - Security enable user to fly."
| N|rnberg, Germany (Batman Costume warning label) |
- -
>
> PROOF:
> =====================
> - From the file /usr/src/RPM/SPECS/xzx.spec (the post installation entry)
>
> == xzx.spec (some snipped) ==
> %post
> set +x
> sm=`type sendmail`
> if [ $? -eq 0 ]
> then
> set ${sm}
> SENDMAIL=$3
> else
> SENDMAIL=/usr/sbin/sendmail
> fi
> if [ -x ${SENDMAIL} ]
> then
> ${SENDMAIL} install@fantasy.muc.de 2>/dev/null <<- _EOF_
> Subject: install notification
>
> Version: %{Name}-%{Version}
> Date : `date`
> User : `whoami`
> Host : `hostname`
> OS : `uname -a`
> _EOF_
> fi
>
> === xzx.spec (some snipped) ===
>
> Solution:
> Compile from its source instead of installing its RPM package
>
> - --
> Prana <pranalukas@gmx.de>
> http://cyest.hypermart.net
> My GnuPG Key ID: 0x33343FD3 (2000-07-21)
> Key fingerprint = F1FB 1F76 8866 0F40 A801 D9DA 6BED 6641 3334 3FD3
> http://blackhole.pca.dfn.de:11371/pks/lookup?op=get&search=0x33343FD3
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.2 (GNU/Linux)
> Comment: Made with Geheimnis
>
> iD8DBQE5e9W2a+1mQTM0P9MRAg3qAJ99Zf18fY9LYscIPfEFPfqfQFxOAgCeNcdZ
> XxzcWlviLUn0mESoz9IWi+s=
> =J9RT
> -----END PGP SIGNATURE-----
>
> --
> Sent through GMX FreeMail - http://www.gmx.net
>
Gru_,
Roman Drahtm|ller.
--
- -
| Roman Drahtm|ller <draht@suse.de> "Caution: Cape does not |
SuSE GmbH - Security enable user to fly."
| N|rnberg, Germany (Batman Costume warning label) |
- -
