Search Results: "will"

29 September 2006

Edd Dumbill: Locking down portmap on Debian

Most sensible people are very wary of NFS and its potential for security holes. If you can at all help it, it's a good idea not to run NFS and portmap on a network interface with direct internet connectivity. However, this isn't always convenient. As I needed to have NFS sharing on a host exposed to the internet, I set about finding the various places I needed to firewall. The tools I typically use to verify I've done the right things are netstat -nap on the machine concerned, to check for listening processes, and nmap from remote hosts to sniff for open ports. Portmap and its associated programs mostly use 'tcpwrappers' for controlling access. The first step you ought to take in securing portmap is to ensure that your hosts.allow and hosts.deny files are set up to control access properly. In /etc/hosts.deny, deny access to allcomers:
mountd: ALL
statd: ALL
portmap: ALL
rquotad: ALL
Then in /etc/hosts.allow, let the good guys through (adjust for your network):
mountd: 192.168.0.
statd: 192.168.0.
portmap: 192.168.0.
rquotad: 192.168.0.
On top of this, however, you should firewall off the ports that these programs use. As I found out, this is not as easy as it sounds. Portmap assigns random ports for some of the services it starts. You can run rpcinfo -p to see the ports in use. An example run on one of my machines looks like this:
program vers proto   port
 100000    2   tcp    111  portmapper
 100000    2   udp    111  portmapper
 100003    2   udp   2049  nfs
 100003    3   udp   2049  nfs
 100003    4   udp   2049  nfs
 100003    2   tcp   2049  nfs
 100003    3   tcp   2049  nfs
 100003    4   tcp   2049  nfs
 100021    1   udp  32770  nlockmgr
 100021    3   udp  32770  nlockmgr
 100021    4   udp  32770  nlockmgr
 100021    1   tcp  32788  nlockmgr
 100021    3   tcp  32788  nlockmgr
 100021    4   tcp  32788  nlockmgr
 100005    1   udp   1005  mountd
 100005    1   tcp   1008  mountd
 100005    2   udp   1005  mountd
 100005    2   tcp   1008  mountd
 100005    3   udp   1005  mountd
 100005    3   tcp   1008  mountd
 100024    1   udp    863  status
 100024    1   tcp    866  status
Of these, nfs and portmapper always use the same ports, 2049 and 111, so ensure you block off these. What about the rest? Happily, there's a way to configure them to use constant ports so we can reliably firewall them. Life would be too easy if all this configuration was in the one place, so here's how to find the different places you need to change. Finally, if you're running quotas, be sure to do something similar with RPCRQUOTADOPTS in /etc/default/quota. See also: Finally, I ought to note that I've written this up in case it helps anybody else. As with everything I write here, I make no warranty about its accuracy. Security is hard and obscure (but that's no reason not make our best efforts!)

Russell Coker: SAK, ctrl-alt-del, and Linux keyboard mapping

A common problem with Linux systems is when Windows users press CTRL-ALT-DEL at the login prompt and reboot the machine.

To fix this some people change the ^ca line in /etc/inittab to just disable the reboot function. However this is not desirable because sometimes you want to reboot a machine with a simple keypress.

Another problem that has not been widely considered is the use of fake login prompts by attackers. This can be implemented in either text mode or graphics mode. All the fake login prompt has to do is display something that looks like a real login prompt, accept a user-name and password, verify the password (a localhost ssh connection is a good way of doing this) and then abort. In the case of a text-mode login the user will think that they entered the wrong password, in the case of a GUI login via an XDM program the user will think that the login program just crashed. Then the attacker has access to their account.

The solution to the fake-login problem is the use of the Secure Attention Keyboard (SAK) feature. When invoked this feature makes the kernel kill all processes that are on the virtual console in question. If you make CTRL-ALT-DEL the SAK combination then pressing those keys will cause the kernel to kill any processes that are attached to the current virtual console and preventing the ability of hostile programs to forge a login prompt (which is the same as it's purpose in Windows).

The next thing to do is to make another combination used for system boot. A reasonable combination seems to be CTRL-ALT-BREAK as those keys are widely separated and the combination is not used for anything else.

If you put the following in a file named sak.map (or whatever you want to call it) then the command loadkeys sak.map will apply the change. Note that when creating a keyboard map you should do it on a machine for which you don't mind being forced to perform a hardware reboot. It's easy to make a mistake and give yourself a keyboard mapping that is not usable. Another possibility is to do such testing on a machine that allows ssh logins, you can then login via ssh and run loadkeys -d to correct any errors you might make.

control alt keycode 119 = Boot
control alt keycode 83 = SAK
control alt keycode 111 = SAK
control altgr keycode 119 = Boot
control altgr keycode 83 = SAK
control altgr keycode 111 = SAK

Note that the above covers both ALT and ALT-Gr keys as well as the numeric keypad and regular versions of the delete key.

dumpkeys -l gives you a list of all possible keyboard combinations. showkey will display the number matching any key you press and will exit after 10 seconds of inactivity.

John Goerzen: The News

Big news over here: earlier this week, our first baby was born: Jacob Simon Goerzen! He weighed in at 8 lbs, 12 oz and is doing well.

Terah was in labor most of the day, but eventually the doctor determined he was too big, so was delivered by C-section. Terah is still sore from all that, but otherwise is doing well, too. And of course we're both trying to catch up on sleep. (Not that we really expect to be able to...)

It's already been so wonderful to have him here. He already has a personality in some ways, and just is wonderful to be around. We've had a number of visitors, but the one that was extra special was when my 91-year-old grandmother stopped by and held him for awhile. Terah managed to get a photo of Jacob, me, my mom, and grandma -- 4 generations.

We've got a lot to tell, and I'm sure you'll be seeing more from both Terah and me in the next couple of days. But to start you off, I've got the first 5 pictures online already.

Here's one of the earliest pictures of him. This one was in the operating room, just a couple of minutes after he was born. The nurses had done their inital check, and gave him to me. I took him over by Terah so she could look (the doctors were still finishing up the operation). One of the people in the OR took the camera and got this picture:



Make sure to click here for the rest of the pictures in this set.

Debian folks -- do you see anything striking about Terah's gown in the photo of her holding Jacob? Something oddly familiar, perhaps? Something that my brother recognized instantly -- and burst out laughing -- when we asked him if he "noticed anything special" about the gown? More on that later...

Sorry, Cliff, for not posting sooner. Hopefully no more bait will be necessary...

Andreas Schuldei

Future beach front property

Today I watched the "An Inconvenient Truth" film which was recommened to us at the foo camp preceeding Euro OSCon. Steve had already blogged about it shortly. While i enjoy the summer evenings at the end of september that I experienced this week, I think we are heading for very serious and even hard times. I would guess that we all will soon have to cut back on many areas of our compfortable lifes: less warm showers, more sweaters in winter, not keeping your computer on 24/7, no more car, no more flights. I have been thinking on where to move, given the delicate position that europe is in with its dependency on the gulf stream.

Incidently i also ran into this cool website today, which makes one consequence of global warming a little bit more realistic. If you are lucky your house in the middle of the city will be beach front property soon.

Yet another example of that positive crisis awareness is needed. Act today and we might just get a major global crisis. Don't act and we might get mass extinction.

Pierre Habouzit: Sad,Bitter,Angry ness

That's my current mix of feelings. There is a french saying that says: the best among us always leave first . Would I need to qualify him ? Dignity, Honesty, Faiththul to his ideals. Shame on us to have let it happen. You will be missed.

28 September 2006

Evan Prodromou: 6 Vend miaire CCXV

As far as I can tell, polygen is a piece of software developed to make jokes at my expense (my favourite kind!). First there was the Evan's blog posts grammar, and now I've made the list in the Complaints grammar for the Debian:TheDebianChoirOfComplaints. I'm so glad this process has finally been automated! tags:

Hey Don Don Marti saw my ssh woes as previously mentioned (see Tag/ssh) and gave a cool shell function to fix it. It even snags credentials from your other ssh-agent instances, even if they're not an immediate parent of your shell. Thanks, Don! Thanks, wp:Lazyweb! tags:

OpenSearch So, I've been twiddling around with OpenSearch, the feed-based distributed search system that weird little Amazon subsidiary A9 is foisting off on the world. I think it'd probably be pretty neat for Wikitravel. Gregory Szorc, the mad scientist of the MediaWiki world, has done a nice OpenSearch extension for MediaWiki. I had to tweak it a lot, which was kind of fun, but I still haven't gotten it to work entirely satisfactorily. I'm suspecting I'll have to changeover to lucene search, the MW plugin that uses Lucene as search subsystem, to really get reasonable performance out of this. In any event I'm mildly interested in OpenSearch. It's nice, I guess, and it's kind of cool that it works with Firefox and IE7 as an in-browser search alternative. However, I'm disappointed it's not supported in other portals besides A9. tags:

YaCy Speaking of search: wow. YaCy. The distributed search engine system. It seems like a really good idea, but I'm not really impressed by the search results I've gotten so far. But, regardless, I've set up the crawler to run on a couple of servers around the house, and the daemon seems to be running pretty cool, so it's not really noticeable. I'll probably forget about them for a while, and we'll see what some benign neglect will bring to their index accuracy. tags:

Erich Schubert: Folding tagclouds

Folding tag clouds of Debian software packages. I'm trying to make tag clounds workable with a large number of tags (unfolded tag cloud for comparison) by folding them into subtopics. Yay, when we're done with tagging the Debian packages, we'll have a great new way of browsing available Linux software. Linux doesn't lack software anymore, it has so much software, you just don't find what you need. The next version of this will probably allow you to select multiple tags, and update the tag cloud upon selection. So if you choose "GTK" ui toolkit, the "QT" toolkit tag will become quite small, etc.

Ben Hutchings: DebConf6 DVDs

They're very nearly done. Menus are available for preview: English disc 1, English disc 2, Spanish disc (you can preview them in a Mozilla-based browser but you need to use VideoLink to see them exactly as they will appear). To do: add background pictures where missing, adjust some menus that are slightly too long in an "NTSC" frame, add the day trip if we ever find some music for it, test, release. I'm also considering moving or duplicating the Debian Day session that's in English to English disc 1. I uploaded VideoLink 0.11 this morning and intend to put up the DebConf6 DVD sources (other than video) this evening. Update: Done. Still lacking the day trip, and I pulled the logo because I forgot to ask permission to use it yet.

Evan Prodromou: 5 Vend miaire CCXV

Being an inveterate domain-name registerer, I've got a lot of domains sitting around doing nothing. I've only recently stumbled across Bruce Perens's Open Source Parking site. It's a clever idea -- transferring those parked domains on GoDaddy and other registrars to a page with ads for FOSS projects. tags:

Adieu John Our friend John Usher bugged out to wt:Banff today. He's off to the Banff Centre to finish up the research he did on his Ph.D. and do some more work on goofy, crazy audio projects in the healthsome mountain air. According to John, it's really nice at the Centre, but if you go outside you have to clap all the time to keep grizzly bears away. I'm not sure if that's for real or just a prank that the locals play on visiting scientists. John's been here a few weeks -- it was really good to have him. Our apartment is just a bit too big, and I've enjoyed the space most when we have a friend or relative staying in the guest bedroom. I think in the year or so that we've lived here it's been occupied about 30-40% of the time. I know Amita June will miss having Mononc John around. They get along really well, and I was hoping that AJ would pick up some UK turns of phrase like "tickety-boo" and "manky". I'm particularly charmed by the English use of the word "cheers", which seems to be analogous to the way like Hawaiians use "aloha"; it means hello, good bye, thank you, and Mmmm! Beer!. A fine word used by fine people. tags:

Postfix fix Over the last few days I've been tightening down on the amount of spam I get in my Inbox by trying to cut it off at the MTA (mail server) level. I have a lot of different email addresses, and I use a mix of mail forwarding and multiple IMAP or POP3 inboxes to bring everything together into one nice little bundle. I do some Bayesian filtering on the client side, and I have a call to use Vipul's Razor in my .procmailrc files, but it's great to filter this stuff further up the data path, too. Fortunately the three servers that get me the most mail all run Postfix. Postfix has some nice common-sense features that cut down on spam right out of the box. First, I made sure all three servers used wp:DNSBL lists to block open relay servers. Second, I added some checks for validity on sender address domain and domain in the HELO command. Finally, I added a filter to check the Sender Policy Framework to see if the connecting server is authorized to send mail for the sending address's domain. Of the three changes, I've found that the basic checks -- making sure that sender address domains and HELO hostnames are valid -- are blocking the most mail. But the other two kinds of checks help, too. This all came not a moment too soon, as the wikitravel.org mail server seems to be under another DDOS attack. Check out the numbers on the mail that's queued versus what's getting rejected!
evan@antipater:~$ sudo grep NOQUEUE /var/log/mail.log.0   wc -l
119150
evan@antipater:~$ sudo grep qmgr.*removed /var/log/mail.log.0   wc -l
590
Gee, three orders of magnitude difference... I'm getting about 50-50% on other servers. This is over the last 24 hours or so -- what a huge waste of time. tags:

Axel Beckert: wApua 0.06 released

I today released version 0.06 of my WAP browser wApua (Release announcement at Freshmeat). The one big new thing is user friendly documentation: wApua and wbmp2xbm (which has been renamed from wbmp2xbm.pl) now have POD documentation and therefore also man pages. Besides that a lot of minor bugfixes and enhancements complete the new version. The other big new thing is that there now is a Debian package of wApua. The package should work fine on Debian Woody (3.0), Sarge (3.1) and Etch (upcoming 4.0) and probably also works on other Debian-based distributions like Ubuntu. Thanks to sponsoring by Christoph “Myon” Berg the Debian package is also in the Debian New Queue and hopefully will be included in Debian Etch.

27 September 2006

Alexander Schmehl: If you travel in Germany...

... on the railroad, and forgot your luggage (like your girlfriends birthday present you just bought) in the train just leaving the station and it's a small station in the middle of nowhere (like the main station in a city counting officially more that 100'000 inhabitants) and late in the evening (like 7pm) and there is no service personal to find anywhere, you should call the zentrale Fundstelle; don't search for their phone number at reasonable places (like the closed information point) or a phone booth (if you ever find one with a phone book). The Number is: 01805-990599. But it's quite useless; they will just take a note, give you a number and ask you call back in a couple of days, instead of doing something useful (like calling the personal in the train, to get my fucking birthday present I spend the last money I don't have from my credit card, and ask them to leave it at the next bigger station, where I would have picked it up). DAMN!

Uwe Hermann: Towards a moderately paranoid Debian laptop setup [Update]

I was planning to set up my laptop from scratch for a while now... so I did. Preparation BIOS Installation / Setting up full-disk encryption using dm-crypt
  • Enable shadow passwords. Allow login as root (I feel confident that I won't do stupid things as root).
  • Choose a good root password, and a (different) good user password. Don't enter a full name for the user.
  • Choose the latest kernel (old kernels might have security issues). Do not participate in popcon.
  • Do not install any tasks (no "desktop", no "base system"). We want the smallest installation possible, and add only the packages we really need. Fewer packages means fewer security issues (statistically).
  • That's it. Eject the CD-ROM, reboot, change the BIOS to only allow booting from hard drive.
  • Post-installation tasks Networking, Upgrading and Apt-secure SELinux Now install and set up SELinux. This section is based on notes from Erich Schubert (thanks!), and will soon appear in the SELinuxSetup wiki page, too. Behaviour Further ideas That's it. You can take off that stupid tin-foil hat now. Update 2006-09-29: Fixed typos. Mentioned sxid. Added two-factor authentication.

    Uwe Hermann: Towards a moderately paranoid Debian laptop setup

    I was planning to set up my laptop from scratch for a while now... so I did. Preparation BIOS Installation / Setting up full-disk encryption
  • Enable shadow passwords. Allow login as root (I feel confident that I won't do stupid things as root).
  • Choose a good root password, and a (different) good user password. Don't enter a full name for the user.
  • Choose the latest kernel (old kernels might have security issues). Do not participate in popcon.
  • Do not install any tasks (no "desktop", no "base system"). We want the smallest installation possible, and add only the packages we really need. Fewer packages means fewer security issues (statistically).
  • That's it. Eject the CD-ROM, reboot, change the BIOS to only allow booting from hard drive.
  • Post-installation tasks Networking, Upgrading and Apt-secure SELinux Now install and set up SELinux. This section is based on notes from Erich Schubert (thanks!), and will soon appear in the SELinuxSetup wiki page, too. Behaviour Further ideas That's it. You can take off that stupid tin-foil hat now.

    Erich Schubert: My favourite name: Freefox

    Apparently, the firefox logo and name have to be considered "non-free" by Debian. The mozilla foundation only allows use of the firefox brand for "official" builds, and Debian tends to add patches to applications to fix bugs without waiting for upstream to do this. So Debian packages aren't an unmodified firefox build. (Mozilla Foundation trademark policy) Of course the Mozilla foundation won't object to the kind of modifications Debian did, probably not consider them "serious"; but Debian is meant to be used by others (e.g. Ubuntu) to build their own distributions. These in turn will probably not be tolerated in the same way (and might want to do "serious" modifications). Anyway, Debian has been using a plain "world" icon for firefox for some time, now it seems we'll have to change the name, too. A couple of names has been proposed, including "iceweasel", "firechicken" and "freefox". I definitely like the last one best, since it's very clear about being related to firefox, but more free. I wonder if we can use "Firefox" at least in the User-Agent string. Other browsers have been using "Mozilla" there for a long time, too.

    Wouter Verhelst: GDM

    Joey, Debian's GDM does ship with the default file that contains lots and lots of comments. However, if you use the builtin configuration tool at least once, it will overwrite your configuration file with another file that contains just the configuration, not the comments anymore. Perhaps that's what happened to you?

    Steve Kemp: Hold out your delicate hands and feel me.

    I’ve given notice that I’m unavailable for Debian work for the next while. Once I’m fully settled I will concentrate soley on doing Debian Auditing, and security team work. With that in mind I hereby give notice that all my packages are up for adoption. I have not filed “O” bugs, but if people wish to claim things by posting here thats fine by me. Preference to Radu for xen-tools (since he has CVS access and did a great job previously), otherwise anybody with the time is welcome. I’m upstream of several packages, but I don’t think I’m hard to deal with …. ;) Anything not claimed by the time I catch up will be Orphaned. Apologies for feeding the “announcement by blog, not by mail” fire.

    Russell Coker: tcpdump and ps

    Today I was doing some network tracing and figured out how to track the start and end of TCP connections. The following tcpdump command will get all SYN, FIN, and RST packets on port 80 and all ICMP packets:

    tcpdump -i bond0 -n "port 80 and tcp[tcpflags] & (tcp-syn tcp-fin tcp-rst) != 0 or icmp"

    Also recently I was tracking down some minor security issues related to programs that call setuid() to drop privs but never call setgid() and therefore always run with GID==0 which gives them a lot of access to the system. The following ps command gives the real, effective, saved, and filesystem UIDs and GIDs mapped to names. Note that with some versions of ps different fields have different truncation lengths.

    ps -eo pid,user,euser,suser,fuser,group,egroup,sgroup,fgroup,comm

    The next thing I have to do is to patch PS to show the supplementary groups.

    Benjamin Mako Hill: Who Gets to Define Freedom?

    Recently, I had an opportunity to publicly discuss my projects around definitions of freedom for creative work with Lawrence Lessig at a workshop at Wizards of OS. In particular, we talked about my article Toward a Standard of Freedom in which I advance a call for a list of essential freedoms, a definition of free culture or content, and a goal around which a social movement for free creative works can be based. At WOS, Lessig and I agreed that its likely that, eventually, some standard (or standards) of freedom will take hold. Like me, Lessig seems to think that this is a good thing. We both agree that there will be, and should be, competing definitions of freedom, competing social movements, and a long conversation about what essential freedom really to creative works is before we get there. Our most fundamental differences seem to stem from a disagreement about who gets to define freedom or, perhaps more precisely, who the communities of producers should listen to in order to find out what essential freedoms in the domain of different types of creative works are. Lessig is extremely reticent to make any claims about what essential freedoms might be: he does not want to speak for creative communities that he does not intimately understand. While he seems to be suspect of any project making normative claims in this regard, he disagrees most strongly with projects like mine that offer definitions of free content and expressions that are intended to be applied broadly and outside of the explicit domain of the definition's initiators recognized experience (in our case, online encyclopedias and software). Lessig explained that he trusts musicians -- and in particular, Gilberto Gil, the progenitor of the CC Sampling license -- when it comes to defining essential freedoms for music. Similarly, he trusts programmers -- and in particular, Richard Stallman -- when it comes to defining essential freedom for software. Since Richard and I are less accomplished, less well known, and less experienced musicians, Lessig feels most comfortable erring in favor of Gil where there's a disagreement between us about the scope of essential freedom for music. While his is a convincing argument, I disagree with Lessig's position for a series of reasons I'll try to discuss here. First, it is important to remember that Gilberto Gil does not represent all musicians. There are many artists and musicians who support my definition. There are many (and probably more if the CC license usage statistics are any indication) who support Gil's lower base-line. It's worth remembering that, even though we disagree, both Gil and I are offering controversial and extreme positions. Today, most creators think that giving away their work at no cost, even non-commercially and barring derivatives, is crazy. To illustrate why this is not a problem, we can look again to free software. In the free software community, we see that Richard Stallman does not speak for the programming community at large when it comes to defining essential freedoms to code. In the mid-eighties, Stallman spoke for himself and a tiny handful of like-minded others. Today he speaks for many more but it's still a tiny fraction of all programmers. It's hard to remember when you're down in the trenches but the idea that software should be free remains a marginal and kooky idea to this day. Due to the hard work of the free software movement, many people have adopted Stallman's definition of essential freedom for software and many more will. But it is not mainstream and it didn't get here by being so. Setting an ethical standard and a goal for a social movement should not be about being popular. It should be about describing an ideal. It should be about standing up to injustice. It should be about answering the question, "what sort of world do I want to live in?" Not only is this process not a popularity contest, it will, in all likelihood, stand to make one very unpopular. Being respected or seen as an expert within a field will help with the adoption of one's ideal. Programmers trusted Richards Stallman because he'd written large parts of the very popular programming tools like GNU Emacs and GCC. However, it wasn't from his experience in programming that this insight into the importance of software freedom stemmed. It was from his desire to be a good, ethical, neighbor and member of a technical community. To this day, most great programmers continue to disagree with Richard. Second, I'm interested not only in talking about the ability of authors to choose how their works are used but in the rights of readers. You don't need to have a platinum album under your belt to have an informed and important opinion about how music should be heard, experienced and distributed. Lessig's current push for a "Read-Write Culture" is very fixated on creators and re-mixers. That's only one important piece of the community that frames and deals with this problem. Third, while I agree with Lessig that discussions around definitions of free culture must happen separately in each separate artist community, I see several compelling reasons why a single definition of freedom may be a very good idea both tactically and philosophically. For example, it provides a common rallying cry around which different creative groups can collaborate and it mirrors the common treatment of different types of works in current IP systems. More importantly, there are fundamental similarities between information goods and the way they are created, distributed, and consumed on computers and in digital networks. I've highlighted this before in quoting Eben Moglen on the ethics of creating artificial scarcity in goods with zero marginal cost. As a final note, it's worth stating that one doesn't need to feel that all works should be free to support a definition of freedom. Richard Stallman provides a great example of this. Stallman doesn't think that works of opinion or works that are designed primarily to entertain need to be free. However, he does believe that the term "free" should refer to a fixed set of freedoms so that he can take such a position. Without a definition of "free," a position on what should or should not be "free" is impossible. I believe that freedom to distribute and produce information goods like art and content and software are embedded in a set of freedoms and rights for both the producers and consumers. I think that to some degree (and quite probably a less extensive degree), Lessig agrees with this. Unlike Lessig, I don't believe that one needs extensive expertise in the creation of a particular type of creative good to make true statements about what is ethical or unethical in the production, distribution, and control of it. To use admittedly extreme analogies, you don't need to be a slave owner (or slave for that matter) to say that slavery is wrong. You don't need to be a farmer to make arguments against or in favor of vegetarianism or in favor of free range animals. I don't believe you have to be a technologist to claim that certain freedoms to technology are essential. I don't believe that you need to be an musician (successful or not) to make claims about essential rights to music. I welcomed the conversations and challenges that Lessig offered and it was encouraging to see agreement on the process of discussion and debate going forward. After the workshop, Lessig suggested that we continue the conversation. I look forward to doing just this in other venues and in other ways.

    Robert Collins: 26 Sep 2006

    I've just released bzr 0.11rc2 which unbreaks the test suite for windows and fixes our commit performance regression! The 0.12 release will be managed by John Arbash Meinel, giving me some more cycles to focus on local performance. Yay!

    26 September 2006

    Alexander Sack: mozilla-thunderbird / mozilla security updates available for preview

    I uploaded another round of security updates for mozilla and mozilla-thunderbird to my security preview archive. The preview build for firefox will be made available from the same location in a day or two. The versions of concern here are:
    CODE:
    mozilla 2:1.7.8-1sarge7.3.1
    mozilla-thunderbird 1.0.2-2.sarge1.0.8c.1
    If you see any NEW bugs, let me know. Thanks

    Next.

    Previous.