Red Hat Enterprise Linux: Updated ovirt-hosted-engine-setup packages that fix several bugs and add various
enhancements are now available.
Monthly Archives: February 2015
RHBA-2015:0159-1: vdsm 3.5.0 – bug fix and enhancement update
Red Hat Enterprise Linux: Updated vdsm packages that fix several bugs and add various enhancements are now
available.
RHBA-2015:0168-1: Red Hat Storage Console 3.0 bug fix async update
Red Hat Enterprise Linux: Updated Red Hat Storage Console packages are now available for use with Red
Hat Storage Server 3.
RHBA-2015:0167-1: Red Hat Storage 3.0 bug fix async update
Red Hat Enterprise Linux: Updated glusterfs packages that fix a bug are now available for Red Hat Storage
3.
Shakacon 2015 Last Call for Papers (July 6-9 2015, Honolulu, Hawaii)
Posted by Jonathan Brossard on Feb 12
—-++++++++++++++++++++++++++++++++++++—-
Shakacon VII – Honolulu, Hawaii
“Sun, Surf, and C Shells”
CALL FOR PAPERS
www.shakacon.org/CFP2015.html
—-++++++++++++++++++++++++++++++++++++—-
Who: Shakacon Crew
What: Shakacon VII
When: July 6-7 (Training) & July 8-9 (Conference) 2015
Where: Honolulu, HI – Hawaii Prince Hotel Waikiki
Why: World Class Speakers,…
5 Tips for becoming a hacker
In the twenty-first century many professions have become virtual. Programmers, designers, Web analysts and community managers are just some of the new professions created by the Internet.
However, there is one that without it this new Internet ecosystem could not survive, although sometimes you might not think so: The hacker who works to detect security flaws and fixes them. They are the guardians of the Internet and for that reason they are well paid for their work.
What do you have to do to become a good hacker? American Eric S. Raymond, who describes himself as “an open source evangelist” and maintains the Jargon File, a dictionary of hacker culture terms, includes a detailed document on his website that offers some practical tips on how to become a good computer security expert, in response to the barrage of questions he has received about the topic in recent years.
If you think that this could be your ideal job, we summarize some of the tips of this open source guru.
5 Tips for becoming a hacker
- Hackers build, not destroy (although many people are not clear on that). If you want to be a hacker, the first thing is to be motivated. Raymond says that it is a fun profession but it takes a lot of effort and learning capacity. Intelligence, practice, dedication, and hard work are just some of the requirements. You have to approach this work as intense play rather than drudgery. This security expert upholds that no problem should ever have to be solved twice; you must always tackle new challenges.
- Learn how to program. Developers have to be multilingual and learn all of the latest programming languages. Hackers have to do the same. One of the languages that Raymond recommends learning (and that many companies are currently demanding) is Python. An open source programming language that its creator, Guido van Rossum, started working on in the late 1980s. Java, C++, Ruby and Django are other languages that you should get to know. Raymond has left some instructions on his website, but he warns that they are not easy.

- Knowledge of Unix. You have to get past Windows and learn to manage operating systems like Unix or Linux (based on the former). Both are essential in the Internet era and any programmer worth their salt must know them.
- Learn how to use the World Wide Web and write HTML. It is vital to know by heart all of the secrets of HTML code. HTML tags, enclosed in ‘greater than’ and ‘less than’ symbols are the vocabulary of the Internet and of programmers. Version five of the standard, HTML 5, published definitively last year, is the latest.
- Earn status in the hacker culture. It is essential to speak English in order to take part in the hacker community; a language that is very specific for the most technical terminology. Then, do not simply copy the knowledge of others, take part in the community; write open-source software, help test and debug it, share your knowledge with others or do something for the hacker culture are just a few of his tips.

“Hackers (and creative people in general) should never be bored or have to drudge at stupid repetitive work, because when this happens it means they aren’t doing what only they can do — solve new problems,” says Raymond.
A hacker must have many skills but this computer security expert shows us that, with all of the opportunities offered by the Internet to learn how it works and the motivation to do something different every day, you can become a good hacker.
Raymond adds that reading science fiction, studying the Zen philosophy, doing martial arts and developing your appreciation of wordplay could be complementary activities. We will leave that for you to choose.
If you have been bitten by the bug, just visit his website, which some kind souls have translated into various languages.
The post 5 Tips for becoming a hacker appeared first on MediaCenter Panda Security.
USN-2499-1: PostgreSQL vulnerabilities
Ubuntu Security Notice USN-2499-1
11th February, 2015
postgresql-8.4, postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary
Several security issues were fixed in PostgreSQL.
Software description
- postgresql-8.4
– Object-relational SQL database - postgresql-9.1
– Object-relational SQL database - postgresql-9.3
– Object-relational SQL database - postgresql-9.4
– Object-relational SQL database
Details
Stephen Frost discovered that PostgreSQL incorrectly displayed certain
values in error messages. An authenticated user could gain access to seeing
certain values, contrary to expected permissions. (CVE-2014-8161)
Andres Freund, Peter Geoghegan and Noah Misch discovered that PostgreSQL
incorrectly handled buffers in to_char functions. An authenticated attacker
could possibly use this issue to cause PostgreSQL to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2015-0241)
It was discovered that PostgreSQL incorrectly handled memory in the
pgcrypto extension. An authenticated attacker could possibly use this issue
to cause PostgreSQL to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2015-0243)
Emil Lenngren discovered that PostgreSQL incorrectly handled extended
protocol message reading. An authenticated attacker could possibly use this
issue to cause PostgreSQL to crash, resulting in a denial of service, or
possibly inject query messages. (CVE-2015-0244)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
postgresql-9.4
9.4.1-0ubuntu0.14.10
- Ubuntu 14.04 LTS:
-
postgresql-9.3
9.3.6-0ubuntu0.14.04
- Ubuntu 12.04 LTS:
-
postgresql-9.1
9.1.15-0ubuntu0.12.04
- Ubuntu 10.04 LTS:
-
postgresql-8.4
8.4.22-0ubuntu0.10.04.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References
[ MDVSA-2015:046 ] ntp
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:046 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : ntp Date : February 12, 2015 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated ntp packages fix security vulnerabilities: Stephen Roettger of the Google Security Team, Sebastian Krahmer of the SUSE Security Team and Harlan Stenn of Network Time Foundation discovered that the length value in extension fields is not properly validated in several code paths in ntp_crypto.c, which could lead to information leakage or denial of service (CVE-2014-9297). Stephen Roettger of the Google Security Team reported that ACLs based on IPv6 ::1 (localhost) addresses can be bypassed (CVE-2014-9298). ______
[ MDVSA-2015:045 ] e2fsprogs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:045 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : e2fsprogs Date : February 12, 2015 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated e2fsprogs packages fix security vulnerability: The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to trigger the vulnerability (CVE-2015-0247). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247 http://advisories.mageia.org/MGAS
[ MDVSA-2015:044 ] perl-Gtk2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:044 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : perl-Gtk2 Date : February 12, 2015 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: A vulnerability has been discovered and corrected in perl-Gtk2: Incorrect memory management in Gtk2::Gdk::Display::list_devices in perl-Gtk2 before 1.2495, where, the code was freeing memory that gtk+ still holds onto and might access later. The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://advisories.mageia.org/MGASA-2015-0059.html _______________________________________________________________________ Upda