spurious.biz IT Department

Webmail preferences accidentally deleted

All preference files of the webmail interface have been accidentally deleted. They will be restored by 14:00 o'clock this afternoon. We apologize seriously for this mistake! Update: all preferences have been successfully restored.

majimoto.net RSS feed

our new IT child got a new RSS feed. Check out the majimoto.net website!

Cracker attack on spurious.biz network

spurious.biz was subject to a major cracker attack. A malicious intruder exploited a system weakness to gain access to the system. Several parts of the system were damaged. The intruder installed several programs which made the system unstable and caused a system failure on late tuesday night. System recovery took longer than expected as it involved a complete reinstallation of the whole system and data recovery from the backup system. However, no data should be lost and the system should be fully functional soon again. Also, one harddisk crashed during the recovery and the backup system got compromised too... As the intruder had full access to the system, he might have gathered delicate information as passwords. We therefore urge you to change any password you used with your account on spurious.biz. As a precautionary measure some accounts/logins will be disabled during the next few days. We strongly recommend you to change also email passwords and database passwords. In order to ensure that a similar event will not happen again, we decided to make security requirements more stringent. In particular, this will affect cgi scripts and to some extent php applications. Most customers will not be affected by these changes. To those who will be affected, we would like to express that we are sorry about any inconvenience this will cause, but we think it is in everybodys if we rate securty a higher priority than convenience. If you encounter problems please do not hesitate to ask us for support. Please be patient while we recover the system... Best regards

phpMyAdmin update

version 2.6.1

Webmail update

squirrelmail was updated to version 1.4.4

Updated Apache and PHP

to version 2.0.53 and 4.3.10 respectively

added new Spam lookups

from sorbs.net

Web scripting issue escalation

An unknown script was executed with the privileges of our webserver and led to the NOC-admin closing the switch port.

UserDir's relocated

All users owning a public_html folder with an URL using a tilde ~ are now relocated on partisans.spurious.biz, which is an proper virtualhost serving only homes. The old URL will stay available at least till 2006.

Webmail security enhancement!

ALL requests to the webmail are finally automatically forced to be encrypted! If your browser cannot handle self-signed/created certificates, choose Firefox for example...

SSL certificates renewed

All the SSL certificates used for encrypting spurious.biz services had expired on January 17th. All have been replaced with new certificates valid until 2015. You might need to re-import the certificates from the IT/certificates website.

Perl and libtiff security fixes

See http://www.debian.org/security/2004/dsa-620 and http://www.debian.org/security/2004/dsa-617 for more information

Small webmail security fix

See here for more information: http://article.gmane.org/gmane.mail.squirrelmail.user/21169

Stability fixes in email system

PHP maintenance update

PHP was upgraded to version 4.3.9. See http://www.php.net/ChangeLog-4.php#4.3.9 for more information

Apache security fix

Upgrade to Apache HTTP Server 2.0.52 from http://httpd.apache.org/download.cgi?update=200409150645 Please see the CHANGES_2.0 file, linked from the above page, for a full list of changes.

Vpopmail and Courier updates

See the respective changelogs for more information.

PureFTPd security fix

The client socket switches to non-blocking mode before forking in accept_client()

Several security fixes

imagemagick (4:5.4.4.5-1woody3) stable-security; urgency=high * Non-maintainer upload by the Security Team. * coders/bmp.c: Fix buffer overflow in DecodeImage(). * coders/avi.c, coders/dib.c: Apply same fixes to local copies of DecodeImage(), and bring back in sync with version in bmp.c. -- Daniel Kobras Fri, 27 Aug 2004 19:15:04 +0200 imagemagick (4:5.4.4.5-1woody2) stable; urgency=high * Non-maintainer upload. * debian/rules: Apply patch from Adrian Bunk that explicitly sets X11 include and library paths. This fixes libdps detection and cures a dependency bug uncovered by the previous security update. Unbreaks all applications depending on libmagick5. Closes: #207016, #237663 -- Daniel Kobras Sat, 27 Mar 2004 16:16:19 +0100

Apache update

Apache was upgraded to version 2.0.51