From trumpjk at gmail.com Wed May 28 23:41:49 2014 Content-Type: multipart/mixed; boundary="===============3665335136401167377==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: [389-users] Retna Scan Results Date: Wed, 28 May 2014 19:41:06 -0400 Message-ID: --===============3665335136401167377== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I have a system running 389-ds that was scanned using retna. Retna showed vulnerabilities which are fairly old. Can anyone confirm that these were fixed. Only thing using port 9830 is the admin-serv. Below are the rpm versions I have installed and the CVE's retna supposidly detected. 389-adminutil-1.1.19-1.el6.x86_64 389-ds-console-doc-1.2.6-1.el6.noarch 389-admin-1.1.35-1.el6.x86_64 389-admin-console-1.1.8-5.fc19.noarch 389-console-1.1.7-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-libs-1.2.11.25-1.el6.x86_64 389-ds-base-1.2.11.25-1.el6.x86_64 389-dsgw-1.1.11-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-admin-console-doc-1.1.8-5.fc19.noarch Audit ID: 6310 Vul ID: N/A Risk Level: Medium Sev Code: Category II PCI Level: Medium (Fail) - CVSS Score CVSS Score: 5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] BugTraq ID 27234,26838,27236,27237 CVE: CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 CCE: N/A Exploit: No IAV: N/A STIG: Context: TCP:9830 Result: Success Tested Value: BR T WB Server: (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-2])) ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+\..= *)) ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) Found Value: Server: Apache/2.2##Content-Length: 301##Connection: close##Content-Type: text/html; charset[=3D]iso-8859-1######404 Not Found##

Not Found

(truncated...) Audit ID: 6059 Vul ID: N/A Risk Level: Medium Sev Code: Category II PCI Level: Medium (Fail) - CVSS Score CVSS Score: 5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] BugTraq ID 24215,24645,25489,24649,24553 CVE: CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 52,CVE-2007-1863 CCE: N/A Exploit: No IAV: N/A STIG: Context: TCP:9830 Result: Success Tested Value: RR T WB (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*= \) )*[[]^()]*$)) Found Value: Apache/2.2 Audit ID: 9820 Vul ID: N/A Risk Level: Medium Sev Code: Category II PCI Level: High (Fail) - CVSS Score CVSS Score: 7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] BugTraq ID 35565,35253,35623,35251,34663,35221,35115 CVE: CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 CCE: N/A Exploit: Yes IAV: N/A STIG: Context: TCP:9830 Result: Success Tested Value: APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) Found Value: APACHE/2.2 --===============3665335136401167377== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SSBoYXZlIGEgc3lzdGVtIHJ1bm5pbmcgMzg5LWRzIHRoYXQgd2FzIHNj YW5uZWQgdXNpbmcgcmV0bmEuIFJldG5hIHNob3dlZCB2dWxuZXJhYmlsaXRpZXMgd2hpY2ggYXJl IGZhaXJseSBvbGQuIENhbiBhbnlvbmUgY29uZmlybSB0aGF0IHRoZXNlIHdlcmUgZml4ZWQuIE9u bHkgdGhpbmcgdXNpbmcgcG9ydCA5ODMwIGlzIHRoZSBhZG1pbi1zZXJ2LiBCZWxvdyBhcmUgdGhl IHJwbSB2ZXJzaW9ucyBJIGhhdmUgaW5zdGFsbGVkIGFuZCB0aGUgQ1ZFJiMzOTtzIHJldG5hIHN1 cHBvc2lkbHkgZGV0ZWN0ZWQuPGRpdj4KCjxicj48L2Rpdj48ZGl2PjxkaXY+Mzg5LWFkbWludXRp bC0xLjEuMTktMS5lbDYueDg2XzY0PC9kaXY+PGRpdj4zODktZHMtY29uc29sZS1kb2MtMS4yLjYt MS5lbDYubm9hcmNoPC9kaXY+PGRpdj4zODktYWRtaW4tMS4xLjM1LTEuZWw2Lng4Nl82NDwvZGl2 PjxkaXY+Mzg5LWFkbWluLWNvbnNvbGUtMS4xLjgtNS5mYzE5Lm5vYXJjaDwvZGl2PjxkaXY+Mzg5 LWNvbnNvbGUtMS4xLjctMS5lbDYubm9hcmNoPC9kaXY+Cgo8ZGl2PjM4OS1kcy0xLjIuMi0xLmVs Ni5ub2FyY2g8L2Rpdj48ZGl2PjM4OS1kcy1iYXNlLWxpYnMtMS4yLjExLjI1LTEuZWw2Lng4Nl82 NDwvZGl2PjxkaXY+Mzg5LWRzLWJhc2UtMS4yLjExLjI1LTEuZWw2Lng4Nl82NDwvZGl2PjxkaXY+ Mzg5LWRzZ3ctMS4xLjExLTEuZWw2Lng4Nl82NDwvZGl2PjxkaXY+Mzg5LWRzLWNvbnNvbGUtMS4y LjYtMS5lbDYubm9hcmNoPC9kaXY+PGRpdj4zODktYWRtaW4tY29uc29sZS1kb2MtMS4xLjgtNS5m YzE5Lm5vYXJjaDwvZGl2PgoKPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5BdWRpdCBJRDo8c3Bh biBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPjYzMTA8c3BhbiBjbGFz cz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPlZ1bCBJRDo8c3BhbiBjbGFzcz0i IiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk4vQTxicj48L2Rpdj48ZGl2PjxkaXY+ UmlzayBMZXZlbDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFu Pk1lZGl1bTwvZGl2PgoKPGRpdj5TZXYgQ29kZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlIj4JPC9zcGFuPkNhdGVnb3J5IElJPC9kaXY+PGRpdj5QQ0kgTGV2ZWw6PHNwYW4g Y2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5NZWRpdW0gKEZhaWwpIC0g Q1ZTUyBTY29yZTwvZGl2PjxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hp dGUtc3BhY2U6cHJlIj4JPC9zcGFuPjUgW0FWOk4vQUM6TC9BdTpOL0M6Ti9JOk4vQTpQXTwvZGl2 PgoKPGRpdj5CdWdUcmFxIElEPHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+ CTwvc3Bhbj4yNzIzNCwyNjgzOCwyNzIzNiwyNzIzNzwvZGl2PjxkaXY+Q1ZFOjxzcGFuIGNsYXNz PSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Q1ZFLTIwMDgtMDAwNSxDVkUtMjAw Ny02Mzg4LENWRS0yMDA3LTY0MjIsQ1ZFLTIwMDctNjQ8L2Rpdj48ZGl2PjIwLENWRS0yMDA3LTUw MDAsQ1ZFLTIwMDctNjQyMSxDVkUtMjAwOC0xNjc4PC9kaXY+Cgo8ZGl2PkNDRTo8c3BhbiBjbGFz cz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk4vQTwvZGl2PjxkaXY+RXhwbG9p dDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk5vPC9kaXY+ PGRpdj5JQVY6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5O L0E8L2Rpdj48ZGl2PlNUSUc6PC9kaXY+PGRpdj5Db250ZXh0OjxzcGFuIGNsYXNzPSIiIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+VENQOjk4MzA8L2Rpdj4KCjxkaXY+UmVzdWx0Ojxz cGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+U3VjY2VzczwvZGl2 PjxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi Pgk8L3NwYW4+QlIgVCBXQiBTZXJ2ZXI6PC9kaXY+PGRpdj4oQXBhY2hlKFwoW1tdXildKlwpKT8v KCgyXC4oKDIoXC5bW10wLTddKT8pfCgwKFwuKFtbXTEtNV0/W1tdMC05XXw2W1tdMC0yXSkpPC9k aXY+Cgo8ZGl2Pj8pfCgxKFwuLiopPykpKXwoMVwuKCgzKFwuKFtbXTEtM10/W1tdMC05XXw0MCkp Pyl8KFtbXTAtMl0oXC4uKik/KSkpfCgwK1wuLiopKTwvZGl2PjxkaXY+KCR8W1tdXjAtOS5dKFtb XV4oXSpcKFtbXV5SXVtbXV4pXSpcKSkqW1tdXigpXSokKSk8L2Rpdj48ZGl2PkZvdW5kIFZhbHVl OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+U2VydmVyOiBB cGFjaGUvMi4yIyNDb250ZW50LUxlbmd0aDogMzAxIyNDb25uZWN0aW9uOjwvZGl2PgoKPGRpdj5j bG9zZSMjQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7PC9kaXY+PGRpdj5jaGFyc2V0Wz1daXNvLTg4 NTktMSMjIyMmbHQ7IURPQ1RZUEUgSFRNTCBQVUJMSUM8L2Rpdj48ZGl2PiZxdW90Oy0vL0lFVEYv L0RURCBIVE1MIDIuMC8vRU4mcXVvdDsmZ3Q7IyZsdDtodG1sJmd0OyZsdDtoZWFkJmd0OyMmbHQ7 dGl0bGUmZ3Q7NDA0IE5vdDwvZGl2PjxkaXY+Rm91bmQmbHQ7L3RpdGxlJmd0OyMmbHQ7L2hlYWQm Z3Q7Jmx0O2JvZHkmZ3Q7IyZsdDtoMSZndDtOb3QgRm91bmQmbHQ7L2gxJmd0O8KgPC9kaXY+Cgo8 ZGl2Pih0cnVuY2F0ZWQuLi4pPC9kaXY+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48ZGl2PkF1 ZGl0IElEOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+NjA1 OTxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+VnVsIElEOjxz cGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Ti9BPC9kaXY+Cgo8 ZGl2PlJpc2sgTGV2ZWw6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwv c3Bhbj5NZWRpdW08L2Rpdj48ZGl2PlNldiBDb2RlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Q2F0ZWdvcnkgSUk8L2Rpdj48ZGl2PlBDSSBMZXZlbDo8c3Bh biBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk1lZGl1bSAoRmFpbCkg LSBDVlNTIFNjb3JlPC9kaXY+Cgo8ZGl2PkNWU1MgU2NvcmU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9 IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj41IFtBVjpOL0FDOkwvQXU6Ti9DOlAvSTpOL0E6Tl08 L2Rpdj48ZGl2PkJ1Z1RyYXEgSUQ8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl Ij4JPC9zcGFuPjI0MjE1LDI0NjQ1LDI1NDg5LDI0NjQ5LDI0NTUzPC9kaXY+PGRpdj5DVkU6PHNw YW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5DVkUtMjAwNy0xODYy LENWRS0yMDA3LTM4NDcsQ1ZFLTIwMDctMzMwNCxDVkUtMjAwNi01NzwvZGl2PgoKPGRpdj41MixD VkUtMjAwNy0xODYzPC9kaXY+PGRpdj5DQ0U6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNw YWNlOnByZSI+CTwvc3Bhbj5OL0E8L2Rpdj48ZGl2PkV4cGxvaXQ6PHNwYW4gY2xhc3M9IiIgc3R5 bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5ObzwvZGl2PjxkaXY+SUFWOjxzcGFuIGNsYXNz PSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Ti9BPC9kaXY+Cgo8ZGl2PlNUSUc6 PC9kaXY+PGRpdj5Db250ZXh0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi Pgk8L3NwYW4+VENQOjk4MzA8L2Rpdj48ZGl2PlJlc3VsdDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPlN1Y2Nlc3M8L2Rpdj48ZGl2PlRlc3RlZCBWYWx1ZTo8 c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPlJSIFQgV0I8L2Rp dj4KCjxkaXY+KEFwYWNoZShcKFtbXV4pXSpcKSk/LygyXC4yKFwuW1tdMC01XSk/KSgkfFtbXV4w LTkuXShbW11eKF0qXChbW11eUl1bW11eKV0qXCk8L2Rpdj48ZGl2PikqW1tdXigpXSokKSk8L2Rp dj48ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi Pgk8L3NwYW4+QXBhY2hlLzIuMjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+PGRpdj4K CkF1ZGl0IElEOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+ OTgyMDxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+VnVsIElE OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Ti9BPC9kaXY+ PGRpdj5SaXNrIExldmVsOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8 L3NwYW4+TWVkaXVtPC9kaXY+Cgo8ZGl2PlNldiBDb2RlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Q2F0ZWdvcnkgSUk8L2Rpdj48ZGl2PlBDSSBMZXZlbDo8 c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPkhpZ2ggKEZhaWwp IC0gQ1ZTUyBTY29yZTwvZGl2PjxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPjcuOCBbQVY6Ti9BQzpML0F1Ok4vQzpOL0k6Ti9BOkNd PC9kaXY+Cgo8ZGl2PkJ1Z1RyYXEgSUQ8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlIj4JPC9zcGFuPjM1NTY1LDM1MjUzLDM1NjIzLDM1MjUxLDM0NjYzLDM1MjIxLDM1MTE1PC9k aXY+PGRpdj5DVkU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bh bj5DVkUtMjAwOS0xODkxLENWRS0yMDA5LTE5NTUsQ1ZFLTIwMDktMTE5MSxDVkUtMjAwOS0wMDwv ZGl2PgoKPGRpdj4yMyxDVkUtMjAwOS0xOTU2LENWRS0yMDA5LTExOTUsQ1ZFLTIwMDktMTg5MDwv ZGl2PjxkaXY+Q0NFOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3Nw YW4+Ti9BPC9kaXY+PGRpdj5FeHBsb2l0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUiPgk8L3NwYW4+WWVzPC9kaXY+PGRpdj5JQVY6PHNwYW4gY2xhc3M9IiIgc3R5bGU9Indo aXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5OL0E8L2Rpdj4KCjxkaXY+U1RJRzo8L2Rpdj48ZGl2PkNv bnRleHQ6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5UQ1A6 OTgzMDwvZGl2PjxkaXY+UmVzdWx0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUiPgk8L3NwYW4+U3VjY2VzczwvZGl2PjxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuIGNsYXNzPSIi IHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+QVBBQ0hFKC1BRFZBTkNFREVYVFJBTkVU U0VSVkVSKT8vMlwuMihcLigxW1tdMDFdfFtbXTA8L2Rpdj4KCjxkaXY+LTldKShcLltbXTAtOV0r KSopPygkfFtbXV4wLTkuXSk8L2Rpdj48ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIGNsYXNzPSIiIHN0 eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+QVBBQ0hFLzIuMjwvZGl2PjwvZGl2PjxkaXY+ PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjwvZGl2Pgo= --===============3665335136401167377==-- From nhosoi at redhat.com Thu May 29 00:24:38 2014 Content-Type: multipart/mixed; boundary="===============1815980297343984882==" MIME-Version: 1.0 From: Noriko Hosoi To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Wed, 28 May 2014 17:24:33 -0700 Message-ID: <53867E41.2090801@redhat.com> In-Reply-To: CANd=zChCb8hmsbhGhZP16MJgCMRDOavu-Eu4S4_R7j63krQ-uA@mail.gmail.com --===============1815980297343984882== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello, as you mentioned, all of the CVEs are quite old (older than = RHEL-6). For instance, the last one CVE-2009-1956 was fixed in = apr-util-1.2.7-7.el5_3.1. As long as you use RHEL-6, the CVEs you = listed are all fixed. Also, please note that the CVEs are all httpd = related, not 389-ds. CVE: CVE-2008-0005 CVE-2007-6388 CVE-2007-6422 CVE-2007-6420 CVE-2007-5000 CVE-2007-6421 CVE-2008-1678 CVE-2007-1862 CVE-2007-3847 CVE-2007-3304 CVE-2006-5752 CVE-2007-1863 CVE-2009-1891 CVE-2009-1955 CVE-2009-1191 CVE-2009-0023 CVE-2009-1956 CVE-2009-1195 CVE-2009-1890 John Trump wrote: > I have a system running 389-ds that was scanned using retna. Retna = > showed vulnerabilities which are fairly old. Can anyone confirm that = > these were fixed. Only thing using port 9830 is the admin-serv. Below = > are the rpm versions I have installed and the CVE's retna supposidly = > detected. > > 389-adminutil-1.1.19-1.el6.x86_64 > 389-ds-console-doc-1.2.6-1.el6.noarch > 389-admin-1.1.35-1.el6.x86_64 > 389-admin-console-1.1.8-5.fc19.noarch > 389-console-1.1.7-1.el6.noarch > 389-ds-1.2.2-1.el6.noarch > 389-ds-base-libs-1.2.11.25-1.el6.x86_64 > 389-ds-base-1.2.11.25-1.el6.x86_64 > 389-dsgw-1.1.11-1.el6.x86_64 > 389-ds-console-1.2.6-1.el6.noarch > 389-admin-console-doc-1.1.8-5.fc19.noarch > > Audit ID:6310Vul ID:N/A > Risk Level:Medium > Sev Code:Category II > PCI Level:Medium (Fail) - CVSS Score > CVSS Score:5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] > BugTraq ID27234,26838,27236,27237 > CVE:CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 > 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 > CCE:N/A > Exploit:No > IAV:N/A > STIG: > Context:TCP:9830 > Result:Success > Tested Value:BR T WB Server: > (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-2= ])) > ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+\= ..*)) > ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) > Found Value:Server: Apache/2.2##Content-Length: 301##Connection: > close##Content-Type: text/html; > charset[=3D]iso-8859-1#### "-//IETF//DTD HTML 2.0//EN">##404 Not > Found##

Not Found

> (truncated...) > > Audit ID:6059Vul ID:N/A > Risk Level:Medium > Sev Code:Category II > PCI Level:Medium (Fail) - CVSS Score > CVSS Score:5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] > BugTraq ID24215,24645,25489,24649,24553 > CVE:CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 > 52,CVE-2007-1863 > CCE:N/A > Exploit:No > IAV:N/A > STIG: > Context:TCP:9830 > Result:Success > Tested Value:RR T WB > (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]^)= ]*\) > )*[[]^()]*$)) > Found Value:Apache/2.2 > > Audit ID:9820Vul ID:N/A > Risk Level:Medium > Sev Code:Category II > PCI Level:High (Fail) - CVSS Score > CVSS Score:7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] > BugTraq ID35565,35253,35623,35251,34663,35221,35115 > CVE:CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 > 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 > CCE:N/A > Exploit:Yes > IAV:N/A > STIG: > Context:TCP:9830 > Result:Success > Tested Value:APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 > -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) > Found Value:APACHE/2.2 > > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users --===============1815980297343984882== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5IZWxsbywgYXMgeW91IG1lbnRpb25lZCwgYWxsIG9mIHRoZQogICAgICBDVkVzIGFyZSBxdWl0 ZSBvbGQgKG9sZGVyIHRoYW4gUkhFTC02KS7CoCBGb3IgaW5zdGFuY2UsIHRoZSBsYXN0CiAgICAg IG9uZSBDVkUtMjAwOS0xOTU2IHdhcyBmaXhlZCBpbiBhcHItdXRpbC0xLjIuNy03LmVsNV8zLjEu wqAgQXMgbG9uZwogICAgICBhcyB5b3UgdXNlIFJIRUwtNiwgdGhlIENWRXMgeW91IGxpc3RlZCBh cmUgYWxsIGZpeGVkLsKgIEFsc28sCiAgICAgIHBsZWFzZSBub3RlIHRoYXQgdGhlIENWRXMgYXJl IGFsbCBodHRwZCByZWxhdGVkLCBub3QgMzg5LWRzLjxicj4KICAgICAgPGJyPgogICAgICA8ZGl2 PkNWRTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPjxicj4K ICAgICAgICBDVkUtMjAwOC0wMDA1PGJyPgogICAgICAgIENWRS0yMDA3LTYzODg8YnI+CiAgICAg ICAgQ1ZFLTIwMDctNjQyMjxicj4KICAgICAgICBDVkUtMjAwNy02NDIwPGJyPgogICAgICAgIENW RS0yMDA3LTUwMDA8YnI+CiAgICAgICAgQ1ZFLTIwMDctNjQyMTxicj4KICAgICAgICBDVkUtMjAw OC0xNjc4PC9kaXY+CiAgICAgIDxicj4KICAgICAgPGRpdj5DVkUtMjAwNy0xODYyPGJyPgogICAg ICAgIENWRS0yMDA3LTM4NDc8YnI+CiAgICAgICAgQ1ZFLTIwMDctMzMwNDxicj4KICAgICAgICBD VkUtMjAwNi01NzUyPGJyPgogICAgICAgIENWRS0yMDA3LTE4NjM8YnI+CiAgICAgIDwvZGl2Pgog ICAgICA8YnI+CiAgICAgIDxkaXY+Q1ZFLTIwMDktMTg5MTxicj4KICAgICAgICBDVkUtMjAwOS0x OTU1PGJyPgogICAgICAgIENWRS0yMDA5LTExOTE8YnI+CiAgICAgICAgQ1ZFLTIwMDktMDAyMzxi cj4KICAgICAgICBDVkUtMjAwOS0xOTU2PGJyPgogICAgICAgIENWRS0yMDA5LTExOTU8YnI+CiAg ICAgICAgQ1ZFLTIwMDktMTg5MDxicj4KICAgICAgPC9kaXY+CiAgICAgIDxicj4KICAgICAgSm9o biBUcnVtcCB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCmNpdGU9Im1pZDpD QU5kPXpDaENiOGhtc2JoR2haUDE2TUpnQ01SRE9hdnUtRXU0UzRfUjdqNjNrclEtdUFAbWFpbC5n bWFpbC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8ZGl2IGRpcj0ibHRyIj5JIGhhdmUg YSBzeXN0ZW0gcnVubmluZyAzODktZHMgdGhhdCB3YXMgc2Nhbm5lZAogICAgICAgIHVzaW5nIHJl dG5hLiBSZXRuYSBzaG93ZWQgdnVsbmVyYWJpbGl0aWVzIHdoaWNoIGFyZSBmYWlybHkgb2xkLgog ICAgICAgIENhbiBhbnlvbmUgY29uZmlybSB0aGF0IHRoZXNlIHdlcmUgZml4ZWQuIE9ubHkgdGhp bmcgdXNpbmcgcG9ydAogICAgICAgIDk4MzAgaXMgdGhlIGFkbWluLXNlcnYuIEJlbG93IGFyZSB0 aGUgcnBtIHZlcnNpb25zIEkgaGF2ZQogICAgICAgIGluc3RhbGxlZCBhbmQgdGhlIENWRSdzIHJl dG5hIHN1cHBvc2lkbHkgZGV0ZWN0ZWQuCiAgICAgICAgPGRpdj4KICAgICAgICAgIDxicj4KICAg ICAgICA8L2Rpdj4KICAgICAgICA8ZGl2PgogICAgICAgICAgPGRpdj4zODktYWRtaW51dGlsLTEu MS4xOS0xLmVsNi54ODZfNjQ8L2Rpdj4KICAgICAgICAgIDxkaXY+Mzg5LWRzLWNvbnNvbGUtZG9j LTEuMi42LTEuZWw2Lm5vYXJjaDwvZGl2PgogICAgICAgICAgPGRpdj4zODktYWRtaW4tMS4xLjM1 LTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAgICAgPGRpdj4zODktYWRtaW4tY29uc29sZS0xLjEu OC01LmZjMTkubm9hcmNoPC9kaXY+CiAgICAgICAgICA8ZGl2PjM4OS1jb25zb2xlLTEuMS43LTEu ZWw2Lm5vYXJjaDwvZGl2PgogICAgICAgICAgPGRpdj4zODktZHMtMS4yLjItMS5lbDYubm9hcmNo PC9kaXY+CiAgICAgICAgICA8ZGl2PjM4OS1kcy1iYXNlLWxpYnMtMS4yLjExLjI1LTEuZWw2Lng4 Nl82NDwvZGl2PgogICAgICAgICAgPGRpdj4zODktZHMtYmFzZS0xLjIuMTEuMjUtMS5lbDYueDg2 XzY0PC9kaXY+CiAgICAgICAgICA8ZGl2PjM4OS1kc2d3LTEuMS4xMS0xLmVsNi54ODZfNjQ8L2Rp dj4KICAgICAgICAgIDxkaXY+Mzg5LWRzLWNvbnNvbGUtMS4yLjYtMS5lbDYubm9hcmNoPC9kaXY+ CiAgICAgICAgICA8ZGl2PjM4OS1hZG1pbi1jb25zb2xlLWRvYy0xLjEuOC01LmZjMTkubm9hcmNo PC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGRpdj48YnI+CiAgICAgICAgPC9kaXY+CiAg ICAgICAgPGRpdj5BdWRpdCBJRDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl Ij4gPC9zcGFuPjYzMTA8c3BhbgogICAgICAgICAgICBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlIj4gPC9zcGFuPlZ1bCBJRDo8c3BhbgogICAgICAgICAgICBjbGFzcz0iIiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPk4vQTxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8 ZGl2PgogICAgICAgICAgPGRpdj5SaXNrIExldmVsOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUiPiA8L3NwYW4+TWVkaXVtPC9kaXY+CiAgICAgICAgICA8ZGl2PlNldiBDb2Rl OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+Q2F0ZWdvcnkK ICAgICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgIDxkaXY+UENJIExldmVsOjxzcGFuIGNsYXNz PSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+TWVkaXVtCiAgICAgICAgICAgIChG YWlsKSAtIENWU1MgU2NvcmU8L2Rpdj4KICAgICAgICAgIDxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBj bGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPjUKICAgICAgICAgICAgW0FW Ok4vQUM6TC9BdTpOL0M6Ti9JOk4vQTpQXTwvZGl2PgogICAgICAgICAgPGRpdj5CdWdUcmFxIElE PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj4yNzIzNCwyNjgz OCwyNzIzNiwyNzIzNzwvZGl2PgogICAgICAgICAgPGRpdj5DVkU6PHNwYW4gY2xhc3M9IiIgc3R5 bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5DVkUtMjAwOC0wMDA1LENWRS0yMDA3LTYzODgs Q1ZFLTIwMDctNjQyMixDVkUtMjAwNy02NDwvZGl2PgogICAgICAgICAgPGRpdj4yMCxDVkUtMjAw Ny01MDAwLENWRS0yMDA3LTY0MjEsQ1ZFLTIwMDgtMTY3ODwvZGl2PgogICAgICAgICAgPGRpdj5D Q0U6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5OL0E8L2Rp dj4KICAgICAgICAgIDxkaXY+RXhwbG9pdDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlIj4gPC9zcGFuPk5vPC9kaXY+CiAgICAgICAgICA8ZGl2PklBVjo8c3BhbiBjbGFzcz0i IiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgPGRp dj5TVElHOjwvZGl2PgogICAgICAgICAgPGRpdj5Db250ZXh0OjxzcGFuIGNsYXNzPSIiIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+VENQOjk4MzA8L2Rpdj4KICAgICAgICAgIDxkaXY+ UmVzdWx0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+U3Vj Y2VzczwvZGl2PgogICAgICAgICAgPGRpdj5UZXN0ZWQgVmFsdWU6PHNwYW4gY2xhc3M9IiIgc3R5 bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5CUgogICAgICAgICAgICBUIFdCIFNlcnZlcjo8 L2Rpdj4KICAgICAgICAgIDxkaXY+KEFwYWNoZShcKFtbXV4pXSpcKSk/LygoMlwuKCgyKFwuW1td MC03XSk/KXwoMChcLihbW10xLTVdP1tbXTAtOV18NltbXTAtMl0pKTwvZGl2PgogICAgICAgICAg PGRpdj4/KXwoMShcLi4qKT8pKSl8KDFcLigoMyhcLihbW10xLTNdP1tbXTAtOV18NDApKT8pfChb W10wLTJdKFwuLiopPykpKXwoMCtcLi4qKSk8L2Rpdj4KICAgICAgICAgIDxkaXY+KCR8W1tdXjAt OS5dKFtbXV4oXSpcKFtbXV5SXVtbXV4pXSpcKSkqW1tdXigpXSokKSk8L2Rpdj4KICAgICAgICAg IDxkaXY+Rm91bmQgVmFsdWU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+ IDwvc3Bhbj5TZXJ2ZXI6CiAgICAgICAgICAgIEFwYWNoZS8yLjIjI0NvbnRlbnQtTGVuZ3RoOiAz MDEjI0Nvbm5lY3Rpb246PC9kaXY+CiAgICAgICAgICA8ZGl2PmNsb3NlIyNDb250ZW50LVR5cGU6 IHRleHQvaHRtbDs8L2Rpdj4KICAgICAgICAgIDxkaXY+Y2hhcnNldFs9XWlzby04ODU5LTEjIyMj Jmx0OyFET0NUWVBFIEhUTUwgUFVCTElDPC9kaXY+CiAgICAgICAgICA8ZGl2PiItLy9JRVRGLy9E VEQgSFRNTAogICAgICAgICAgICAyLjAvL0VOIiZndDsjJmx0O2h0bWwmZ3Q7Jmx0O2hlYWQmZ3Q7 IyZsdDt0aXRsZSZndDs0MDQgTm90PC9kaXY+CiAgICAgICAgICA8ZGl2PkZvdW5kJmx0Oy90aXRs ZSZndDsjJmx0Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyMmbHQ7aDEmZ3Q7Tm90CiAgICAgICAgICAg IEZvdW5kJmx0Oy9oMSZndDvCoDwvZGl2PgogICAgICAgICAgPGRpdj4odHJ1bmNhdGVkLi4uKTwv ZGl2PgogICAgICAgIDwvZGl2PgogICAgICAgIDxkaXY+PGJyPgogICAgICAgIDwvZGl2PgogICAg ICAgIDxkaXY+CiAgICAgICAgICA8ZGl2PkF1ZGl0IElEOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+NjA1OTxzcGFuCiAgICAgICAgICAgICAgY2xhc3M9IiIg c3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5WdWwgSUQ6PHNwYW4KICAgICAgICAgICAg ICBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPk4vQTwvZGl2PgogICAg ICAgICAgPGRpdj5SaXNrIExldmVsOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUiPiA8L3NwYW4+TWVkaXVtPC9kaXY+CiAgICAgICAgICA8ZGl2PlNldiBDb2RlOjxzcGFuIGNs YXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+Q2F0ZWdvcnkKICAgICAgICAg ICAgSUk8L2Rpdj4KICAgICAgICAgIDxkaXY+UENJIExldmVsOjxzcGFuIGNsYXNzPSIiIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+TWVkaXVtCiAgICAgICAgICAgIChGYWlsKSAtIENW U1MgU2NvcmU8L2Rpdj4KICAgICAgICAgIDxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBjbGFzcz0iIiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPjUKICAgICAgICAgICAgW0FWOk4vQUM6TC9B dTpOL0M6UC9JOk4vQTpOXTwvZGl2PgogICAgICAgICAgPGRpdj5CdWdUcmFxIElEPHNwYW4gY2xh c3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj4yNDIxNSwyNDY0NSwyNTQ4OSwy NDY0OSwyNDU1MzwvZGl2PgogICAgICAgICAgPGRpdj5DVkU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9 IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5DVkUtMjAwNy0xODYyLENWRS0yMDA3LTM4NDcsQ1ZF LTIwMDctMzMwNCxDVkUtMjAwNi01NzwvZGl2PgogICAgICAgICAgPGRpdj41MixDVkUtMjAwNy0x ODYzPC9kaXY+CiAgICAgICAgICA8ZGl2PkNDRTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgPGRpdj5FeHBsb2l0OjxzcGFu IGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+Tm88L2Rpdj4KICAgICAg ICAgIDxkaXY+SUFWOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3Nw YW4+Ti9BPC9kaXY+CiAgICAgICAgICA8ZGl2PlNUSUc6PC9kaXY+CiAgICAgICAgICA8ZGl2PkNv bnRleHQ6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5UQ1A6 OTgzMDwvZGl2PgogICAgICAgICAgPGRpdj5SZXN1bHQ6PHNwYW4gY2xhc3M9IiIgc3R5bGU9Indo aXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5TdWNjZXNzPC9kaXY+CiAgICAgICAgICA8ZGl2PlRlc3Rl ZCBWYWx1ZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPlJS CiAgICAgICAgICAgIFQgV0I8L2Rpdj4KICAgICAgICAgIDxkaXY+KEFwYWNoZShcKFtbXV4pXSpc KSk/LygyXC4yKFwuW1tdMC01XSk/KSgkfFtbXV4wLTkuXShbW11eKF0qXChbW11eUl1bW11eKV0q XCk8L2Rpdj4KICAgICAgICAgIDxkaXY+KSpbW11eKCldKiQpKTwvZGl2PgogICAgICAgICAgPGRp dj5Gb3VuZCBWYWx1ZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9z cGFuPkFwYWNoZS8yLjI8L2Rpdj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2Pjxicj4KICAg ICAgICA8L2Rpdj4KICAgICAgICA8ZGl2PgogICAgICAgICAgPGRpdj4KICAgICAgICAgICAgQXVk aXQgSUQ6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj45ODIw PHNwYW4KICAgICAgICAgICAgICBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9z cGFuPlZ1bCBJRDo8c3BhbgogICAgICAgICAgICAgIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAgICAgICA8ZGl2PlJpc2sgTGV2ZWw6PHNwYW4g Y2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5NZWRpdW08L2Rpdj4KICAg ICAgICAgIDxkaXY+U2V2IENvZGU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnBy ZSI+IDwvc3Bhbj5DYXRlZ29yeQogICAgICAgICAgICBJSTwvZGl2PgogICAgICAgICAgPGRpdj5Q Q0kgTGV2ZWw6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+IDwvc3Bhbj5I aWdoCiAgICAgICAgICAgIChGYWlsKSAtIENWU1MgU2NvcmU8L2Rpdj4KICAgICAgICAgIDxkaXY+ Q1ZTUyBTY29yZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFu PjcuOAogICAgICAgICAgICBbQVY6Ti9BQzpML0F1Ok4vQzpOL0k6Ti9BOkNdPC9kaXY+CiAgICAg ICAgICA8ZGl2PkJ1Z1RyYXEgSUQ8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl Ij4gPC9zcGFuPjM1NTY1LDM1MjUzLDM1NjIzLDM1MjUxLDM0NjYzLDM1MjIxLDM1MTE1PC9kaXY+ CiAgICAgICAgICA8ZGl2PkNWRTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl Ij4gPC9zcGFuPkNWRS0yMDA5LTE4OTEsQ1ZFLTIwMDktMTk1NSxDVkUtMjAwOS0xMTkxLENWRS0y MDA5LTAwPC9kaXY+CiAgICAgICAgICA8ZGl2PjIzLENWRS0yMDA5LTE5NTYsQ1ZFLTIwMDktMTE5 NSxDVkUtMjAwOS0xODkwPC9kaXY+CiAgICAgICAgICA8ZGl2PkNDRTo8c3BhbiBjbGFzcz0iIiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgPGRpdj5F eHBsb2l0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+WWVz PC9kaXY+CiAgICAgICAgICA8ZGl2PklBVjo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAg ICAgICAgPGRpdj5Db250ZXh0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi PiA8L3NwYW4+VENQOjk4MzA8L2Rpdj4KICAgICAgICAgIDxkaXY+UmVzdWx0OjxzcGFuIGNsYXNz PSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPiA8L3NwYW4+U3VjY2VzczwvZGl2PgogICAgICAg ICAgPGRpdj5UZXN0ZWQgVmFsdWU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnBy ZSI+IDwvc3Bhbj5BUEFDSEUoLUFEVkFOQ0VERVhUUkFORVRTRVJWRVIpPy8yXC4yKFwuKDFbW10w MV18W1tdMDwvZGl2PgogICAgICAgICAgPGRpdj4tOV0pKFwuW1tdMC05XSspKik/KCR8W1tdXjAt OS5dKTwvZGl2PgogICAgICAgICAgPGRpdj5Gb3VuZCBWYWx1ZTo8c3BhbiBjbGFzcz0iIiBzdHls ZT0id2hpdGUtc3BhY2U6cHJlIj4gPC9zcGFuPkFQQUNIRS8yLjI8L2Rpdj4KICAgICAgICA8L2Rp dj4KICAgICAgICA8ZGl2Pjxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2Pjxicj4KICAg ICAgICA8L2Rpdj4KICAgICAgPC9kaXY+CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0IGNsYXNz PSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgPGJyPgogICAgICA8cHJl IHdyYXA9IiI+LS0KMzg5IHVzZXJzIG1haWxpbmcgbGlzdAo8YSBjbGFzcz0ibW96LXR4dC1saW5r LWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qu b3JnIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+CjxhIGNsYXNzPSJtb3ot dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcv bWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiPmh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5v cmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8L2E+PC9wcmU+CiAgICA8L2Jsb2NrcXVvdGU+ CiAgICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============1815980297343984882==-- From trumpjk at gmail.com Thu May 29 01:16:01 2014 Content-Type: multipart/mixed; boundary="===============3100921541561077073==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Wed, 28 May 2014 21:15:58 -0400 Message-ID: In-Reply-To: 53867E41.2090801@redhat.com --===============3100921541561077073== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I am running RHEL 6. Why does the scan show the vulnerabilities on the port that directory administration server is using? On May 28, 2014 8:25 PM, "Noriko Hosoi" wrote: > Hello, as you mentioned, all of the CVEs are quite old (older than > RHEL-6). For instance, the last one CVE-2009-1956 was fixed in > apr-util-1.2.7-7.el5_3.1. As long as you use RHEL-6, the CVEs you listed > are all fixed. Also, please note that the CVEs are all httpd related, not > 389-ds. > > CVE: > CVE-2008-0005 > CVE-2007-6388 > CVE-2007-6422 > CVE-2007-6420 > CVE-2007-5000 > CVE-2007-6421 > CVE-2008-1678 > > CVE-2007-1862 > CVE-2007-3847 > CVE-2007-3304 > CVE-2006-5752 > CVE-2007-1863 > > CVE-2009-1891 > CVE-2009-1955 > CVE-2009-1191 > CVE-2009-0023 > CVE-2009-1956 > CVE-2009-1195 > CVE-2009-1890 > > John Trump wrote: > > I have a system running 389-ds that was scanned using retna. Retna showed > vulnerabilities which are fairly old. Can anyone confirm that these were > fixed. Only thing using port 9830 is the admin-serv. Below are the rpm > versions I have installed and the CVE's retna supposidly detected. > > 389-adminutil-1.1.19-1.el6.x86_64 > 389-ds-console-doc-1.2.6-1.el6.noarch > 389-admin-1.1.35-1.el6.x86_64 > 389-admin-console-1.1.8-5.fc19.noarch > 389-console-1.1.7-1.el6.noarch > 389-ds-1.2.2-1.el6.noarch > 389-ds-base-libs-1.2.11.25-1.el6.x86_64 > 389-ds-base-1.2.11.25-1.el6.x86_64 > 389-dsgw-1.1.11-1.el6.x86_64 > 389-ds-console-1.2.6-1.el6.noarch > 389-admin-console-doc-1.1.8-5.fc19.noarch > > Audit ID: 6310 Vul ID: N/A > Risk Level: Medium > Sev Code: Category II > PCI Level: Medium (Fail) - CVSS Score > CVSS Score: 5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] > BugTraq ID 27234,26838,27236,27237 > CVE: CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 > 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 > CCE: N/A > Exploit: No > IAV: N/A > STIG: > Context: TCP:9830 > Result: Success > Tested Value: BR T WB Server: > > (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-2= ])) > > ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+\= ..*)) > ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) > Found Value: Server: Apache/2.2##Content-Length: 301##Connection: > close##Content-Type: text/html; > charset[=3D]iso-8859-1#### "-//IETF//DTD HTML 2.0//EN">##404 Not > Found##

Not Found

> (truncated...) > > Audit ID: 6059 Vul ID: N/A > Risk Level: Medium > Sev Code: Category II > PCI Level: Medium (Fail) - CVSS Score > CVSS Score: 5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] > BugTraq ID 24215,24645,25489,24649,24553 > CVE: CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 > 52,CVE-2007-1863 > CCE: N/A > Exploit: No > IAV: N/A > STIG: > Context: TCP:9830 > Result: Success > Tested Value: RR T WB > > (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]^)= ]*\) > )*[[]^()]*$)) > Found Value: Apache/2.2 > > Audit ID: 9820 Vul ID: N/A > Risk Level: Medium > Sev Code: Category II > PCI Level: High (Fail) - CVSS Score > CVSS Score: 7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] > BugTraq ID 35565,35253,35623,35251,34663,35221,35115 > CVE: CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 > 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 > CCE: N/A > Exploit: Yes > IAV: N/A > STIG: > Context: TCP:9830 > Result: Success > Tested Value: APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 > -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) > Found Value: APACHE/2.2 > > > > > -- > 389 users mailing list389-users(a)lists.fedoraproject.orghttps://admin.fe= doraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > --===============3100921541561077073== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PHAgZGlyPSJsdHIiPkkgYW0gcnVubmluZyBSSEVMIDYuIFdoeSBkb2VzIHRoZSBzY2FuIHNob3cg dGhlIHZ1bG5lcmFiaWxpdGllcyBvbiB0aGUgcG9ydCB0aGF0IGRpcmVjdG9yeSBhZG1pbmlzdHJh dGlvbiBzZXJ2ZXIgaXMgdXNpbmc/IDwvcD4KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIE1h eSAyOCwgMjAxNCA4OjI1IFBNLCAmcXVvdDtOb3Jpa28gSG9zb2kmcXVvdDsgJmx0OzxhIGhyZWY9 Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNvbSI+bmhvc29pQHJlZGhhdC5jb208L2E+Jmd0OyB3cm90 ZTo8YnIgdHlwZT0iYXR0cmlidXRpb24iPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRp bmctbGVmdDoxZXgiPgoKICAKICAgIAogIAogIDxkaXYgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0i IzAwMDAwMCI+CiAgICA8ZGl2PkhlbGxvLCBhcyB5b3UgbWVudGlvbmVkLCBhbGwgb2YgdGhlCiAg ICAgIENWRXMgYXJlIHF1aXRlIG9sZCAob2xkZXIgdGhhbiBSSEVMLTYpLsKgIEZvciBpbnN0YW5j ZSwgdGhlIGxhc3QKICAgICAgb25lIENWRS0yMDA5LTE5NTYgd2FzIGZpeGVkIGluIGFwci11dGls LTEuMi43LTcuZWw1XzMuMS7CoCBBcyBsb25nCiAgICAgIGFzIHlvdSB1c2UgUkhFTC02LCB0aGUg Q1ZFcyB5b3UgbGlzdGVkIGFyZSBhbGwgZml4ZWQuwqAgQWxzbywKICAgICAgcGxlYXNlIG5vdGUg dGhhdCB0aGUgQ1ZFcyBhcmUgYWxsIGh0dHBkIHJlbGF0ZWQsIG5vdCAzODktZHMuPGJyPgogICAg ICA8YnI+CiAgICAgIDxkaXY+Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ IDwvc3Bhbj48YnI+CiAgICAgICAgQ1ZFLTIwMDgtMDAwNTxicj4KICAgICAgICBDVkUtMjAwNy02 Mzg4PGJyPgogICAgICAgIENWRS0yMDA3LTY0MjI8YnI+CiAgICAgICAgQ1ZFLTIwMDctNjQyMDxi cj4KICAgICAgICBDVkUtMjAwNy01MDAwPGJyPgogICAgICAgIENWRS0yMDA3LTY0MjE8YnI+CiAg ICAgICAgQ1ZFLTIwMDgtMTY3ODwvZGl2PgogICAgICA8YnI+CiAgICAgIDxkaXY+Q1ZFLTIwMDct MTg2Mjxicj4KICAgICAgICBDVkUtMjAwNy0zODQ3PGJyPgogICAgICAgIENWRS0yMDA3LTMzMDQ8 YnI+CiAgICAgICAgQ1ZFLTIwMDYtNTc1Mjxicj4KICAgICAgICBDVkUtMjAwNy0xODYzPGJyPgog ICAgICA8L2Rpdj4KICAgICAgPGJyPgogICAgICA8ZGl2PkNWRS0yMDA5LTE4OTE8YnI+CiAgICAg ICAgQ1ZFLTIwMDktMTk1NTxicj4KICAgICAgICBDVkUtMjAwOS0xMTkxPGJyPgogICAgICAgIENW RS0yMDA5LTAwMjM8YnI+CiAgICAgICAgQ1ZFLTIwMDktMTk1Njxicj4KICAgICAgICBDVkUtMjAw OS0xMTk1PGJyPgogICAgICAgIENWRS0yMDA5LTE4OTA8YnI+CiAgICAgIDwvZGl2PgogICAgICA8 YnI+CiAgICAgIEpvaG4gVHJ1bXAgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj4KICAgICAgPGRpdiBkaXI9Imx0ciI+SSBoYXZlIGEgc3lzdGVtIHJ1bm5p bmcgMzg5LWRzIHRoYXQgd2FzIHNjYW5uZWQKICAgICAgICB1c2luZyByZXRuYS4gUmV0bmEgc2hv d2VkIHZ1bG5lcmFiaWxpdGllcyB3aGljaCBhcmUgZmFpcmx5IG9sZC4KICAgICAgICBDYW4gYW55 b25lIGNvbmZpcm0gdGhhdCB0aGVzZSB3ZXJlIGZpeGVkLiBPbmx5IHRoaW5nIHVzaW5nIHBvcnQK ICAgICAgICA5ODMwIGlzIHRoZSBhZG1pbi1zZXJ2LiBCZWxvdyBhcmUgdGhlIHJwbSB2ZXJzaW9u cyBJIGhhdmUKICAgICAgICBpbnN0YWxsZWQgYW5kIHRoZSBDVkUmIzM5O3MgcmV0bmEgc3VwcG9z aWRseSBkZXRlY3RlZC4KICAgICAgICA8ZGl2PgogICAgICAgICAgPGJyPgogICAgICAgIDwvZGl2 PgogICAgICAgIDxkaXY+CiAgICAgICAgICA8ZGl2PjM4OS1hZG1pbnV0aWwtMS4xLjE5LTEuZWw2 Lng4Nl82NDwvZGl2PgogICAgICAgICAgPGRpdj4zODktZHMtY29uc29sZS1kb2MtMS4yLjYtMS5l bDYubm9hcmNoPC9kaXY+CiAgICAgICAgICA8ZGl2PjM4OS1hZG1pbi0xLjEuMzUtMS5lbDYueDg2 XzY0PC9kaXY+CiAgICAgICAgICA8ZGl2PjM4OS1hZG1pbi1jb25zb2xlLTEuMS44LTUuZmMxOS5u b2FyY2g8L2Rpdj4KICAgICAgICAgIDxkaXY+Mzg5LWNvbnNvbGUtMS4xLjctMS5lbDYubm9hcmNo PC9kaXY+CiAgICAgICAgICA8ZGl2PjM4OS1kcy0xLjIuMi0xLmVsNi5ub2FyY2g8L2Rpdj4KICAg ICAgICAgIDxkaXY+Mzg5LWRzLWJhc2UtbGlicy0xLjIuMTEuMjUtMS5lbDYueDg2XzY0PC9kaXY+ CiAgICAgICAgICA8ZGl2PjM4OS1kcy1iYXNlLTEuMi4xMS4yNS0xLmVsNi54ODZfNjQ8L2Rpdj4K ICAgICAgICAgIDxkaXY+Mzg5LWRzZ3ctMS4xLjExLTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAg ICAgPGRpdj4zODktZHMtY29uc29sZS0xLjIuNi0xLmVsNi5ub2FyY2g8L2Rpdj4KICAgICAgICAg IDxkaXY+Mzg5LWFkbWluLWNvbnNvbGUtZG9jLTEuMS44LTUuZmMxOS5ub2FyY2g8L2Rpdj4KICAg ICAgICA8L2Rpdj4KICAgICAgICA8ZGl2Pjxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2 PkF1ZGl0IElEOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj42MzEw PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlZ1bCBJRDo8c3BhbiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPGJyPgogICAgICAgIDwvZGl2 PgogICAgICAgIDxkaXY+CiAgICAgICAgICA8ZGl2PlJpc2sgTGV2ZWw6PHNwYW4gc3R5bGU9Indo aXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk1lZGl1bTwvZGl2PgogICAgICAgICAgPGRpdj5T ZXYgQ29kZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q2F0ZWdv cnkKICAgICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgIDxkaXY+UENJIExldmVsOjxzcGFuIHN0 eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5NZWRpdW0KICAgICAgICAgICAgKEZh aWwpIC0gQ1ZTUyBTY29yZTwvZGl2PgogICAgICAgICAgPGRpdj5DVlNTIFNjb3JlOjxzcGFuIHN0 eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj41CiAgICAgICAgICAgIFtBVjpOL0FD OkwvQXU6Ti9DOk4vSTpOL0E6UF08L2Rpdj4KICAgICAgICAgIDxkaXY+QnVnVHJhcSBJRDxzcGFu IHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj4yNzIzNCwyNjgzOCwyNzIzNiwy NzIzNzwvZGl2PgogICAgICAgICAgPGRpdj5DVkU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4gPC9zcGFuPkNWRS0yMDA4LTAwMDUsQ1ZFLTIwMDctNjM4OCxDVkUtMjAwNy02NDIy LENWRS0yMDA3LTY0PC9kaXY+CiAgICAgICAgICA8ZGl2PjIwLENWRS0yMDA3LTUwMDAsQ1ZFLTIw MDctNjQyMSxDVkUtMjAwOC0xNjc4PC9kaXY+CiAgICAgICAgICA8ZGl2PkNDRTo8c3BhbiBzdHls ZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAgICAgICA8ZGl2 PkV4cGxvaXQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk5vPC9k aXY+CiAgICAgICAgICA8ZGl2PklBVjo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAi PiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAgICAgICA8ZGl2PlNUSUc6PC9kaXY+CiAgICAgICAgICA8 ZGl2PkNvbnRleHQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlRD UDo5ODMwPC9kaXY+CiAgICAgICAgICA8ZGl2PlJlc3VsdDo8c3BhbiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+U3VjY2VzczwvZGl2PgogICAgICAgICAgPGRpdj5UZXN0ZWQg VmFsdWU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPkJSCiAgICAg ICAgICAgIFQgV0IgU2VydmVyOjwvZGl2PgogICAgICAgICAgPGRpdj4oQXBhY2hlKFwoW1tdXild KlwpKT8vKCgyXC4oKDIoXC5bW10wLTddKT8pfCgwKFwuKFtbXTEtNV0/W1tdMC05XXw2W1tdMC0y XSkpPC9kaXY+CiAgICAgICAgICA8ZGl2Pj8pfCgxKFwuLiopPykpKXwoMVwuKCgzKFwuKFtbXTEt M10/W1tdMC05XXw0MCkpPyl8KFtbXTAtMl0oXC4uKik/KSkpfCgwK1wuLiopKTwvZGl2PgogICAg ICAgICAgPGRpdj4oJHxbW11eMC05Ll0oW1tdXihdKlwoW1tdXlJdW1tdXildKlwpKSpbW11eKCld KiQpKTwvZGl2PgogICAgICAgICAgPGRpdj5Gb3VuZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+U2VydmVyOgogICAgICAgICAgICBBcGFjaGUvMi4yIyND b250ZW50LUxlbmd0aDogMzAxIyNDb25uZWN0aW9uOjwvZGl2PgogICAgICAgICAgPGRpdj5jbG9z ZSMjQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7PC9kaXY+CiAgICAgICAgICA8ZGl2PmNoYXJzZXRb PV1pc28tODg1OS0xIyMjIyZsdDshRE9DVFlQRSBIVE1MIFBVQkxJQzwvZGl2PgogICAgICAgICAg PGRpdj4mcXVvdDstLy9JRVRGLy9EVEQgSFRNTAogICAgICAgICAgICAyLjAvL0VOJnF1b3Q7Jmd0 OyMmbHQ7aHRtbCZndDsmbHQ7aGVhZCZndDsjJmx0O3RpdGxlJmd0OzQwNCBOb3Q8L2Rpdj4KICAg ICAgICAgIDxkaXY+Rm91bmQmbHQ7L3RpdGxlJmd0OyMmbHQ7L2hlYWQmZ3Q7Jmx0O2JvZHkmZ3Q7 IyZsdDtoMSZndDtOb3QKICAgICAgICAgICAgRm91bmQmbHQ7L2gxJmd0O8KgPC9kaXY+CiAgICAg ICAgICA8ZGl2Pih0cnVuY2F0ZWQuLi4pPC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGRp dj48YnI+CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGRpdj4KICAgICAgICAgIDxkaXY+QXVkaXQg SUQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjYwNTk8c3BhbiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+VnVsIElEOjxzcGFuIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgIDxkaXY+Umlz ayBMZXZlbDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+TWVkaXVt PC9kaXY+CiAgICAgICAgICA8ZGl2PlNldiBDb2RlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUtd3JhcCI+IDwvc3Bhbj5DYXRlZ29yeQogICAgICAgICAgICBJSTwvZGl2PgogICAgICAgICAg PGRpdj5QQ0kgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFu Pk1lZGl1bQogICAgICAgICAgICAoRmFpbCkgLSBDVlNTIFNjb3JlPC9kaXY+CiAgICAgICAgICA8 ZGl2PkNWU1MgU2NvcmU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFu PjUKICAgICAgICAgICAgW0FWOk4vQUM6TC9BdTpOL0M6UC9JOk4vQTpOXTwvZGl2PgogICAgICAg ICAgPGRpdj5CdWdUcmFxIElEPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9z cGFuPjI0MjE1LDI0NjQ1LDI1NDg5LDI0NjQ5LDI0NTUzPC9kaXY+CiAgICAgICAgICA8ZGl2PkNW RTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIwMDctMTg2 MixDVkUtMjAwNy0zODQ3LENWRS0yMDA3LTMzMDQsQ1ZFLTIwMDYtNTc8L2Rpdj4KICAgICAgICAg IDxkaXY+NTIsQ1ZFLTIwMDctMTg2MzwvZGl2PgogICAgICAgICAgPGRpdj5DQ0U6PHNwYW4gc3R5 bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgPGRp dj5FeHBsb2l0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5Obzwv ZGl2PgogICAgICAgICAgPGRpdj5JQVY6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAgICAg PGRpdj5Db250ZXh0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5U Q1A6OTgzMDwvZGl2PgogICAgICAgICAgPGRpdj5SZXN1bHQ6PHNwYW4gc3R5bGU9IndoaXRlLXNw YWNlOnByZS13cmFwIj4gPC9zcGFuPlN1Y2Nlc3M8L2Rpdj4KICAgICAgICAgIDxkaXY+VGVzdGVk IFZhbHVlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5SUgogICAg ICAgICAgICBUIFdCPC9kaXY+CiAgICAgICAgICA8ZGl2PihBcGFjaGUoXChbW11eKV0qXCkpPy8o MlwuMihcLltbXTAtNV0pPykoJHxbW11eMC05Ll0oW1tdXihdKlwoW1tdXlJdW1tdXildKlwpPC9k aXY+CiAgICAgICAgICA8ZGl2PikqW1tdXigpXSokKSk8L2Rpdj4KICAgICAgICAgIDxkaXY+Rm91 bmQgVmFsdWU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPkFwYWNo ZS8yLjI8L2Rpdj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2Pjxicj4KICAgICAgICA8L2Rp dj4KICAgICAgICA8ZGl2PgogICAgICAgICAgPGRpdj4KICAgICAgICAgICAgQXVkaXQgSUQ6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjk4MjA8c3BhbiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+VnVsIElEOjxzcGFuIHN0eWxlPSJ3aGl0ZS1z cGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgIDxkaXY+UmlzayBMZXZl bDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+TWVkaXVtPC9kaXY+ CiAgICAgICAgICA8ZGl2PlNldiBDb2RlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3Jh cCI+IDwvc3Bhbj5DYXRlZ29yeQogICAgICAgICAgICBJSTwvZGl2PgogICAgICAgICAgPGRpdj5Q Q0kgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPkhpZ2gK ICAgICAgICAgICAgKEZhaWwpIC0gQ1ZTUyBTY29yZTwvZGl2PgogICAgICAgICAgPGRpdj5DVlNT IFNjb3JlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj43LjgKICAg ICAgICAgICAgW0FWOk4vQUM6TC9BdTpOL0M6Ti9JOk4vQTpDXTwvZGl2PgogICAgICAgICAgPGRp dj5CdWdUcmFxIElEPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjM1 NTY1LDM1MjUzLDM1NjIzLDM1MjUxLDM0NjYzLDM1MjIxLDM1MTE1PC9kaXY+CiAgICAgICAgICA8 ZGl2PkNWRTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIw MDktMTg5MSxDVkUtMjAwOS0xOTU1LENWRS0yMDA5LTExOTEsQ1ZFLTIwMDktMDA8L2Rpdj4KICAg ICAgICAgIDxkaXY+MjMsQ1ZFLTIwMDktMTk1NixDVkUtMjAwOS0xMTk1LENWRS0yMDA5LTE4OTA8 L2Rpdj4KICAgICAgICAgIDxkaXY+Q0NFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3Jh cCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgIDxkaXY+RXhwbG9pdDo8c3BhbiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+WWVzPC9kaXY+CiAgICAgICAgICA8ZGl2PklB Vjo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAg ICAgICAgICA8ZGl2PlNUSUc6PC9kaXY+CiAgICAgICAgICA8ZGl2PkNvbnRleHQ6PHNwYW4gc3R5 bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlRDUDo5ODMwPC9kaXY+CiAgICAgICAg ICA8ZGl2PlJlc3VsdDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+ U3VjY2VzczwvZGl2PgogICAgICAgICAgPGRpdj5UZXN0ZWQgVmFsdWU6PHNwYW4gc3R5bGU9Indo aXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPkFQQUNIRSgtQURWQU5DRURFWFRSQU5FVFNFUlZF Uik/LzJcLjIoXC4oMVtbXTAxXXxbW10wPC9kaXY+CiAgICAgICAgICA8ZGl2Pi05XSkoXC5bW10w LTldKykqKT8oJHxbW11eMC05Ll0pPC9kaXY+CiAgICAgICAgICA8ZGl2PkZvdW5kIFZhbHVlOjxz cGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5BUEFDSEUvMi4yPC9kaXY+ CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGRpdj48YnI+CiAgICAgICAgPC9kaXY+CiAgICAgICAg PGRpdj48YnI+CiAgICAgICAgPC9kaXY+CiAgICAgIDwvZGl2PgogICAgICA8YnI+CiAgICAgIDxm aWVsZHNldD48L2ZpZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxwcmU+LS0KMzg5IHVzZXJzIG1h aWxpbmcgbGlzdAo8YSBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qu b3JnIiB0YXJnZXQ9Il9ibGFuayI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9h Pgo8YSBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGlu Zm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0 Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48L3ByZT4KICAgIDwvYmxvY2txdW90 ZT4KICAgIDxicj4KICA8L2Rpdj4KCjxicj4tLTxicj4KMzg5IHVzZXJzIG1haWxpbmcgbGlzdDxi cj4KPGEgaHJlZj0ibWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyI+Mzg5 LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9h ZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5m by8zODktdXNlcnM8L2E+PGJyPjwvYmxvY2txdW90ZT48L2Rpdj4K --===============3100921541561077073==-- From nhosoi at redhat.com Thu May 29 15:59:11 2014 Content-Type: multipart/mixed; boundary="===============7204842063851627966==" MIME-Version: 1.0 From: Noriko Hosoi To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 08:59:05 -0700 Message-ID: <53875949.8070303@redhat.com> In-Reply-To: CANd=zChU_-9D0j5QkmeUC4UK6s-1yszbQ--svFwtgKLxP-7o=Q@mail.gmail.com --===============7204842063851627966== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sorry, I don't know what the tool does. You may want to ask the tool's = provider the question. Thanks. John Trump wrote: > > I am running RHEL 6. Why does the scan show the vulnerabilities on the = > port that directory administration server is using? > > On May 28, 2014 8:25 PM, "Noriko Hosoi" > wrote: > > Hello, as you mentioned, all of the CVEs are quite old (older than > RHEL-6). For instance, the last one CVE-2009-1956 was fixed in > apr-util-1.2.7-7.el5_3.1. As long as you use RHEL-6, the CVEs you > listed are all fixed. Also, please note that the CVEs are all > httpd related, not 389-ds. > > CVE: > CVE-2008-0005 > CVE-2007-6388 > CVE-2007-6422 > CVE-2007-6420 > CVE-2007-5000 > CVE-2007-6421 > CVE-2008-1678 > > CVE-2007-1862 > CVE-2007-3847 > CVE-2007-3304 > CVE-2006-5752 > CVE-2007-1863 > > CVE-2009-1891 > CVE-2009-1955 > CVE-2009-1191 > CVE-2009-0023 > CVE-2009-1956 > CVE-2009-1195 > CVE-2009-1890 > > John Trump wrote: >> I have a system running 389-ds that was scanned using retna. >> Retna showed vulnerabilities which are fairly old. Can anyone >> confirm that these were fixed. Only thing using port 9830 is the >> admin-serv. Below are the rpm versions I have installed and the >> CVE's retna supposidly detected. >> >> 389-adminutil-1.1.19-1.el6.x86_64 >> 389-ds-console-doc-1.2.6-1.el6.noarch >> 389-admin-1.1.35-1.el6.x86_64 >> 389-admin-console-1.1.8-5.fc19.noarch >> 389-console-1.1.7-1.el6.noarch >> 389-ds-1.2.2-1.el6.noarch >> 389-ds-base-libs-1.2.11.25-1.el6.x86_64 >> 389-ds-base-1.2.11.25-1.el6.x86_64 >> 389-dsgw-1.1.11-1.el6.x86_64 >> 389-ds-console-1.2.6-1.el6.noarch >> 389-admin-console-doc-1.1.8-5.fc19.noarch >> >> Audit ID:6310Vul ID:N/A >> Risk Level:Medium >> Sev Code:Category II >> PCI Level:Medium (Fail) - CVSS Score >> CVSS Score:5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] >> BugTraq ID27234,26838,27236,27237 >> CVE:CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 >> 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 >> CCE:N/A >> Exploit:No >> IAV:N/A >> STIG: >> Context:TCP:9830 >> Result:Success >> Tested Value:BR T WB Server: >> (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[= []0-2])) >> ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))= |(0+\..*)) >> ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) >> Found Value:Server: Apache/2.2##Content-Length: 301##Connection: >> close##Content-Type: text/html; >> charset[=3D]iso-8859-1####> "-//IETF//DTD HTML 2.0//EN">##404 Not >> Found##

Not Found

>> (truncated...) >> >> Audit ID:6059Vul ID:N/A >> Risk Level:Medium >> Sev Code:Category II >> PCI Level:Medium (Fail) - CVSS Score >> CVSS Score:5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] >> BugTraq ID24215,24645,25489,24649,24553 >> CVE:CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 >> 52,CVE-2007-1863 >> CCE:N/A >> Exploit:No >> IAV:N/A >> STIG: >> Context:TCP:9830 >> Result:Success >> Tested Value:RR T WB >> (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R]= [[]^)]*\) >> )*[[]^()]*$)) >> Found Value:Apache/2.2 >> >> Audit ID:9820Vul ID:N/A >> Risk Level:Medium >> Sev Code:Category II >> PCI Level:High (Fail) - CVSS Score >> CVSS Score:7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] >> BugTraq ID35565,35253,35623,35251,34663,35221,35115 >> CVE:CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 >> 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 >> CCE:N/A >> Exploit:Yes >> IAV:N/A >> STIG: >> Context:TCP:9830 >> Result:Success >> Tested Value:APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 >> -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) >> Found Value:APACHE/2.2 >> >> >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users --===============7204842063851627966== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5Tb3JyeSwgSSBkb24ndCBrbm93IHdoYXQgdGhlIHRvb2wKICAgICAgZG9lcy7CoCBZb3UgbWF5 IHdhbnQgdG8gYXNrIHRoZSB0b29sJ3MgcHJvdmlkZXIgdGhlIHF1ZXN0aW9uLjxicj4KICAgICAg VGhhbmtzLjxicj4KICAgICAgPGJyPgogICAgICBKb2huIFRydW1wIHdyb3RlOjxicj4KICAgIDwv ZGl2PgogICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOkNBTmQ9ekNoVV8tOUQwajVRa21lVUM0VUs2 cy0xeXN6YlEtLXN2Rnd0Z0tMeFAtN289UUBtYWlsLmdtYWlsLmNvbSIKICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgIDxwIGRpcj0ibHRyIj5JIGFtIHJ1bm5pbmcgUkhFTCA2LiBXaHkgZG9lcyB0aGUg c2NhbiBzaG93IHRoZQogICAgICAgIHZ1bG5lcmFiaWxpdGllcyBvbiB0aGUgcG9ydCB0aGF0IGRp cmVjdG9yeSBhZG1pbmlzdHJhdGlvbiBzZXJ2ZXIKICAgICAgICBpcyB1c2luZz8gPC9wPgogICAg ICA8ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gTWF5IDI4LCAyMDE0IDg6MjUgUE0sICJOb3Jp a28gSG9zb2kiCiAgICAgICAgJmx0OzxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgaHJlZj0ibWFp bHRvOm5ob3NvaUByZWRoYXQuY29tIj5uaG9zb2lAcmVkaGF0LmNvbTwvYT4mZ3Q7CiAgICAgICAg d3JvdGU6PGJyIHR5cGU9ImF0dHJpYnV0aW9uIj4KICAgICAgICA8YmxvY2txdW90ZSBjbGFzcz0i Z21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAKICAgICAgICAgIC44ZXg7Ym9yZGVyLWxl ZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAgICAgICAgICA8ZGl2IGJnY29s b3I9IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgICAgICAgICA8ZGl2PkhlbGxvLCBhcyB5 b3UgbWVudGlvbmVkLCBhbGwgb2YgdGhlIENWRXMgYXJlIHF1aXRlIG9sZAogICAgICAgICAgICAg IChvbGRlciB0aGFuIFJIRUwtNikuwqAgRm9yIGluc3RhbmNlLCB0aGUgbGFzdCBvbmUKICAgICAg ICAgICAgICBDVkUtMjAwOS0xOTU2IHdhcyBmaXhlZCBpbiBhcHItdXRpbC0xLjIuNy03LmVsNV8z LjEuwqAgQXMKICAgICAgICAgICAgICBsb25nIGFzIHlvdSB1c2UgUkhFTC02LCB0aGUgQ1ZFcyB5 b3UgbGlzdGVkIGFyZSBhbGwKICAgICAgICAgICAgICBmaXhlZC7CoCBBbHNvLCBwbGVhc2Ugbm90 ZSB0aGF0IHRoZSBDVkVzIGFyZSBhbGwgaHR0cGQKICAgICAgICAgICAgICByZWxhdGVkLCBub3Qg Mzg5LWRzLjxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGRpdj5DVkU6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjxicj4KICAgICAgICAgICAg ICAgIENWRS0yMDA4LTAwMDU8YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwNy02Mzg4PGJyPgog ICAgICAgICAgICAgICAgQ1ZFLTIwMDctNjQyMjxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA3 LTY0MjA8YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwNy01MDAwPGJyPgogICAgICAgICAgICAg ICAgQ1ZFLTIwMDctNjQyMTxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA4LTE2Nzg8L2Rpdj4K ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGRpdj5DVkUtMjAwNy0xODYyPGJyPgog ICAgICAgICAgICAgICAgQ1ZFLTIwMDctMzg0Nzxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA3 LTMzMDQ8YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwNi01NzUyPGJyPgogICAgICAgICAgICAg ICAgQ1ZFLTIwMDctMTg2Mzxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgPGRpdj5DVkUtMjAwOS0xODkxPGJyPgogICAgICAgICAgICAgICAg Q1ZFLTIwMDktMTk1NTxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA5LTExOTE8YnI+CiAgICAg ICAgICAgICAgICBDVkUtMjAwOS0wMDIzPGJyPgogICAgICAgICAgICAgICAgQ1ZFLTIwMDktMTk1 Njxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA5LTExOTU8YnI+CiAgICAgICAgICAgICAgICBD VkUtMjAwOS0xODkwPGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICBKb2huIFRydW1wIHdyb3RlOjxicj4KICAgICAgICAgICAgPC9kaXY+CiAg ICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgIDxkaXYgZGly PSJsdHIiPkkgaGF2ZSBhIHN5c3RlbSBydW5uaW5nIDM4OS1kcyB0aGF0IHdhcwogICAgICAgICAg ICAgICAgc2Nhbm5lZCB1c2luZyByZXRuYS4gUmV0bmEgc2hvd2VkIHZ1bG5lcmFiaWxpdGllcyB3 aGljaAogICAgICAgICAgICAgICAgYXJlIGZhaXJseSBvbGQuIENhbiBhbnlvbmUgY29uZmlybSB0 aGF0IHRoZXNlIHdlcmUKICAgICAgICAgICAgICAgIGZpeGVkLiBPbmx5IHRoaW5nIHVzaW5nIHBv cnQgOTgzMCBpcyB0aGUgYWRtaW4tc2Vydi4KICAgICAgICAgICAgICAgIEJlbG93IGFyZSB0aGUg cnBtIHZlcnNpb25zIEkgaGF2ZSBpbnN0YWxsZWQgYW5kIHRoZQogICAgICAgICAgICAgICAgQ1ZF J3MgcmV0bmEgc3VwcG9zaWRseSBkZXRlY3RlZC4KICAgICAgICAgICAgICAgIDxkaXY+IDxicj4K ICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAg ICAgICAgPGRpdj4zODktYWRtaW51dGlsLTEuMS4xOS0xLmVsNi54ODZfNjQ8L2Rpdj4KICAgICAg ICAgICAgICAgICAgPGRpdj4zODktZHMtY29uc29sZS1kb2MtMS4yLjYtMS5lbDYubm9hcmNoPC9k aXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWFkbWluLTEuMS4zNS0xLmVsNi54ODZfNjQ8 L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4zODktYWRtaW4tY29uc29sZS0xLjEuOC01LmZj MTkubm9hcmNoPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWNvbnNvbGUtMS4xLjct MS5lbDYubm9hcmNoPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWRzLTEuMi4yLTEu ZWw2Lm5vYXJjaDwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1kcy1iYXNlLWxpYnMt MS4yLjExLjI1LTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1k cy1iYXNlLTEuMi4xMS4yNS0xLmVsNi54ODZfNjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRp dj4zODktZHNndy0xLjEuMTEtMS5lbDYueDg2XzY0PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxk aXY+Mzg5LWRzLWNvbnNvbGUtMS4yLjYtMS5lbDYubm9hcmNoPC9kaXY+CiAgICAgICAgICAgICAg ICAgIDxkaXY+Mzg5LWFkbWluLWNvbnNvbGUtZG9jLTEuMS44LTUuZmMxOS5ub2FyY2g8L2Rpdj4K ICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRpdj48YnI+CiAgICAgICAg ICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgIDxkaXY+QXVkaXQgSUQ6PHNwYW4gc3R5bGU9 IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjYzMTA8c3BhbgogICAgICAgICAgICAgICAg ICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5WdWwgSUQ6PHNwYW4KICAg ICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9B PGJyPgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAg ICAgICAgICAgICA8ZGl2PlJpc2sgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPk1lZGl1bTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PlNldiBDb2Rl OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5DYXRlZ29yeQoKICAg ICAgICAgICAgICAgICAgICBJSTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PlBDSSBMZXZl bDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+TWVkaXVtCgogICAg ICAgICAgICAgICAgICAgIChGYWlsKSAtIENWU1MgU2NvcmU8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj5DVlNTIFNjb3JlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwv c3Bhbj41CiAgICAgICAgICAgICAgICAgICAgW0FWOk4vQUM6TC9BdTpOL0M6Ti9JOk4vQTpQXTwv ZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkJ1Z1RyYXEgSUQ8c3BhbiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+MjcyMzQsMjY4MzgsMjcyMzYsMjcyMzc8L2Rpdj4KICAg ICAgICAgICAgICAgICAgPGRpdj5DVkU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPkNWRS0yMDA4LTAwMDUsQ1ZFLTIwMDctNjM4OCxDVkUtMjAwNy02NDIyLENWRS0y MDA3LTY0PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+MjAsQ1ZFLTIwMDctNTAwMCxDVkUt MjAwNy02NDIxLENWRS0yMDA4LTE2Nzg8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5DQ0U6 PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAg ICAgICAgICAgICAgICA8ZGl2PkV4cGxvaXQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPk5vPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+SUFWOjxzcGFuIHN0 eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAg ICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkNvbnRleHQ6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlRDUDo5ODMwPC9kaXY+CiAg ICAgICAgICAgICAgICAgIDxkaXY+UmVzdWx0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUt d3JhcCI+IDwvc3Bhbj5TdWNjZXNzPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+VGVzdGVk IFZhbHVlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+CiAgICAgICAgICAgICAg ICAgICAgPC9zcGFuPkJSIFQgV0IgU2VydmVyOjwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2 PihBcGFjaGUoXChbW11eKV0qXCkpPy8oKDJcLigoMihcLltbXTAtN10pPyl8KDAoXC4oW1tdMS01 XT9bW10wLTldfDZbW10wLTJdKSk8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4/KXwoMShc Li4qKT8pKSl8KDFcLigoMyhcLihbW10xLTNdP1tbXTAtOV18NDApKT8pfChbW10wLTJdKFwuLiop PykpKXwoMCtcLi4qKSk8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4oJHxbW11eMC05Ll0o W1tdXihdKlwoW1tdXlJdW1tdXildKlwpKSpbW11eKCldKiQpKTwvZGl2PgogICAgICAgICAgICAg ICAgICA8ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ IDwvc3Bhbj5TZXJ2ZXI6CgogICAgICAgICAgICAgICAgICAgIEFwYWNoZS8yLjIjI0NvbnRlbnQt TGVuZ3RoOiAzMDEjI0Nvbm5lY3Rpb246PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Y2xv c2UjI0NvbnRlbnQtVHlwZTogdGV4dC9odG1sOzwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2 PmNoYXJzZXRbPV1pc28tODg1OS0xIyMjIyZsdDshRE9DVFlQRSBIVE1MIFBVQkxJQzwvZGl2Pgog ICAgICAgICAgICAgICAgICA8ZGl2PiItLy9JRVRGLy9EVEQgSFRNTAogICAgICAgICAgICAgICAg ICAgIDIuMC8vRU4iJmd0OyMmbHQ7aHRtbCZndDsmbHQ7aGVhZCZndDsjJmx0O3RpdGxlJmd0OzQw NAogICAgICAgICAgICAgICAgICAgIE5vdDwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkZv dW5kJmx0Oy90aXRsZSZndDsjJmx0Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyMmbHQ7aDEmZ3Q7Tm90 CgogICAgICAgICAgICAgICAgICAgIEZvdW5kJmx0Oy9oMSZndDvCoDwvZGl2PgogICAgICAgICAg ICAgICAgICA8ZGl2Pih0cnVuY2F0ZWQuLi4pPC9kaXY+CiAgICAgICAgICAgICAgICA8L2Rpdj4K ICAgICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAg ICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkF1ZGl0IElEOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj42MDU5PHNwYW4KICAgICAgICAgICAgICAg ICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5WdWwgSUQ6PHNwYW4K ICAgICAgICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bh bj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5SaXNrIExldmVsOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5NZWRpdW08L2Rpdj4KICAgICAgICAgICAg ICAgICAgPGRpdj5TZXYgQ29kZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8 L3NwYW4+Q2F0ZWdvcnkKCiAgICAgICAgICAgICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgICAg ICAgICAgPGRpdj5QQ0kgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4g PC9zcGFuPk1lZGl1bQoKICAgICAgICAgICAgICAgICAgICAoRmFpbCkgLSBDVlNTIFNjb3JlPC9k aXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+NQogICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwv QXU6Ti9DOlAvSTpOL0E6Tl08L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5CdWdUcmFxIElE PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjI0MjE1LDI0NjQ1LDI1 NDg5LDI0NjQ5LDI0NTUzPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZFOjxzcGFuIHN0 eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5DVkUtMjAwNy0xODYyLENWRS0yMDA3 LTM4NDcsQ1ZFLTIwMDctMzMwNCxDVkUtMjAwNi01NzwvZGl2PgogICAgICAgICAgICAgICAgICA8 ZGl2PjUyLENWRS0yMDA3LTE4NjM8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5DQ0U6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAg ICAgICAgICAgICA8ZGl2PkV4cGxvaXQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPk5vPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+SUFWOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkNvbnRleHQ6PHNwYW4g c3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlRDUDo5ODMwPC9kaXY+CiAgICAg ICAgICAgICAgICAgIDxkaXY+UmVzdWx0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3Jh cCI+IDwvc3Bhbj5TdWNjZXNzPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+VGVzdGVkIFZh bHVlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+CiAgICAgICAgICAgICAgICAg ICAgPC9zcGFuPlJSIFQgV0I8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4oQXBhY2hlKFwo W1tdXildKlwpKT8vKDJcLjIoXC5bW10wLTVdKT8pKCR8W1tdXjAtOS5dKFtbXV4oXSpcKFtbXV5S XVtbXV4pXSpcKTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PikqW1tdXigpXSokKSk8L2Rp dj4KICAgICAgICAgICAgICAgICAgPGRpdj5Gb3VuZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+QXBhY2hlLzIuMjwvZGl2PgogICAgICAgICAgICAgICAg PC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2Pgog ICAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4gQXVkaXQgSUQ6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjk4MjA8c3BhbgogICAgICAg ICAgICAgICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlZ1bCBJ RDo8c3BhbgogICAgICAgICAgICAgICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PlJpc2sgTGV2ZWw6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk1lZGl1bTwvZGl2PgogICAg ICAgICAgICAgICAgICA8ZGl2PlNldiBDb2RlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUt d3JhcCI+IDwvc3Bhbj5DYXRlZ29yeQoKICAgICAgICAgICAgICAgICAgICBJSTwvZGl2PgogICAg ICAgICAgICAgICAgICA8ZGl2PlBDSSBMZXZlbDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl LXdyYXAiPiA8L3NwYW4+SGlnaAoKICAgICAgICAgICAgICAgICAgICAoRmFpbCkgLSBDVlNTIFNj b3JlPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ny44CgogICAgICAgICAgICAgICAgICAgIFtB VjpOL0FDOkwvQXU6Ti9DOk4vSTpOL0E6Q108L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5C dWdUcmFxIElEPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjM1NTY1 LDM1MjUzLDM1NjIzLDM1MjUxLDM0NjYzLDM1MjIxLDM1MTE1PC9kaXY+CiAgICAgICAgICAgICAg ICAgIDxkaXY+Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5D VkUtMjAwOS0xODkxLENWRS0yMDA5LTE5NTUsQ1ZFLTIwMDktMTE5MSxDVkUtMjAwOS0wMDwvZGl2 PgogICAgICAgICAgICAgICAgICA8ZGl2PjIzLENWRS0yMDA5LTE5NTYsQ1ZFLTIwMDktMTE5NSxD VkUtMjAwOS0xODkwPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Q0NFOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj5FeHBsb2l0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bh bj5ZZXM8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5JQVY6PHNwYW4gc3R5bGU9IndoaXRl LXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2 PlNUSUc6PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Q29udGV4dDo8c3BhbiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+VENQOjk4MzA8L2Rpdj4KICAgICAgICAgICAg ICAgICAgPGRpdj5SZXN1bHQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9z cGFuPlN1Y2Nlc3M8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5UZXN0ZWQgVmFsdWU6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4KICAgICAgICAgICAgICAgICAgICA8L3Nw YW4+QVBBQ0hFKC1BRFZBTkNFREVYVFJBTkVUU0VSVkVSKT8vMlwuMihcLigxW1tdMDFdfFtbXTA8 L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4tOV0pKFwuW1tdMC05XSspKik/KCR8W1tdXjAt OS5dKTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5BUEFDSEUvMi4yPC9kaXY+CiAgICAgICAg ICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAg PC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2Pgog ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8Zmll bGRzZXQ+PC9maWVsZHNldD4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPHByZT4t LQozODkgdXNlcnMgbWFpbGluZyBsaXN0CjxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgaHJlZj0i bWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsi PjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZzwvYT4KPGEgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIiBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlz dGluZm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9q ZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48L3ByZT4KICAgICAgICAgICAg PC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAg IDxicj4KICAgICAgICAgIC0tPGJyPgogICAgICAgICAgMzg5IHVzZXJzIG1haWxpbmcgbGlzdDxi cj4KICAgICAgICAgIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgaHJlZj0i bWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJzQGxpc3Rz LmZlZG9yYXByb2plY3Qub3JnPC9hPjxicj4KICAgICAgICAgIDxhIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSIKICAgICAgICAgICAgaHJlZj0iaHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9t YWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIKICAgICAgICAgICAgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8 L2E+PGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPC9kaXY+CiAgICAgIDxicj4KICAg ICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAg ICAgPGJyPgogICAgICA8cHJlIHdyYXA9IiI+LS0KMzg5IHVzZXJzIG1haWxpbmcgbGlzdAo8YSBj bGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxp c3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8 L2E+CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vYWRtaW4u ZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiPmh0dHBzOi8vYWRt aW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8L2E+PC9wcmU+ CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============7204842063851627966==-- From trumpjk at gmail.com Thu May 29 16:21:46 2014 Content-Type: multipart/mixed; boundary="===============6913838581066341408==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 12:21:43 -0400 Message-ID: In-Reply-To: 53875949.8070303@redhat.com --===============6913838581066341408== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Does the admin server or admin console run a webserver? On May 29, 2014 11:59 AM, "Noriko Hosoi" wrote: > Sorry, I don't know what the tool does. You may want to ask the tool's > provider the question. > Thanks. > > John Trump wrote: > > I am running RHEL 6. Why does the scan show the vulnerabilities on the > port that directory administration server is using? > On May 28, 2014 8:25 PM, "Noriko Hosoi" wrote: > >> Hello, as you mentioned, all of the CVEs are quite old (older than >> RHEL-6). For instance, the last one CVE-2009-1956 was fixed in >> apr-util-1.2.7-7.el5_3.1. As long as you use RHEL-6, the CVEs you listed >> are all fixed. Also, please note that the CVEs are all httpd related, n= ot >> 389-ds. >> >> CVE: >> CVE-2008-0005 >> CVE-2007-6388 >> CVE-2007-6422 >> CVE-2007-6420 >> CVE-2007-5000 >> CVE-2007-6421 >> CVE-2008-1678 >> >> CVE-2007-1862 >> CVE-2007-3847 >> CVE-2007-3304 >> CVE-2006-5752 >> CVE-2007-1863 >> >> CVE-2009-1891 >> CVE-2009-1955 >> CVE-2009-1191 >> CVE-2009-0023 >> CVE-2009-1956 >> CVE-2009-1195 >> CVE-2009-1890 >> >> John Trump wrote: >> >> I have a system running 389-ds that was scanned using retna. Retna showed >> vulnerabilities which are fairly old. Can anyone confirm that these were >> fixed. Only thing using port 9830 is the admin-serv. Below are the rpm >> versions I have installed and the CVE's retna supposidly detected. >> >> 389-adminutil-1.1.19-1.el6.x86_64 >> 389-ds-console-doc-1.2.6-1.el6.noarch >> 389-admin-1.1.35-1.el6.x86_64 >> 389-admin-console-1.1.8-5.fc19.noarch >> 389-console-1.1.7-1.el6.noarch >> 389-ds-1.2.2-1.el6.noarch >> 389-ds-base-libs-1.2.11.25-1.el6.x86_64 >> 389-ds-base-1.2.11.25-1.el6.x86_64 >> 389-dsgw-1.1.11-1.el6.x86_64 >> 389-ds-console-1.2.6-1.el6.noarch >> 389-admin-console-doc-1.1.8-5.fc19.noarch >> >> Audit ID: 6310 Vul ID: N/A >> Risk Level: Medium >> Sev Code: Category II >> PCI Level: Medium (Fail) - CVSS Score >> CVSS Score: 5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] >> BugTraq ID 27234,26838,27236,27237 >> CVE: CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 >> 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 >> CCE: N/A >> Exploit: No >> IAV: N/A >> STIG: >> Context: TCP:9830 >> Result: Success >> Tested Value: BR T WB Server: >> >> (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-= 2])) >> >> ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+= \..*)) >> ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) >> Found Value: Server: Apache/2.2##Content-Length: 301##Connection: >> close##Content-Type: text/html; >> charset[=3D]iso-8859-1####> "-//IETF//DTD HTML 2.0//EN">##404 Not >> Found##

Not Found

>> (truncated...) >> >> Audit ID: 6059 Vul ID: N/A >> Risk Level: Medium >> Sev Code: Category II >> PCI Level: Medium (Fail) - CVSS Score >> CVSS Score: 5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] >> BugTraq ID 24215,24645,25489,24649,24553 >> CVE: CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 >> 52,CVE-2007-1863 >> CCE: N/A >> Exploit: No >> IAV: N/A >> STIG: >> Context: TCP:9830 >> Result: Success >> Tested Value: RR T WB >> >> (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]^= )]*\) >> )*[[]^()]*$)) >> Found Value: Apache/2.2 >> >> Audit ID: 9820 Vul ID: N/A >> Risk Level: Medium >> Sev Code: Category II >> PCI Level: High (Fail) - CVSS Score >> CVSS Score: 7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] >> BugTraq ID 35565,35253,35623,35251,34663,35221,35115 >> CVE: CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 >> 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 >> CCE: N/A >> Exploit: Yes >> IAV: N/A >> STIG: >> Context: TCP:9830 >> Result: Success >> Tested Value: APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 >> -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) >> Found Value: APACHE/2.2 >> >> >> >> >> -- >> 389 users mailing list389-users(a)lists.fedoraproject.orghttps://admin.f= edoraproject.org/mailman/listinfo/389-users >> >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users >> > > > -- > 389 users mailing list389-users(a)lists.fedoraproject.orghttps://admin.fe= doraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > --===============6913838581066341408== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PHAgZGlyPSJsdHIiPkRvZXMgdGhlIGFkbWluIHNlcnZlciBvciBhZG1pbiBjb25zb2xlIHJ1biBh IHdlYnNlcnZlcj88YnI+CjwvcD4KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIE1heSAyOSwg MjAxNCAxMTo1OSBBTSwgJnF1b3Q7Tm9yaWtvIEhvc29pJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWls dG86bmhvc29pQHJlZGhhdC5jb20iPm5ob3NvaUByZWRoYXQuY29tPC9hPiZndDsgd3JvdGU6PGJy IHR5cGU9ImF0dHJpYnV0aW9uIj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxl PSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxl ZnQ6MWV4Ij4KCiAgCiAgICAKICAKICA8ZGl2IGJnY29sb3I9IiNGRkZGRkYiIHRleHQ9IiMwMDAw MDAiPgogICAgPGRpdj5Tb3JyeSwgSSBkb24mIzM5O3Qga25vdyB3aGF0IHRoZSB0b29sCiAgICAg IGRvZXMuwqAgWW91IG1heSB3YW50IHRvIGFzayB0aGUgdG9vbCYjMzk7cyBwcm92aWRlciB0aGUg cXVlc3Rpb24uPGJyPgogICAgICBUaGFua3MuPGJyPgogICAgICA8YnI+CiAgICAgIEpvaG4gVHJ1 bXAgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4KICAg ICAgPHAgZGlyPSJsdHIiPkkgYW0gcnVubmluZyBSSEVMIDYuIFdoeSBkb2VzIHRoZSBzY2FuIHNo b3cgdGhlCiAgICAgICAgdnVsbmVyYWJpbGl0aWVzIG9uIHRoZSBwb3J0IHRoYXQgZGlyZWN0b3J5 IGFkbWluaXN0cmF0aW9uIHNlcnZlcgogICAgICAgIGlzIHVzaW5nPyA8L3A+CiAgICAgIDxkaXYg Y2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBNYXkgMjgsIDIwMTQgODoyNSBQTSwgJnF1b3Q7Tm9yaWtv IEhvc29pJnF1b3Q7CiAgICAgICAgJmx0OzxhIGhyZWY9Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNv bSIgdGFyZ2V0PSJfYmxhbmsiPm5ob3NvaUByZWRoYXQuY29tPC9hPiZndDsKICAgICAgICB3cm90 ZTo8YnIgdHlwZT0iYXR0cmlidXRpb24iPgogICAgICAgIDxibG9ja3F1b3RlIGNsYXNzPSJnbWFp bF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNv bGlkO3BhZGRpbmctbGVmdDoxZXgiPgogICAgICAgICAgPGRpdiBiZ2NvbG9yPSIjRkZGRkZGIiB0 ZXh0PSIjMDAwMDAwIj4KICAgICAgICAgICAgPGRpdj5IZWxsbywgYXMgeW91IG1lbnRpb25lZCwg YWxsIG9mIHRoZSBDVkVzIGFyZSBxdWl0ZSBvbGQKICAgICAgICAgICAgICAob2xkZXIgdGhhbiBS SEVMLTYpLsKgIEZvciBpbnN0YW5jZSwgdGhlIGxhc3Qgb25lCiAgICAgICAgICAgICAgQ1ZFLTIw MDktMTk1NiB3YXMgZml4ZWQgaW4gYXByLXV0aWwtMS4yLjctNy5lbDVfMy4xLsKgIEFzCiAgICAg ICAgICAgICAgbG9uZyBhcyB5b3UgdXNlIFJIRUwtNiwgdGhlIENWRXMgeW91IGxpc3RlZCBhcmUg YWxsCiAgICAgICAgICAgICAgZml4ZWQuwqAgQWxzbywgcGxlYXNlIG5vdGUgdGhhdCB0aGUgQ1ZF cyBhcmUgYWxsIGh0dHBkCiAgICAgICAgICAgICAgcmVsYXRlZCwgbm90IDM4OS1kcy48YnI+CiAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxkaXY+Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj48YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwOC0w MDA1PGJyPgogICAgICAgICAgICAgICAgQ1ZFLTIwMDctNjM4ODxicj4KICAgICAgICAgICAgICAg IENWRS0yMDA3LTY0MjI8YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwNy02NDIwPGJyPgogICAg ICAgICAgICAgICAgQ1ZFLTIwMDctNTAwMDxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA3LTY0 MjE8YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwOC0xNjc4PC9kaXY+CiAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgIDxkaXY+Q1ZFLTIwMDctMTg2Mjxicj4KICAgICAgICAgICAgICAg IENWRS0yMDA3LTM4NDc8YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwNy0zMzA0PGJyPgogICAg ICAgICAgICAgICAgQ1ZFLTIwMDYtNTc1Mjxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA3LTE4 NjM8YnI+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgIDxkaXY+Q1ZFLTIwMDktMTg5MTxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA5LTE5NTU8 YnI+CiAgICAgICAgICAgICAgICBDVkUtMjAwOS0xMTkxPGJyPgogICAgICAgICAgICAgICAgQ1ZF LTIwMDktMDAyMzxicj4KICAgICAgICAgICAgICAgIENWRS0yMDA5LTE5NTY8YnI+CiAgICAgICAg ICAgICAgICBDVkUtMjAwOS0xMTk1PGJyPgogICAgICAgICAgICAgICAgQ1ZFLTIwMDktMTg5MDxi cj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg Sm9obiBUcnVtcCB3cm90ZTo8YnI+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj4KICAgICAgICAgICAgICA8ZGl2IGRpcj0ibHRyIj5JIGhhdmUg YSBzeXN0ZW0gcnVubmluZyAzODktZHMgdGhhdCB3YXMKICAgICAgICAgICAgICAgIHNjYW5uZWQg dXNpbmcgcmV0bmEuIFJldG5hIHNob3dlZCB2dWxuZXJhYmlsaXRpZXMgd2hpY2gKICAgICAgICAg ICAgICAgIGFyZSBmYWlybHkgb2xkLiBDYW4gYW55b25lIGNvbmZpcm0gdGhhdCB0aGVzZSB3ZXJl CiAgICAgICAgICAgICAgICBmaXhlZC4gT25seSB0aGluZyB1c2luZyBwb3J0IDk4MzAgaXMgdGhl IGFkbWluLXNlcnYuCiAgICAgICAgICAgICAgICBCZWxvdyBhcmUgdGhlIHJwbSB2ZXJzaW9ucyBJ IGhhdmUgaW5zdGFsbGVkIGFuZCB0aGUKICAgICAgICAgICAgICAgIENWRSYjMzk7cyByZXRuYSBz dXBwb3NpZGx5IGRldGVjdGVkLgogICAgICAgICAgICAgICAgPGRpdj4gPGJyPgogICAgICAgICAg ICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2 PjM4OS1hZG1pbnV0aWwtMS4xLjE5LTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAgICAgICAgICAg ICA8ZGl2PjM4OS1kcy1jb25zb2xlLWRvYy0xLjIuNi0xLmVsNi5ub2FyY2g8L2Rpdj4KICAgICAg ICAgICAgICAgICAgPGRpdj4zODktYWRtaW4tMS4xLjM1LTEuZWw2Lng4Nl82NDwvZGl2PgogICAg ICAgICAgICAgICAgICA8ZGl2PjM4OS1hZG1pbi1jb25zb2xlLTEuMS44LTUuZmMxOS5ub2FyY2g8 L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4zODktY29uc29sZS0xLjEuNy0xLmVsNi5ub2Fy Y2g8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4zODktZHMtMS4yLjItMS5lbDYubm9hcmNo PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWRzLWJhc2UtbGlicy0xLjIuMTEuMjUt MS5lbDYueDg2XzY0PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWRzLWJhc2UtMS4y LjExLjI1LTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1kc2d3 LTEuMS4xMS0xLmVsNi54ODZfNjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4zODktZHMt Y29uc29sZS0xLjIuNi0xLmVsNi5ub2FyY2g8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4z ODktYWRtaW4tY29uc29sZS1kb2MtMS4xLjgtNS5mYzE5Lm5vYXJjaDwvZGl2PgogICAgICAgICAg ICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwv ZGl2PgogICAgICAgICAgICAgICAgPGRpdj5BdWRpdCBJRDo8c3BhbiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+NjMxMDxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3Jh cCI+IDwvc3Bhbj5WdWwgSUQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9z cGFuPk4vQTxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRpdj4K ICAgICAgICAgICAgICAgICAgPGRpdj5SaXNrIExldmVsOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUtd3JhcCI+IDwvc3Bhbj5NZWRpdW08L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5T ZXYgQ29kZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q2F0ZWdv cnkKCiAgICAgICAgICAgICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5Q Q0kgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk1lZGl1 bQoKICAgICAgICAgICAgICAgICAgICAoRmFpbCkgLSBDVlNTIFNjb3JlPC9kaXY+CiAgICAgICAg ICAgICAgICAgIDxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdy YXAiPiA8L3NwYW4+NQogICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwvQXU6Ti9DOk4vSTpO L0E6UF08L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5CdWdUcmFxIElEPHNwYW4gc3R5bGU9 IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjI3MjM0LDI2ODM4LDI3MjM2LDI3MjM3PC9k aXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUtd3JhcCI+IDwvc3Bhbj5DVkUtMjAwOC0wMDA1LENWRS0yMDA3LTYzODgsQ1ZFLTIwMDctNjQy MixDVkUtMjAwNy02NDwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PjIwLENWRS0yMDA3LTUw MDAsQ1ZFLTIwMDctNjQyMSxDVkUtMjAwOC0xNjc4PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxk aXY+Q0NFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rp dj4KICAgICAgICAgICAgICAgICAgPGRpdj5FeHBsb2l0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUtd3JhcCI+IDwvc3Bhbj5ObzwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PklBVjo8 c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAg ICAgICAgICAgICAgIDxkaXY+U1RJRzo8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5Db250 ZXh0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5UQ1A6OTgzMDwv ZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PlJlc3VsdDo8c3BhbiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+U3VjY2VzczwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2 PlRlc3RlZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPgogICAgICAg ICAgICAgICAgICAgIDwvc3Bhbj5CUiBUIFdCIFNlcnZlcjo8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj4oQXBhY2hlKFwoW1tdXildKlwpKT8vKCgyXC4oKDIoXC5bW10wLTddKT8pfCgwKFwu KFtbXTEtNV0/W1tdMC05XXw2W1tdMC0yXSkpPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+ Pyl8KDEoXC4uKik/KSkpfCgxXC4oKDMoXC4oW1tdMS0zXT9bW10wLTldfDQwKSk/KXwoW1tdMC0y XShcLi4qKT8pKSl8KDArXC4uKikpPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+KCR8W1td XjAtOS5dKFtbXV4oXSpcKFtbXV5SXVtbXV4pXSpcKSkqW1tdXigpXSokKSk8L2Rpdj4KICAgICAg ICAgICAgICAgICAgPGRpdj5Gb3VuZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl LXdyYXAiPiA8L3NwYW4+U2VydmVyOgoKICAgICAgICAgICAgICAgICAgICBBcGFjaGUvMi4yIyND b250ZW50LUxlbmd0aDogMzAxIyNDb25uZWN0aW9uOjwvZGl2PgogICAgICAgICAgICAgICAgICA8 ZGl2PmNsb3NlIyNDb250ZW50LVR5cGU6IHRleHQvaHRtbDs8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj5jaGFyc2V0Wz1daXNvLTg4NTktMSMjIyMmbHQ7IURPQ1RZUEUgSFRNTCBQVUJMSUM8 L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4mcXVvdDstLy9JRVRGLy9EVEQgSFRNTAogICAg ICAgICAgICAgICAgICAgIDIuMC8vRU4mcXVvdDsmZ3Q7IyZsdDtodG1sJmd0OyZsdDtoZWFkJmd0 OyMmbHQ7dGl0bGUmZ3Q7NDA0CiAgICAgICAgICAgICAgICAgICAgTm90PC9kaXY+CiAgICAgICAg ICAgICAgICAgIDxkaXY+Rm91bmQmbHQ7L3RpdGxlJmd0OyMmbHQ7L2hlYWQmZ3Q7Jmx0O2JvZHkm Z3Q7IyZsdDtoMSZndDtOb3QKCiAgICAgICAgICAgICAgICAgICAgRm91bmQmbHQ7L2gxJmd0O8Kg PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+KHRydW5jYXRlZC4uLik8L2Rpdj4KICAgICAg ICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgICAg ICA8L2Rpdj4KICAgICAgICAgICAgICAgIDxkaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+QXVk aXQgSUQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjYwNTk8c3Bh biBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+VnVsIElEOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj5SaXNrIExldmVsOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwv c3Bhbj5NZWRpdW08L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5TZXYgQ29kZTo8c3BhbiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q2F0ZWdvcnkKCiAgICAgICAgICAg ICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5QQ0kgTGV2ZWw6PHNwYW4g c3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk1lZGl1bQoKICAgICAgICAgICAg ICAgICAgICAoRmFpbCkgLSBDVlNTIFNjb3JlPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+ Q1ZTUyBTY29yZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+NQog ICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwvQXU6Ti9DOlAvSTpOL0E6Tl08L2Rpdj4KICAg ICAgICAgICAgICAgICAgPGRpdj5CdWdUcmFxIElEPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4gPC9zcGFuPjI0MjE1LDI0NjQ1LDI1NDg5LDI0NjQ5LDI0NTUzPC9kaXY+CiAgICAg ICAgICAgICAgICAgIDxkaXY+Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ IDwvc3Bhbj5DVkUtMjAwNy0xODYyLENWRS0yMDA3LTM4NDcsQ1ZFLTIwMDctMzMwNCxDVkUtMjAw Ni01NzwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PjUyLENWRS0yMDA3LTE4NjM8L2Rpdj4K ICAgICAgICAgICAgICAgICAgPGRpdj5DQ0U6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkV4cGxvaXQ6PHNw YW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk5vPC9kaXY+CiAgICAgICAg ICAgICAgICAgIDxkaXY+SUFWOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwv c3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAg ICAgICAgICAgICA8ZGl2PkNvbnRleHQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPlRDUDo5ODMwPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+UmVzdWx0Ojxz cGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5TdWNjZXNzPC9kaXY+CiAg ICAgICAgICAgICAgICAgIDxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUtd3JhcCI+CiAgICAgICAgICAgICAgICAgICAgPC9zcGFuPlJSIFQgV0I8L2Rpdj4KICAg ICAgICAgICAgICAgICAgPGRpdj4oQXBhY2hlKFwoW1tdXildKlwpKT8vKDJcLjIoXC5bW10wLTVd KT8pKCR8W1tdXjAtOS5dKFtbXV4oXSpcKFtbXV5SXVtbXV4pXSpcKTwvZGl2PgogICAgICAgICAg ICAgICAgICA8ZGl2PikqW1tdXigpXSokKSk8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5G b3VuZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+QXBh Y2hlLzIuMjwvZGl2PgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2 Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRpdj4KICAgICAg ICAgICAgICAgICAgPGRpdj4gQXVkaXQgSUQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPjk4MjA8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3Nw YW4+VnVsIElEOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8 L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5SaXNrIExldmVsOjxzcGFuIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5NZWRpdW08L2Rpdj4KICAgICAgICAgICAgICAgICAg PGRpdj5TZXYgQ29kZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+ Q2F0ZWdvcnkKCiAgICAgICAgICAgICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgICAgICAgICAg PGRpdj5QQ0kgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFu PkhpZ2gKCiAgICAgICAgICAgICAgICAgICAgKEZhaWwpIC0gQ1ZTUyBTY29yZTwvZGl2PgogICAg ICAgICAgICAgICAgICA8ZGl2PkNWU1MgU2NvcmU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4gPC9zcGFuPjcuOAoKICAgICAgICAgICAgICAgICAgICBbQVY6Ti9BQzpML0F1Ok4v QzpOL0k6Ti9BOkNdPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+QnVnVHJhcSBJRDxzcGFu IHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj4zNTU2NSwzNTI1MywzNTYyMywz NTI1MSwzNDY2MywzNTIyMSwzNTExNTwvZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkNWRTo8 c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIwMDktMTg5MSxD VkUtMjAwOS0xOTU1LENWRS0yMDA5LTExOTEsQ1ZFLTIwMDktMDA8L2Rpdj4KICAgICAgICAgICAg ICAgICAgPGRpdj4yMyxDVkUtMjAwOS0xOTU2LENWRS0yMDA5LTExOTUsQ1ZFLTIwMDktMTg5MDwv ZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PkNDRTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+RXhwbG9p dDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+WWVzPC9kaXY+CiAg ICAgICAgICAgICAgICAgIDxkaXY+SUFWOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3Jh cCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5TVElHOjwvZGl2Pgog ICAgICAgICAgICAgICAgICA8ZGl2PkNvbnRleHQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4gPC9zcGFuPlRDUDo5ODMwPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+UmVz dWx0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5TdWNjZXNzPC9k aXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUtd3JhcCI+CiAgICAgICAgICAgICAgICAgICAgPC9zcGFuPkFQQUNIRSgtQURW QU5DRURFWFRSQU5FVFNFUlZFUik/LzJcLjIoXC4oMVtbXTAxXXxbW10wPC9kaXY+CiAgICAgICAg ICAgICAgICAgIDxkaXY+LTldKShcLltbXTAtOV0rKSopPygkfFtbXV4wLTkuXSk8L2Rpdj4KICAg ICAgICAgICAgICAgICAgPGRpdj5Gb3VuZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+QVBBQ0hFLzIuMjwvZGl2PgogICAgICAgICAgICAgICAgPC9kaXY+ CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAg ICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8 L2Rpdj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGZpZWxkc2V0PjwvZmllbGRz ZXQ+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxwcmU+LS0KMzg5IHVzZXJzIG1h aWxpbmcgbGlzdAo8YSBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qu b3JnIiB0YXJnZXQ9Il9ibGFuayI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9h Pgo8YSBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGlu Zm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0 Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48L3ByZT4KICAgICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDxi cj4KICAgICAgICAgIC0tPGJyPgogICAgICAgICAgMzg5IHVzZXJzIG1haWxpbmcgbGlzdDxicj4K ICAgICAgICAgIDxhIGhyZWY9Im1haWx0bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5v cmciIHRhcmdldD0iX2JsYW5rIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+ PGJyPgogICAgICAgICAgPGEgaHJlZj0iaHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9t YWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vYWRtaW4u ZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8L2E+PGJyPgogICAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgPC9kaXY+CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0 PjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPHByZT4tLQozODkgdXNlcnMgbWFpbGluZyBs aXN0CjxhIGhyZWY9Im1haWx0bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmciIHRh cmdldD0iX2JsYW5rIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+CjxhIGhy ZWY9Imh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODkt dXNlcnMiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21h aWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzPC9hPjwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAg PGJyPgogIDwvZGl2PgoKPGJyPi0tPGJyPgozODkgdXNlcnMgbWFpbGluZyBsaXN0PGJyPgo8YSBo cmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNlcnNA bGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2FkbWluLmZl ZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFu ayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11 c2VyczwvYT48YnI+PC9ibG9ja3F1b3RlPjwvZGl2Pgo= --===============6913838581066341408==-- From nhosoi at redhat.com Thu May 29 16:28:14 2014 Content-Type: multipart/mixed; boundary="===============3461869941418721246==" MIME-Version: 1.0 From: Noriko Hosoi To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 09:28:07 -0700 Message-ID: <53876017.4090602@redhat.com> In-Reply-To: CANd=zCjpjGCd4SVjSJNXhpYtszkFfjg5GCR1S_VoC-W1tjQnbQ@mail.gmail.com --===============3461869941418721246== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable John Trump wrote: > > Does the admin server or admin console run a webserver? > Yes, the admin server depends upon httpd. > > On May 29, 2014 11:59 AM, "Noriko Hosoi" > wrote: > > Sorry, I don't know what the tool does. You may want to ask the > tool's provider the question. > Thanks. > > John Trump wrote: >> >> I am running RHEL 6. Why does the scan show the vulnerabilities >> on the port that directory administration server is using? >> >> On May 28, 2014 8:25 PM, "Noriko Hosoi" > > wrote: >> >> Hello, as you mentioned, all of the CVEs are quite old (older >> than RHEL-6). For instance, the last one CVE-2009-1956 was >> fixed in apr-util-1.2.7-7.el5_3.1. As long as you use >> RHEL-6, the CVEs you listed are all fixed. Also, please note >> that the CVEs are all httpd related, not 389-ds. >> >> CVE: >> CVE-2008-0005 >> CVE-2007-6388 >> CVE-2007-6422 >> CVE-2007-6420 >> CVE-2007-5000 >> CVE-2007-6421 >> CVE-2008-1678 >> >> CVE-2007-1862 >> CVE-2007-3847 >> CVE-2007-3304 >> CVE-2006-5752 >> CVE-2007-1863 >> >> CVE-2009-1891 >> CVE-2009-1955 >> CVE-2009-1191 >> CVE-2009-0023 >> CVE-2009-1956 >> CVE-2009-1195 >> CVE-2009-1890 >> >> John Trump wrote: >>> I have a system running 389-ds that was scanned using retna. >>> Retna showed vulnerabilities which are fairly old. Can >>> anyone confirm that these were fixed. Only thing using port >>> 9830 is the admin-serv. Below are the rpm versions I have >>> installed and the CVE's retna supposidly detected. >>> >>> 389-adminutil-1.1.19-1.el6.x86_64 >>> 389-ds-console-doc-1.2.6-1.el6.noarch >>> 389-admin-1.1.35-1.el6.x86_64 >>> 389-admin-console-1.1.8-5.fc19.noarch >>> 389-console-1.1.7-1.el6.noarch >>> 389-ds-1.2.2-1.el6.noarch >>> 389-ds-base-libs-1.2.11.25-1.el6.x86_64 >>> 389-ds-base-1.2.11.25-1.el6.x86_64 >>> 389-dsgw-1.1.11-1.el6.x86_64 >>> 389-ds-console-1.2.6-1.el6.noarch >>> 389-admin-console-doc-1.1.8-5.fc19.noarch >>> >>> Audit ID:6310Vul ID:N/A >>> Risk Level:Medium >>> Sev Code:Category II >>> PCI Level:Medium (Fail) - CVSS Score >>> CVSS Score:5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] >>> BugTraq ID27234,26838,27236,27237 >>> CVE:CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 >>> 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 >>> CCE:N/A >>> Exploit:No >>> IAV:N/A >>> STIG: >>> Context:TCP:9830 >>> Result:Success >>> Tested Value:BR T WB Server: >>> (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-= 9]|6[[]0-2])) >>> ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*= )?)))|(0+\..*)) >>> ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) >>> Found Value:Server: Apache/2.2##Content-Length: 301##Connection: >>> close##Content-Type: text/html; >>> charset[=3D]iso-8859-1####>> "-//IETF//DTD HTML 2.0//EN">##404 Not >>> Found##

Not Found

>>> (truncated...) >>> >>> Audit ID:6059Vul ID:N/A >>> Risk Level:Medium >>> Sev Code:Category II >>> PCI Level:Medium (Fail) - CVSS Score >>> CVSS Score:5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] >>> BugTraq ID24215,24645,25489,24649,24553 >>> CVE:CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 >>> 52,CVE-2007-1863 >>> CCE:N/A >>> Exploit:No >>> IAV:N/A >>> STIG: >>> Context:TCP:9830 >>> Result:Success >>> Tested Value:RR T WB >>> (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([= []^R][[]^)]*\) >>> )*[[]^()]*$)) >>> Found Value:Apache/2.2 >>> >>> Audit ID:9820Vul ID:N/A >>> Risk Level:Medium >>> Sev Code:Category II >>> PCI Level:High (Fail) - CVSS Score >>> CVSS Score:7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] >>> BugTraq ID35565,35253,35623,35251,34663,35221,35115 >>> CVE:CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 >>> 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 >>> CCE:N/A >>> Exploit:Yes >>> IAV:N/A >>> STIG: >>> Context:TCP:9830 >>> Result:Success >>> Tested >>> Value:APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 >>> -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) >>> Found Value:APACHE/2.2 >>> >>> >>> >>> >>> -- >>> 389 users mailing list >>> 389-users(a)lists.fedoraproject.org >>> https://admin.fedoraproject.org/mailman/listinfo/389-users >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> >> https://admin.fedoraproject.org/mailman/listinfo/389-users >> >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users --===============3461869941418721246== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5Kb2huIFRydW1wIHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKY2l0ZT0i bWlkOkNBTmQ9ekNqcGpHQ2Q0U1ZqU0pOWGhwWXRzemtGZmpnNUdDUjFTX1ZvQy1XMXRqUW5iUUBt YWlsLmdtYWlsLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwIGRpcj0ibHRyIj5Eb2Vz IHRoZSBhZG1pbiBzZXJ2ZXIgb3IgYWRtaW4gY29uc29sZSBydW4gYQogICAgICAgIHdlYnNlcnZl cj88YnI+CiAgICAgIDwvcD4KICAgIDwvYmxvY2txdW90ZT4KICAgIFllcywgdGhlIGFkbWluIHNl cnZlciBkZXBlbmRzIHVwb24gaHR0cGQuPGJyPgogICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOkNB TmQ9ekNqcGpHQ2Q0U1ZqU0pOWGhwWXRzemtGZmpnNUdDUjFTX1ZvQy1XMXRqUW5iUUBtYWlsLmdt YWlsLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwIGRpcj0ibHRyIj4KICAgICAgPC9w PgogICAgICA8ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gTWF5IDI5LCAyMDE0IDExOjU5IEFN LCAiTm9yaWtvIEhvc29pIgogICAgICAgICZsdDs8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGhy ZWY9Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNvbSI+bmhvc29pQHJlZGhhdC5jb208L2E+Jmd0Owog ICAgICAgIHdyb3RlOjxiciB0eXBlPSJhdHRyaWJ1dGlvbiI+CiAgICAgICAgPGJsb2NrcXVvdGUg Y2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwCiAgICAgICAgICAuOGV4O2Jv cmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgogICAgICAgICAgPGRp diBiZ2NvbG9yPSIjRkZGRkZGIiB0ZXh0PSIjMDAwMDAwIj4KICAgICAgICAgICAgPGRpdj5Tb3Jy eSwgSSBkb24ndCBrbm93IHdoYXQgdGhlIHRvb2wgZG9lcy7CoCBZb3UgbWF5IHdhbnQKICAgICAg ICAgICAgICB0byBhc2sgdGhlIHRvb2wncyBwcm92aWRlciB0aGUgcXVlc3Rpb24uPGJyPgogICAg ICAgICAgICAgIFRoYW5rcy48YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIEpv aG4gVHJ1bXAgd3JvdGU6PGJyPgogICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAgPHAgZGlyPSJsdHIiPkkgYW0gcnVubmlu ZyBSSEVMIDYuIFdoeSBkb2VzIHRoZSBzY2FuIHNob3cKICAgICAgICAgICAgICAgIHRoZSB2dWxu ZXJhYmlsaXRpZXMgb24gdGhlIHBvcnQgdGhhdCBkaXJlY3RvcnkKICAgICAgICAgICAgICAgIGFk bWluaXN0cmF0aW9uIHNlcnZlciBpcyB1c2luZz8gPC9wPgogICAgICAgICAgICAgIDxkaXYgY2xh c3M9ImdtYWlsX3F1b3RlIj5PbiBNYXkgMjgsIDIwMTQgODoyNSBQTSwgIk5vcmlrbwogICAgICAg ICAgICAgICAgSG9zb2kiICZsdDs8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAg ICAgICAgIGhyZWY9Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm5o b3NvaUByZWRoYXQuY29tPC9hPiZndDsKCiAgICAgICAgICAgICAgICB3cm90ZTo8YnIgdHlwZT0i YXR0cmlidXRpb24iPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1 b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwCiAgICAgICAgICAgICAgICAgIC44ZXg7Ym9yZGVyLWxl ZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAgICAgICAgICAgICAgICAgIDxk aXYgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAwMDAwMCI+CiAgICAgICAgICAgICAgICAgICAg PGRpdj5IZWxsbywgYXMgeW91IG1lbnRpb25lZCwgYWxsIG9mIHRoZSBDVkVzIGFyZQogICAgICAg ICAgICAgICAgICAgICAgcXVpdGUgb2xkIChvbGRlciB0aGFuIFJIRUwtNikuwqAgRm9yIGluc3Rh bmNlLCB0aGUKICAgICAgICAgICAgICAgICAgICAgIGxhc3Qgb25lIENWRS0yMDA5LTE5NTYgd2Fz IGZpeGVkIGluCiAgICAgICAgICAgICAgICAgICAgICBhcHItdXRpbC0xLjIuNy03LmVsNV8zLjEu wqAgQXMgbG9uZyBhcyB5b3UgdXNlCiAgICAgICAgICAgICAgICAgICAgICBSSEVMLTYsIHRoZSBD VkVzIHlvdSBsaXN0ZWQgYXJlIGFsbCBmaXhlZC7CoCBBbHNvLAogICAgICAgICAgICAgICAgICAg ICAgcGxlYXNlIG5vdGUgdGhhdCB0aGUgQ1ZFcyBhcmUgYWxsIGh0dHBkIHJlbGF0ZWQsCiAgICAg ICAgICAgICAgICAgICAgICBub3QgMzg5LWRzLjxicj4KICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUtd3JhcCI+IDwvc3Bhbj48YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA4 LTAwMDU8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA3LTYzODg8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIENWRS0yMDA3LTY0MjI8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIENWRS0yMDA3LTY0MjA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA3LTUw MDA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA3LTY0MjE8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgIENWRS0yMDA4LTE2Nzg8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZFLTIwMDctMTg2Mjxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgQ1ZFLTIwMDctMzg0Nzxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgQ1ZFLTIwMDctMzMwNDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgQ1ZFLTIwMDYtNTc1 Mjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgQ1ZFLTIwMDctMTg2Mzxicj4KICAgICAgICAg ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgPGRpdj5DVkUtMjAwOS0xODkxPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICBDVkUtMjAwOS0xOTU1PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBDVkUtMjAwOS0xMTkx PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBDVkUtMjAwOS0wMDIzPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICBDVkUtMjAwOS0xOTU2PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBD VkUtMjAwOS0xMTk1PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBDVkUtMjAwOS0xODkwPGJy PgogICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICBKb2huIFRydW1wIHdyb3RlOjxicj4KICAgICAgICAgICAg ICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij4KICAgICAgICAgICAgICAgICAgICAgIDxkaXYgZGlyPSJsdHIiPkkgaGF2ZSBhIHN5c3RlbSBy dW5uaW5nIDM4OS1kcyB0aGF0CiAgICAgICAgICAgICAgICAgICAgICAgIHdhcyBzY2FubmVkIHVz aW5nIHJldG5hLiBSZXRuYSBzaG93ZWQKICAgICAgICAgICAgICAgICAgICAgICAgdnVsbmVyYWJp bGl0aWVzIHdoaWNoIGFyZSBmYWlybHkgb2xkLiBDYW4gYW55b25lCiAgICAgICAgICAgICAgICAg ICAgICAgIGNvbmZpcm0gdGhhdCB0aGVzZSB3ZXJlIGZpeGVkLiBPbmx5IHRoaW5nIHVzaW5nCiAg ICAgICAgICAgICAgICAgICAgICAgIHBvcnQgOTgzMCBpcyB0aGUgYWRtaW4tc2Vydi4gQmVsb3cg YXJlIHRoZSBycG0KICAgICAgICAgICAgICAgICAgICAgICAgdmVyc2lvbnMgSSBoYXZlIGluc3Rh bGxlZCBhbmQgdGhlIENWRSdzIHJldG5hCiAgICAgICAgICAgICAgICAgICAgICAgIHN1cHBvc2lk bHkgZGV0ZWN0ZWQuCiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgPGRpdj4zODktYWRtaW51dGlsLTEuMS4xOS0xLmVsNi54ODZf NjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1kcy1jb25zb2xlLWRv Yy0xLjIuNi0xLmVsNi5ub2FyY2g8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PjM4OS1hZG1pbi0xLjEuMzUtMS5lbDYueDg2XzY0PC9kaXY+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgPGRpdj4zODktYWRtaW4tY29uc29sZS0xLjEuOC01LmZjMTkubm9hcmNoPC9kaXY+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4zODktY29uc29sZS0xLjEuNy0xLmVsNi5ub2Fy Y2g8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1kcy0xLjIuMi0xLmVs Ni5ub2FyY2g8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1kcy1iYXNl LWxpYnMtMS4yLjExLjI1LTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAg ICAgIDxkaXY+Mzg5LWRzLWJhc2UtMS4yLjExLjI1LTEuZWw2Lng4Nl82NDwvZGl2PgogICAgICAg ICAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWRzZ3ctMS4xLjExLTEuZWw2Lng4Nl82NDwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWRzLWNvbnNvbGUtMS4yLjYtMS5l bDYubm9hcmNoPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4zODktYWRtaW4t Y29uc29sZS1kb2MtMS4xLjgtNS5mYzE5Lm5vYXJjaDwvZGl2PgogICAgICAgICAgICAgICAgICAg ICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkF1ZGl0IElE OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgPC9zcGFuPjYzMTA8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPgogICAg ICAgICAgICAgICAgICAgICAgICAgIDwvc3Bhbj5WdWwgSUQ6PHNwYW4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8 ZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+UmlzayBMZXZlbDo8c3BhbgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8 L3NwYW4+TWVkaXVtPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5TZXYgQ29k ZTo8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+Q2F0ZWdvcnkKCgogICAgICAgICAgICAgICAgICAgICAgICAgICAg SUk8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlBDSSBMZXZlbDo8c3Bhbgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAi PiA8L3NwYW4+TWVkaXVtCgoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIChGYWlsKSAtIENW U1MgU2NvcmU8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNWU1MgU2NvcmU6 PHNwYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4gPC9zcGFuPjUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwv QXU6Ti9DOk4vSTpOL0E6UF08L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkJ1 Z1RyYXEgSUQ8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUt c3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+MjcyMzQsMjY4MzgsMjcyMzYsMjcyMzc8L2Rpdj4KICAg ICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNWRTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIwMDgtMDAwNSxDVkUtMjAwNy02Mzg4LENWRS0yMDA3LTY0 MjIsQ1ZFLTIwMDctNjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjIwLENW RS0yMDA3LTUwMDAsQ1ZFLTIwMDctNjQyMSxDVkUtMjAwOC0xNjc4PC9kaXY+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGRpdj5DQ0U6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+RXhwbG9p dDo8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+Tm88L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PklBVjo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAgICAgICAg ICAgICAgICAgICAgIDxkaXY+Q29udGV4dDo8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+VENQOjk4MzA8L2Rpdj4K ICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlJlc3VsdDo8c3BhbiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlLXdyYXAiPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9zcGFuPlN1Y2Nl c3M8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlRlc3RlZCBWYWx1ZTo8c3Bh bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdy YXAiPiA8L3NwYW4+QlIgVAogICAgICAgICAgICAgICAgICAgICAgICAgICAgV0IgU2VydmVyOjwv ZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+KEFwYWNoZShcKFtbXV4pXSpcKSk/ LygoMlwuKCgyKFwuW1tdMC03XSk/KXwoMChcLihbW10xLTVdP1tbXTAtOV18NltbXTAtMl0pKTwv ZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Pyl8KDEoXC4uKik/KSkpfCgxXC4o KDMoXC4oW1tdMS0zXT9bW10wLTldfDQwKSk/KXwoW1tdMC0yXShcLi4qKT8pKSl8KDArXC4uKikp PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4oJHxbW11eMC05Ll0oW1tdXihd KlwoW1tdXlJdW1tdXildKlwpKSpbW11eKCldKiQpKTwvZGl2PgogICAgICAgICAgICAgICAgICAg ICAgICAgIDxkaXY+Rm91bmQgVmFsdWU6PHNwYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlNlcnZlcjoKCgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgQXBhY2hlLzIuMiMjQ29udGVudC1MZW5ndGg6IDMwMSMjQ29u bmVjdGlvbjo8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PmNsb3NlIyNDb250 ZW50LVR5cGU6IHRleHQvaHRtbDs8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PmNoYXJzZXRbPV1pc28tODg1OS0xIyMjIyZsdDshRE9DVFlQRSBIVE1MCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICBQVUJMSUM8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PiItLy9JRVRGLy9EVEQgSFRNTAogICAgICAgICAgICAgICAgICAgICAgICAgICAgMi4wLy9FTiIm Z3Q7IyZsdDtodG1sJmd0OyZsdDtoZWFkJmd0OyMmbHQ7dGl0bGUmZ3Q7NDA0CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICBOb3Q8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PkZvdW5kJmx0Oy90aXRsZSZndDsjJmx0Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyMmbHQ7aDEmZ3Q7 Tm90CgoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZvdW5kJmx0Oy9oMSZndDvCoDwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+KHRydW5jYXRlZC4uLik8L2Rpdj4KICAg ICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+ PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAg ICAgPGRpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkF1ZGl0IElEOjxzcGFuCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ IDwvc3Bhbj42MDU5PHNwYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3R5bGU9Indo aXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlZ1bAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgSUQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+UmlzayBMZXZlbDo8c3BhbgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3Nw YW4+TWVkaXVtPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5TZXYgQ29kZTo8 c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJl LXdyYXAiPiA8L3NwYW4+Q2F0ZWdvcnkKCgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSUk8 L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlBDSSBMZXZlbDo8c3BhbgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8 L3NwYW4+TWVkaXVtCgoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIChGYWlsKSAtIENWU1Mg U2NvcmU8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNWU1MgU2NvcmU6PHNw YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPjUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwvQXU6 Ti9DOlAvSTpOL0E6Tl08L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkJ1Z1Ry YXEgSUQ8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+MjQyMTUsMjQ2NDUsMjU0ODksMjQ2NDksMjQ1NTM8L2Rpdj4K ICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNWRTo8c3BhbiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIwMDctMTg2MixDVkUtMjAwNy0zODQ3LENWRS0yMDA3 LTMzMDQsQ1ZFLTIwMDYtNTc8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjUy LENWRS0yMDA3LTE4NjM8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNDRTo8 c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgPGRpdj5FeHBsb2l0OjxzcGFuCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5ObzwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+SUFWOjxzcGFuIHN0eWxlPSJ3aGl0ZS1z cGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8ZGl2PlNUSUc6PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5Db250ZXh0 OjxzcGFuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUtd3JhcCI+IDwvc3Bhbj5UQ1A6OTgzMDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAg IDxkaXY+UmVzdWx0OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8L3NwYW4+U3VjY2VzczwvZGl2PgogICAgICAgICAgICAgICAg ICAgICAgICAgIDxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5SUiBUCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICBXQjwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxk aXY+KEFwYWNoZShcKFtbXV4pXSpcKSk/LygyXC4yKFwuW1tdMC01XSk/KSgkfFtbXV4wLTkuXShb W11eKF0qXChbW11eUl1bW11eKV0qXCk8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8 ZGl2PikqW1tdXigpXSokKSk8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkZv dW5kIFZhbHVlOjxzcGFuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5BcGFjaGUvMi4yPC9kaXY+CiAgICAgICAgICAgICAg ICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4gQXVkaXQgSUQ6PHNwYW4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPjk4 MjA8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+VnVsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBJRDo8c3Bh biBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgPGRpdj5SaXNrIExldmVsOjxzcGFuCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5NZWRpdW08 L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlNldiBDb2RlOjxzcGFuCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwv c3Bhbj5DYXRlZ29yeQoKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBJSTwvZGl2PgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxkaXY+UENJIExldmVsOjxzcGFuCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5IaWdo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAoRmFpbCkgLSBDVlNTIFNjb3JlPC9kaXY+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5DVlNTIFNjb3JlOjxzcGFuCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj43 LjgKICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwvQXU6Ti9DOk4vSTpOL0E6 Q108L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkJ1Z1RyYXEgSUQ8c3Bhbgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAi PiA8L3NwYW4+MzU1NjUsMzUyNTMsMzU2MjMsMzUyNTEsMzQ2NjMsMzUyMjEsMzUxMTU8L2Rpdj4K ICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNWRTo8c3BhbiBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIwMDktMTg5MSxDVkUtMjAwOS0xOTU1LENWRS0yMDA5 LTExOTEsQ1ZFLTIwMDktMDA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjIz LENWRS0yMDA5LTE5NTYsQ1ZFLTIwMDktMTE5NSxDVkUtMjAwOS0xODkwPC9kaXY+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgPGRpdj5DQ0U6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+RXhw bG9pdDo8c3BhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPiA8L3NwYW4+WWVzPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAg PGRpdj5JQVY6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwv ZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+U1RJRzo8L2Rpdj4KICAgICAgICAg ICAgICAgICAgICAgICAgICA8ZGl2PkNvbnRleHQ6PHNwYW4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlRDUDo5ODMwPC9k aXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5SZXN1bHQ6PHNwYW4gc3R5bGU9Indo aXRlLXNwYWNlOnByZS13cmFwIj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvc3Bhbj5T dWNjZXNzPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5UZXN0ZWQgVmFsdWU6 PHNwYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4gPC9zcGFuPkFQQUNIRSgtQURWQU5DRURFWFRSQU5FVFNFUlZFUik/LzJcLjIoXC4o MVtbXTAxXXxbW10wPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4tOV0pKFwu W1tdMC05XSspKik/KCR8W1tdXjAtOS5dKTwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAg IDxkaXY+Rm91bmQgVmFsdWU6PHNwYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3R5 bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPkFQQUNIRS8yLjI8L2Rpdj4KICAgICAg ICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+PGJy PgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAg PGRpdj48YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAg ICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICA8ZmllbGRzZXQ+PC9maWVsZHNldD4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgIDxwcmU+LS0KMzg5IHVzZXJzIG1haWxpbmcgbGlzdAo8YSBtb3ot ZG8tbm90LXNlbmQ9InRydWUiIGhyZWY9Im1haWx0bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJv amVjdC5vcmciIHRhcmdldD0iX2JsYW5rIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5v cmc8L2E+CjxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgaHJlZj0iaHR0cHM6Ly9hZG1pbi5mZWRv cmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNl cnM8L2E+PC9wcmU+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgLS08YnI+CiAgICAgICAgICAgICAgICAgIDM4OSB1c2Vy cyBtYWlsaW5nIGxpc3Q8YnI+CiAgICAgICAgICAgICAgICAgIDxhIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSIKICAgICAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZl ZG9yYXByb2plY3Qub3JnIgogICAgICAgICAgICAgICAgICAgIHRhcmdldD0iX2JsYW5rIj4zODkt dXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+PGJyPgogICAgICAgICAgICAgICAgICA8 YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cHM6 Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIKICAg ICAgICAgICAgICAgICAgICB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9q ZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48YnI+CiAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgIDxmaWVsZHNldD48L2ZpZWxkc2V0PgogICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICA8cHJlPi0tCjM4OSB1c2VycyBtYWlsaW5nIGxpc3QKPGEgbW96LWRvLW5vdC1z ZW5kPSJ0cnVlIiBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3Jn IiB0YXJnZXQ9Il9ibGFuayI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9hPgo8 YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGhyZWY9Imh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVj dC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzPC9hPjwv cHJlPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAgICAg IDwvZGl2PgogICAgICAgICAgPGJyPgogICAgICAgICAgLS08YnI+CiAgICAgICAgICAzODkgdXNl cnMgbWFpbGluZyBsaXN0PGJyPgogICAgICAgICAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgog ICAgICAgICAgICBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3Jn Ij4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+PGJyPgogICAgICAgICAgPGEg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgICBocmVmPSJodHRwczovL2FkbWluLmZl ZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzIgogICAgICAgICAgICB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xp c3RpbmZvLzM4OS11c2VyczwvYT48YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICA8L2Rp dj4KICAgICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVy Ij48L2ZpZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxwcmUgd3JhcD0iIj4tLQozODkgdXNlcnMg bWFpbGluZyBsaXN0CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1h aWx0bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmciPjM4OS11c2Vyc0BsaXN0cy5m ZWRvcmFwcm9qZWN0Lm9yZzwvYT4KPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJl Zj0iaHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11 c2VycyI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4 OS11c2VyczwvYT48L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICA8L2JvZHk+Cjwv aHRtbD4K --===============3461869941418721246==-- From trumpjk at gmail.com Thu May 29 17:14:42 2014 Content-Type: multipart/mixed; boundary="===============9193368300300669160==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 13:13:59 -0400 Message-ID: In-Reply-To: 53876017.4090602@redhat.com --===============9193368300300669160== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable In /etc/dirsrv/admin-serv there is a httpd.conf file. Does the admin-serv use the httpd system rpm or does it use a http server distributed with the admin-serv rpm? If it is distributed with the admin-serv rpm than I would say the scan is saying that the vulnerabilities exist in that http server. The httpd rpm installed on the system is the latest httpd-2.2.15-30 On Thu, May 29, 2014 at 12:28 PM, Noriko Hosoi wrote: > John Trump wrote: > > Does the admin server or admin console run a webserver? > > Yes, the admin server depends upon httpd. > > On May 29, 2014 11:59 AM, "Noriko Hosoi" wrote: > >> Sorry, I don't know what the tool does. You may want to ask the tool's >> provider the question. >> Thanks. >> >> John Trump wrote: >> >> I am running RHEL 6. Why does the scan show the vulnerabilities on the >> port that directory administration server is using? >> On May 28, 2014 8:25 PM, "Noriko Hosoi" wrote: >> >>> Hello, as you mentioned, all of the CVEs are quite old (older than >>> RHEL-6). For instance, the last one CVE-2009-1956 was fixed in >>> apr-util-1.2.7-7.el5_3.1. As long as you use RHEL-6, the CVEs you list= ed >>> are all fixed. Also, please note that the CVEs are all httpd related, = not >>> 389-ds. >>> >>> CVE: >>> CVE-2008-0005 >>> CVE-2007-6388 >>> CVE-2007-6422 >>> CVE-2007-6420 >>> CVE-2007-5000 >>> CVE-2007-6421 >>> CVE-2008-1678 >>> >>> CVE-2007-1862 >>> CVE-2007-3847 >>> CVE-2007-3304 >>> CVE-2006-5752 >>> CVE-2007-1863 >>> >>> CVE-2009-1891 >>> CVE-2009-1955 >>> CVE-2009-1191 >>> CVE-2009-0023 >>> CVE-2009-1956 >>> CVE-2009-1195 >>> CVE-2009-1890 >>> >>> John Trump wrote: >>> >>> I have a system running 389-ds that was scanned using retna. Retna >>> showed vulnerabilities which are fairly old. Can anyone confirm that th= ese >>> were fixed. Only thing using port 9830 is the admin-serv. Below are the= rpm >>> versions I have installed and the CVE's retna supposidly detected. >>> >>> 389-adminutil-1.1.19-1.el6.x86_64 >>> 389-ds-console-doc-1.2.6-1.el6.noarch >>> 389-admin-1.1.35-1.el6.x86_64 >>> 389-admin-console-1.1.8-5.fc19.noarch >>> 389-console-1.1.7-1.el6.noarch >>> 389-ds-1.2.2-1.el6.noarch >>> 389-ds-base-libs-1.2.11.25-1.el6.x86_64 >>> 389-ds-base-1.2.11.25-1.el6.x86_64 >>> 389-dsgw-1.1.11-1.el6.x86_64 >>> 389-ds-console-1.2.6-1.el6.noarch >>> 389-admin-console-doc-1.1.8-5.fc19.noarch >>> >>> Audit ID: 6310 Vul ID: N/A >>> Risk Level: Medium >>> Sev Code: Category II >>> PCI Level: Medium (Fail) - CVSS Score >>> CVSS Score: 5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] >>> BugTraq ID 27234,26838,27236,27237 >>> CVE: CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 >>> 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 >>> CCE: N/A >>> Exploit: No >>> IAV: N/A >>> STIG: >>> Context: TCP:9830 >>> Result: Success >>> Tested Value: BR T WB Server: >>> >>> (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0= -2])) >>> >>> ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0= +\..*)) >>> ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) >>> Found Value: Server: Apache/2.2##Content-Length: 301##Connection: >>> close##Content-Type: text/html; >>> charset[=3D]iso-8859-1####>> "-//IETF//DTD HTML 2.0//EN">##404 Not >>> Found##

Not Found

>>> (truncated...) >>> >>> Audit ID: 6059 Vul ID: N/A >>> Risk Level: Medium >>> Sev Code: Category II >>> PCI Level: Medium (Fail) - CVSS Score >>> CVSS Score: 5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] >>> BugTraq ID 24215,24645,25489,24649,24553 >>> CVE: CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 >>> 52,CVE-2007-1863 >>> CCE: N/A >>> Exploit: No >>> IAV: N/A >>> STIG: >>> Context: TCP:9830 >>> Result: Success >>> Tested Value: RR T WB >>> >>> (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]= ^)]*\) >>> )*[[]^()]*$)) >>> Found Value: Apache/2.2 >>> >>> Audit ID: 9820 Vul ID: N/A >>> Risk Level: Medium >>> Sev Code: Category II >>> PCI Level: High (Fail) - CVSS Score >>> CVSS Score: 7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] >>> BugTraq ID 35565,35253,35623,35251,34663,35221,35115 >>> CVE: CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 >>> 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 >>> CCE: N/A >>> Exploit: Yes >>> IAV: N/A >>> STIG: >>> Context: TCP:9830 >>> Result: Success >>> Tested Value: APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 >>> -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) >>> Found Value: APACHE/2.2 >>> >>> >>> >>> >>> -- >>> 389 users mailing list389-users(a)lists.fedoraproject.orghttps://admin.= fedoraproject.org/mailman/listinfo/389-users >>> >>> >>> >>> -- >>> 389 users mailing list >>> 389-users(a)lists.fedoraproject.org >>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>> >> >> >> -- >> 389 users mailing list389-users(a)lists.fedoraproject.orghttps://admin.f= edoraproject.org/mailman/listinfo/389-users >> >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users >> > > > -- > 389 users mailing list389-users(a)lists.fedoraproject.orghttps://admin.fe= doraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > --===============9193368300300669160== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SW7CoC9ldGMvZGlyc3J2L2FkbWluLXNlcnYgdGhlcmUgaXMgYSBodHRw ZC5jb25mIGZpbGUuIERvZXMgdGhlIGFkbWluLXNlcnYgdXNlIHRoZSBodHRwZCBzeXN0ZW0gcnBt IG9yIGRvZXMgaXQgdXNlIGEgaHR0cCBzZXJ2ZXIgZGlzdHJpYnV0ZWQgd2l0aCB0aGUgYWRtaW4t c2VydiBycG0/IElmIGl0IGlzIGRpc3RyaWJ1dGVkIHdpdGggdGhlIGFkbWluLXNlcnYgcnBtIHRo YW4gSSB3b3VsZCBzYXkgdGhlIHNjYW4gaXMgc2F5aW5nIHRoYXQgdGhlIHZ1bG5lcmFiaWxpdGll cyBleGlzdCBpbiB0aGF0IGh0dHAgc2VydmVyLiBUaGUgaHR0cGQgcnBtIGluc3RhbGxlZCBvbiB0 aGUgc3lzdGVtIGlzIHRoZSBsYXRlc3TCoGh0dHBkLTIuMi4xNS0zMAo8L2Rpdj48ZGl2IGNsYXNz PSJnbWFpbF9leHRyYSI+PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gVGh1LCBN YXkgMjksIDIwMTQgYXQgMTI6MjggUE0sIE5vcmlrbyBIb3NvaSA8c3BhbiBkaXI9Imx0ciI+Jmx0 OzxhIGhyZWY9Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm5ob3Nv aUByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj4KCjxibG9ja3F1b3RlIGNsYXNz PSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAj Y2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgogIAogICAgCiAgCiAgPGRpdiBiZ2NvbG9yPSIj RkZGRkZGIiB0ZXh0PSIjMDAwMDAwIj48ZGl2IGNsYXNzPSIiPgogICAgPGRpdj5Kb2huIFRydW1w IHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAg IDxwIGRpcj0ibHRyIj5Eb2VzIHRoZSBhZG1pbiBzZXJ2ZXIgb3IgYWRtaW4gY29uc29sZSBydW4g YQogICAgICAgIHdlYnNlcnZlcj88YnI+CiAgICAgIDwvcD4KICAgIDwvYmxvY2txdW90ZT48L2Rp dj4KICAgIFllcywgdGhlIGFkbWluIHNlcnZlciBkZXBlbmRzIHVwb24gaHR0cGQuPGRpdj48ZGl2 IGNsYXNzPSJoNSI+PGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgIDxwIGRp cj0ibHRyIj4KICAgICAgPC9wPgogICAgICA8ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gTWF5 IDI5LCAyMDE0IDExOjU5IEFNLCAmcXVvdDtOb3Jpa28gSG9zb2kmcXVvdDsKICAgICAgICAmbHQ7 PGEgaHJlZj0ibWFpbHRvOm5ob3NvaUByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+bmhvc29p QHJlZGhhdC5jb208L2E+Jmd0OwogICAgICAgIHdyb3RlOjxiciB0eXBlPSJhdHRyaWJ1dGlvbiI+ CiAgICAgICAgPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAg MCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAg ICAgICAgICA8ZGl2IGJnY29sb3I9IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgICAgICAg ICA8ZGl2PlNvcnJ5LCBJIGRvbiYjMzk7dCBrbm93IHdoYXQgdGhlIHRvb2wgZG9lcy7CoCBZb3Ug bWF5IHdhbnQKICAgICAgICAgICAgICB0byBhc2sgdGhlIHRvb2wmIzM5O3MgcHJvdmlkZXIgdGhl IHF1ZXN0aW9uLjxicj4KICAgICAgICAgICAgICBUaGFua3MuPGJyPgogICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICBKb2huIFRydW1wIHdyb3RlOjxicj4KICAgICAgICAgICAgPC9kaXY+ CiAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgIDxwIGRp cj0ibHRyIj5JIGFtIHJ1bm5pbmcgUkhFTCA2LiBXaHkgZG9lcyB0aGUgc2NhbiBzaG93CiAgICAg ICAgICAgICAgICB0aGUgdnVsbmVyYWJpbGl0aWVzIG9uIHRoZSBwb3J0IHRoYXQgZGlyZWN0b3J5 CiAgICAgICAgICAgICAgICBhZG1pbmlzdHJhdGlvbiBzZXJ2ZXIgaXMgdXNpbmc/IDwvcD4KICAg ICAgICAgICAgICA8ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gTWF5IDI4LCAyMDE0IDg6MjUg UE0sICZxdW90O05vcmlrbwogICAgICAgICAgICAgICAgSG9zb2kmcXVvdDsgJmx0OzxhIGhyZWY9 Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm5ob3NvaUByZWRoYXQu Y29tPC9hPiZndDsKCiAgICAgICAgICAgICAgICB3cm90ZTo8YnIgdHlwZT0iYXR0cmlidXRpb24i PgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0i bWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0 OjFleCI+CiAgICAgICAgICAgICAgICAgIDxkaXYgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAw MDAwMCI+CiAgICAgICAgICAgICAgICAgICAgPGRpdj5IZWxsbywgYXMgeW91IG1lbnRpb25lZCwg YWxsIG9mIHRoZSBDVkVzIGFyZQogICAgICAgICAgICAgICAgICAgICAgcXVpdGUgb2xkIChvbGRl ciB0aGFuIFJIRUwtNikuwqAgRm9yIGluc3RhbmNlLCB0aGUKICAgICAgICAgICAgICAgICAgICAg IGxhc3Qgb25lIENWRS0yMDA5LTE5NTYgd2FzIGZpeGVkIGluCiAgICAgICAgICAgICAgICAgICAg ICBhcHItdXRpbC0xLjIuNy03LmVsNV8zLjEuwqAgQXMgbG9uZyBhcyB5b3UgdXNlCiAgICAgICAg ICAgICAgICAgICAgICBSSEVMLTYsIHRoZSBDVkVzIHlvdSBsaXN0ZWQgYXJlIGFsbCBmaXhlZC7C oCBBbHNvLAogICAgICAgICAgICAgICAgICAgICAgcGxlYXNlIG5vdGUgdGhhdCB0aGUgQ1ZFcyBh cmUgYWxsIGh0dHBkIHJlbGF0ZWQsCiAgICAgICAgICAgICAgICAgICAgICBub3QgMzg5LWRzLjxi cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxkaXY+ Q1ZFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj48YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIENWRS0yMDA4LTAwMDU8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIENWRS0yMDA3LTYzODg8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA3LTY0 MjI8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA3LTY0MjA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgIENWRS0yMDA3LTUwMDA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IENWRS0yMDA3LTY0MjE8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENWRS0yMDA4LTE2Nzg8 L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxk aXY+Q1ZFLTIwMDctMTg2Mjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgQ1ZFLTIwMDctMzg0 Nzxicj4KICAgICAgICAgICAgICAgICAgICAgICAgQ1ZFLTIwMDctMzMwNDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgQ1ZFLTIwMDYtNTc1Mjxicj4KICAgICAgICAgICAgICAgICAgICAgICAg Q1ZFLTIwMDctMTg2Mzxicj4KICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGRpdj5DVkUtMjAwOS0xODkx PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBDVkUtMjAwOS0xOTU1PGJyPgogICAgICAgICAg ICAgICAgICAgICAgICBDVkUtMjAwOS0xMTkxPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBD VkUtMjAwOS0wMDIzPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBDVkUtMjAwOS0xOTU2PGJy PgogICAgICAgICAgICAgICAgICAgICAgICBDVkUtMjAwOS0xMTk1PGJyPgogICAgICAgICAgICAg ICAgICAgICAgICBDVkUtMjAwOS0xODkwPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9kaXY+ CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKb2huIFRy dW1wIHdyb3RlOjxicj4KICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4KICAgICAgICAgICAgICAgICAgICAgIDxkaXYg ZGlyPSJsdHIiPkkgaGF2ZSBhIHN5c3RlbSBydW5uaW5nIDM4OS1kcyB0aGF0CiAgICAgICAgICAg ICAgICAgICAgICAgIHdhcyBzY2FubmVkIHVzaW5nIHJldG5hLiBSZXRuYSBzaG93ZWQKICAgICAg ICAgICAgICAgICAgICAgICAgdnVsbmVyYWJpbGl0aWVzIHdoaWNoIGFyZSBmYWlybHkgb2xkLiBD YW4gYW55b25lCiAgICAgICAgICAgICAgICAgICAgICAgIGNvbmZpcm0gdGhhdCB0aGVzZSB3ZXJl IGZpeGVkLiBPbmx5IHRoaW5nIHVzaW5nCiAgICAgICAgICAgICAgICAgICAgICAgIHBvcnQgOTgz MCBpcyB0aGUgYWRtaW4tc2Vydi4gQmVsb3cgYXJlIHRoZSBycG0KICAgICAgICAgICAgICAgICAg ICAgICAgdmVyc2lvbnMgSSBoYXZlIGluc3RhbGxlZCBhbmQgdGhlIENWRSYjMzk7cyByZXRuYQog ICAgICAgICAgICAgICAgICAgICAgICBzdXBwb3NpZGx5IGRldGVjdGVkLgogICAgICAgICAgICAg ICAgICAgICAgICA8ZGl2PiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+ Mzg5LWFkbWludXRpbC0xLjEuMTktMS5lbDYueDg2XzY0PC9kaXY+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgPGRpdj4zODktZHMtY29uc29sZS1kb2MtMS4yLjYtMS5lbDYubm9hcmNoPC9kaXY+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4zODktYWRtaW4tMS4xLjM1LTEuZWw2Lng4 Nl82NDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWFkbWluLWNvbnNv bGUtMS4xLjgtNS5mYzE5Lm5vYXJjaDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxk aXY+Mzg5LWNvbnNvbGUtMS4xLjctMS5lbDYubm9hcmNoPC9kaXY+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgPGRpdj4zODktZHMtMS4yLjItMS5lbDYubm9hcmNoPC9kaXY+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGRpdj4zODktZHMtYmFzZS1saWJzLTEuMi4xMS4yNS0xLmVsNi54ODZf NjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjM4OS1kcy1iYXNlLTEuMi4x MS4yNS0xLmVsNi54ODZfNjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PjM4 OS1kc2d3LTEuMS4xMS0xLmVsNi54ODZfNjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8ZGl2PjM4OS1kcy1jb25zb2xlLTEuMi42LTEuZWw2Lm5vYXJjaDwvZGl2PgogICAgICAgICAg ICAgICAgICAgICAgICAgIDxkaXY+Mzg5LWFkbWluLWNvbnNvbGUtZG9jLTEuMS44LTUuZmMxOS5u b2FyY2g8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAg ICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAg ICAgICAgICAgICAgICAgICAgPGRpdj5BdWRpdCBJRDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPgogICAgICAgICAgICAgICAgICAgICAgICAgIDwvc3Bhbj42MzEwPHNwYW4gc3R5 bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L3Nw YW4+VnVsIElEOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAg ICA8ZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+UmlzayBMZXZlbDo8c3BhbiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+TWVkaXVtPC9kaXY+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgPGRpdj5TZXYgQ29kZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPiA8L3NwYW4+Q2F0ZWdvcnkKCgogICAgICAgICAgICAgICAgICAgICAgICAgICAg SUk8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlBDSSBMZXZlbDo8c3BhbiBz dHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+TWVkaXVtCgoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgIChGYWlsKSAtIENWU1MgU2NvcmU8L2Rpdj4KICAgICAgICAgICAgICAg ICAgICAgICAgICA8ZGl2PkNWU1MgU2NvcmU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13 cmFwIj4gPC9zcGFuPjUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtBVjpOL0FDOkwvQXU6 Ti9DOk4vSTpOL0E6UF08L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkJ1Z1Ry YXEgSUQ8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+MjcyMzQsMjY4 MzgsMjcyMzYsMjcyMzc8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkNWRTo8 c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q1ZFLTIwMDgtMDAwNSxD VkUtMjAwNy02Mzg4LENWRS0yMDA3LTY0MjIsQ1ZFLTIwMDctNjQ8L2Rpdj4KICAgICAgICAgICAg ICAgICAgICAgICAgICA8ZGl2PjIwLENWRS0yMDA3LTUwMDAsQ1ZFLTIwMDctNjQyMSxDVkUtMjAw OC0xNjc4PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5DQ0U6PHNwYW4gc3R5 bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAg ICAgICAgICAgICAgIDxkaXY+RXhwbG9pdDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdy YXAiPiA8L3NwYW4+Tm88L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PklBVjo8 c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAgICAgICAgICAgICAg ICAgICAgIDxkaXY+Q29udGV4dDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8 L3NwYW4+VENQOjk4MzA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlJlc3Vs dDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgPC9zcGFuPlN1Y2Nlc3M8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8 ZGl2PlRlc3RlZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3Nw YW4+QlIgVAogICAgICAgICAgICAgICAgICAgICAgICAgICAgV0IgU2VydmVyOjwvZGl2PgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxkaXY+KEFwYWNoZShcKFtbXV4pXSpcKSk/LygoMlwuKCgy KFwuW1tdMC03XSk/KXwoMChcLihbW10xLTVdP1tbXTAtOV18NltbXTAtMl0pKTwvZGl2PgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Pyl8KDEoXC4uKik/KSkpfCgxXC4oKDMoXC4oW1td MS0zXT9bW10wLTldfDQwKSk/KXwoW1tdMC0yXShcLi4qKT8pKSl8KDArXC4uKikpPC9kaXY+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4oJHxbW11eMC05Ll0oW1tdXihdKlwoW1tdXlJd W1tdXildKlwpKSpbW11eKCldKiQpKTwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxk aXY+Rm91bmQgVmFsdWU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFu PlNlcnZlcjoKCgogICAgICAgICAgICAgICAgICAgICAgICAgICAgQXBhY2hlLzIuMiMjQ29udGVu dC1MZW5ndGg6IDMwMSMjQ29ubmVjdGlvbjo8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8ZGl2PmNsb3NlIyNDb250ZW50LVR5cGU6IHRleHQvaHRtbDs8L2Rpdj4KICAgICAgICAgICAg ICAgICAgICAgICAgICA8ZGl2PmNoYXJzZXRbPV1pc28tODg1OS0xIyMjIyZsdDshRE9DVFlQRSBI VE1MCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBQVUJMSUM8L2Rpdj4KICAgICAgICAgICAg ICAgICAgICAgICAgICA8ZGl2PiZxdW90Oy0vL0lFVEYvL0RURCBIVE1MCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAyLjAvL0VOJnF1b3Q7Jmd0OyMmbHQ7aHRtbCZndDsmbHQ7aGVhZCZndDsj Jmx0O3RpdGxlJmd0OzQwNAogICAgICAgICAgICAgICAgICAgICAgICAgICAgTm90PC9kaXY+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5Gb3VuZCZsdDsvdGl0bGUmZ3Q7IyZsdDsvaGVh ZCZndDsmbHQ7Ym9keSZndDsjJmx0O2gxJmd0O05vdAoKCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBGb3VuZCZsdDsvaDEmZ3Q7wqA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8 ZGl2Pih0cnVuY2F0ZWQuLi4pPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2Pgog ICAgICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgICAgICAgICAg PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgPGRpdj5BdWRpdCBJRDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8 L3NwYW4+NjA1OTxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5WdWwK ICAgICAgICAgICAgICAgICAgICAgICAgICAgIElEOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PlJpc2sgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk1l ZGl1bTwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+U2V2IENvZGU6PHNwYW4g c3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPkNhdGVnb3J5CgoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIElJPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRp dj5QQ0kgTGV2ZWw6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk1l ZGl1bQoKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAoRmFpbCkgLSBDVlNTIFNjb3JlPC9k aXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5DVlNTIFNjb3JlOjxzcGFuIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj41CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBbQVY6Ti9BQzpML0F1Ok4vQzpQL0k6Ti9BOk5dPC9kaXY+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgPGRpdj5CdWdUcmFxIElEPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPjI0MjE1LDI0NjQ1LDI1NDg5LDI0NjQ5LDI0NTUzPC9kaXY+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGRpdj5DVkU6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPkNWRS0yMDA3LTE4NjIsQ1ZFLTIwMDctMzg0NyxDVkUtMjAwNy0zMzA0LENWRS0y MDA2LTU3PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj41MixDVkUtMjAwNy0x ODYzPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5DQ0U6PHNwYW4gc3R5bGU9 IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAg ICAgICAgICAgIDxkaXY+RXhwbG9pdDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAi PiA8L3NwYW4+Tm88L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PklBVjo8c3Bh biBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ti9BPC9kaXY+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgPGRpdj5TVElHOjwvZGl2PgogICAgICAgICAgICAgICAgICAgICAg ICAgIDxkaXY+Q29udGV4dDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3Nw YW4+VENQOjk4MzA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PlJlc3VsdDo8 c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgPC9zcGFuPlN1Y2Nlc3M8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 PlRlc3RlZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+ UlIgVAogICAgICAgICAgICAgICAgICAgICAgICAgICAgV0I8L2Rpdj4KICAgICAgICAgICAgICAg ICAgICAgICAgICA8ZGl2PihBcGFjaGUoXChbW11eKV0qXCkpPy8oMlwuMihcLltbXTAtNV0pPyko JHxbW11eMC05Ll0oW1tdXihdKlwoW1tdXlJdW1tdXildKlwpPC9kaXY+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgPGRpdj4pKltbXV4oKV0qJCkpPC9kaXY+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgPGRpdj5Gb3VuZCBWYWx1ZTo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAi PiA8L3NwYW4+QXBhY2hlLzIuMjwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4K ICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICAg ICAgICAgIDxkaXY+IEF1ZGl0IElEOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ IDwvc3Bhbj45ODIwPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlZ1 bAogICAgICAgICAgICAgICAgICAgICAgICAgICAgSUQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNl OnByZS13cmFwIj4gPC9zcGFuPk4vQTwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxk aXY+UmlzayBMZXZlbDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+ TWVkaXVtPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5TZXYgQ29kZTo8c3Bh biBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Q2F0ZWdvcnkKCgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgSUk8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8 ZGl2PlBDSSBMZXZlbDo8c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+ SGlnaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgKEZhaWwpIC0gQ1ZTUyBTY29yZTwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiA8L3NwYW4+Ny44CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBbQVY6Ti9BQzpML0F1Ok4vQzpOL0k6Ti9BOkNdPC9kaXY+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgPGRpdj5CdWdUcmFxIElEPHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFw Ij4gPC9zcGFuPjM1NTY1LDM1MjUzLDM1NjIzLDM1MjUxLDM0NjYzLDM1MjIxLDM1MTE1PC9kaXY+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5DVkU6PHNwYW4gc3R5bGU9IndoaXRlLXNw YWNlOnByZS13cmFwIj4gPC9zcGFuPkNWRS0yMDA5LTE4OTEsQ1ZFLTIwMDktMTk1NSxDVkUtMjAw OS0xMTkxLENWRS0yMDA5LTAwPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj4y MyxDVkUtMjAwOS0xOTU2LENWRS0yMDA5LTExOTUsQ1ZFLTIwMDktMTg5MDwvZGl2PgogICAgICAg ICAgICAgICAgICAgICAgICAgIDxkaXY+Q0NFOjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUt d3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkV4 cGxvaXQ6PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4gPC9zcGFuPlllczwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+SUFWOjxzcGFuIHN0eWxlPSJ3aGl0ZS1z cGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5OL0E8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8ZGl2PlNUSUc6PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj5Db250ZXh0 OjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5UQ1A6OTgzMDwvZGl2 PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+UmVzdWx0OjxzcGFuIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUtd3JhcCI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3NwYW4+U3Vj Y2VzczwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+VGVzdGVkIFZhbHVlOjxz cGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5BUEFDSEUoLUFEVkFOQ0VE RVhUUkFORVRTRVJWRVIpPy8yXC4yKFwuKDFbW10wMV18W1tdMDwvZGl2PgogICAgICAgICAgICAg ICAgICAgICAgICAgIDxkaXY+LTldKShcLltbXTAtOV0rKSopPygkfFtbXV4wLTkuXSk8L2Rpdj4K ICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUtd3JhcCI+IDwvc3Bhbj5BUEFDSEUvMi4yPC9kaXY+CiAgICAgICAgICAg ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+ PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAg IDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg PGZpZWxkc2V0PjwvZmllbGRzZXQ+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICA8cHJlPi0tCjM4OSB1c2VycyBtYWlsaW5nIGxpc3QKPGEgaHJlZj0ibWFp bHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjM4 OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZzwvYT4KPGEgaHJlZj0iaHR0cHM6Ly9hZG1p bi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8z ODktdXNlcnM8L2E+PC9wcmU+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgLS08YnI+CiAgICAgICAgICAgICAgICAgIDM4 OSB1c2VycyBtYWlsaW5nIGxpc3Q8YnI+CiAgICAgICAgICAgICAgICAgIDxhIGhyZWY9Im1haWx0 bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmciIHRhcmdldD0iX2JsYW5rIj4zODkt dXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+PGJyPgogICAgICAgICAgICAgICAgICA8 YSBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8v Mzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9y Zy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48YnI+CiAgICAgICAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgIDxmaWVsZHNldD48L2ZpZWxkc2V0PgogICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICA8cHJlPi0tCjM4OSB1c2VycyBtYWlsaW5nIGxpc3QKPGEgaHJlZj0ibWFpbHRvOjM4OS11 c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjM4OS11c2Vyc0Bs aXN0cy5mZWRvcmFwcm9qZWN0Lm9yZzwvYT4KPGEgaHJlZj0iaHR0cHM6Ly9hZG1pbi5mZWRvcmFw cm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8 L2E+PC9wcmU+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgPGJyPgogICAg ICAgICAgPC9kaXY+CiAgICAgICAgICA8YnI+CiAgICAgICAgICAtLTxicj4KICAgICAgICAgIDM4 OSB1c2VycyBtYWlsaW5nIGxpc3Q8YnI+CiAgICAgICAgICA8YSBocmVmPSJtYWlsdG86Mzg5LXVz ZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIiB0YXJnZXQ9Il9ibGFuayI+Mzg5LXVzZXJzQGxp c3RzLmZlZG9yYXByb2plY3Qub3JnPC9hPjxicj4KICAgICAgICAgIDxhIGhyZWY9Imh0dHBzOi8v YWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGlu Zm8vMzg5LXVzZXJzPC9hPjxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDwvZGl2Pgog ICAgICA8YnI+CiAgICAgIDxmaWVsZHNldD48L2ZpZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxw cmU+LS0KMzg5IHVzZXJzIG1haWxpbmcgbGlzdAo8YSBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxp c3RzLmZlZG9yYXByb2plY3Qub3JnIiB0YXJnZXQ9Il9ibGFuayI+Mzg5LXVzZXJzQGxpc3RzLmZl ZG9yYXByb2plY3Qub3JnPC9hPgo8YSBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qu b3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9h ZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48L3By ZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICA8L2Rpdj48L2Rpdj48L2Rpdj4KCjxicj4t LTxicj4KMzg5IHVzZXJzIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOjM4OS11c2Vy c0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qu b3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWls bWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vYWRtaW4uZmVk b3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8L2E+PGJyPjwvYmxvY2tx dW90ZT48L2Rpdj48YnI+PC9kaXY+Cg== --===============9193368300300669160==-- From rcritten at redhat.com Thu May 29 17:23:12 2014 Content-Type: multipart/mixed; boundary="===============4579255319380920123==" MIME-Version: 1.0 From: Rob Crittenden To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 13:23:08 -0400 Message-ID: <53876CFC.5080209@redhat.com> In-Reply-To: CANd=zCh+nWcxMMuL+GGWaLVgAS5V5LOBVB8rxXdVKoZVeh_CzA@mail.gmail.com --===============4579255319380920123== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable John Trump wrote: > In /etc/dirsrv/admin-serv there is a httpd.conf file. Does the > admin-serv use the httpd system rpm or does it use a http server > distributed with the admin-serv rpm? If it is distributed with the > admin-serv rpm than I would say the scan is saying that the > vulnerabilities exist in that http server. The httpd rpm installed on > the system is the latest httpd-2.2.15-30 389-admin runs a separate instance of the system httpd. I know nothing about this scanner but based on these logs it is just doing server version string comparisons which are rather meaningless in this context. There seems to be a lot of false-positives merely because the Apache version is 2.2. rob > = > = > On Thu, May 29, 2014 at 12:28 PM, Noriko Hosoi > wrote: > = > John Trump wrote: >> >> Does the admin server or admin console run a webserver? >> > Yes, the admin server depends upon httpd. > = >> On May 29, 2014 11:59 AM, "Noriko Hosoi" > > wrote: >> >> Sorry, I don't know what the tool does. You may want to ask >> the tool's provider the question. >> Thanks. >> >> John Trump wrote: >>> >>> I am running RHEL 6. Why does the scan show the >>> vulnerabilities on the port that directory administration >>> server is using? >>> >>> On May 28, 2014 8:25 PM, "Noriko Hosoi" >> > wrote: >>> >>> Hello, as you mentioned, all of the CVEs are quite old >>> (older than RHEL-6). For instance, the last one >>> CVE-2009-1956 was fixed in apr-util-1.2.7-7.el5_3.1. As >>> long as you use RHEL-6, the CVEs you listed are all >>> fixed. Also, please note that the CVEs are all httpd >>> related, not 389-ds. >>> >>> CVE: >>> CVE-2008-0005 >>> CVE-2007-6388 >>> CVE-2007-6422 >>> CVE-2007-6420 >>> CVE-2007-5000 >>> CVE-2007-6421 >>> CVE-2008-1678 >>> >>> CVE-2007-1862 >>> CVE-2007-3847 >>> CVE-2007-3304 >>> CVE-2006-5752 >>> CVE-2007-1863 >>> >>> CVE-2009-1891 >>> CVE-2009-1955 >>> CVE-2009-1191 >>> CVE-2009-0023 >>> CVE-2009-1956 >>> CVE-2009-1195 >>> CVE-2009-1890 >>> >>> John Trump wrote: >>>> I have a system running 389-ds that was scanned using >>>> retna. Retna showed vulnerabilities which are fairly >>>> old. Can anyone confirm that these were fixed. Only >>>> thing using port 9830 is the admin-serv. Below are the >>>> rpm versions I have installed and the CVE's retna >>>> supposidly detected. >>>> >>>> 389-adminutil-1.1.19-1.el6.x86_64 >>>> 389-ds-console-doc-1.2.6-1.el6.noarch >>>> 389-admin-1.1.35-1.el6.x86_64 >>>> 389-admin-console-1.1.8-5.fc19.noarch >>>> 389-console-1.1.7-1.el6.noarch >>>> 389-ds-1.2.2-1.el6.noarch >>>> 389-ds-base-libs-1.2.11.25-1.el6.x86_64 >>>> 389-ds-base-1.2.11.25-1.el6.x86_64 >>>> 389-dsgw-1.1.11-1.el6.x86_64 >>>> 389-ds-console-1.2.6-1.el6.noarch >>>> 389-admin-console-doc-1.1.8-5.fc19.noarch >>>> >>>> Audit ID:6310Vul ID:N/A >>>> Risk Level:Medium >>>> Sev Code:Category II >>>> PCI Level:Medium (Fail) - CVSS Score >>>> CVSS Score:5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] >>>> BugTraq ID27234,26838,27236,27237 >>>> CVE:CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 >>>> 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 >>>> CCE:N/A >>>> Exploit:No >>>> IAV:N/A >>>> STIG: >>>> Context:TCP:9830 >>>> Result:Success >>>> Tested Value:BR T WB Server: >>>> (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?= [[]0-9]|6[[]0-2])) >>>> ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2]= (\..*)?)))|(0+\..*)) >>>> ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) >>>> Found Value:Server: Apache/2.2##Content-Length: >>>> 301##Connection: >>>> close##Content-Type: text/html; >>>> charset[=3D]iso-8859-1####>>> "-//IETF//DTD HTML 2.0//EN">##404 Not >>>> Found##

Not Found

= >>>> (truncated...) >>>> >>>> Audit ID:6059Vul ID:N/A >>>> Risk Level:Medium >>>> Sev Code:Category II >>>> PCI Level:Medium (Fail) - CVSS Score >>>> CVSS Score:5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] >>>> BugTraq ID24215,24645,25489,24649,24553 >>>> CVE:CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 >>>> 52,CVE-2007-1863 >>>> CCE:N/A >>>> Exploit:No >>>> IAV:N/A >>>> STIG: >>>> Context:TCP:9830 >>>> Result:Success >>>> Tested Value:RR T WB >>>> (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(= ]*\([[]^R][[]^)]*\) >>>> )*[[]^()]*$)) >>>> Found Value:Apache/2.2 >>>> >>>> Audit ID:9820Vul ID:N/A >>>> Risk Level:Medium >>>> Sev Code:Category II >>>> PCI Level:High (Fail) - CVSS Score >>>> CVSS Score:7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] >>>> BugTraq ID35565,35253,35623,35251,34663,35221,35115 >>>> CVE:CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 >>>> 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 >>>> CCE:N/A >>>> Exploit:Yes >>>> IAV:N/A >>>> STIG: >>>> Context:TCP:9830 >>>> Result:Success >>>> Tested >>>> Value:APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 >>>> -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) >>>> Found Value:APACHE/2.2 >>>> >>>> >>>> >>>> >>>> -- >>>> 389 users mailing list >>>> 389-users(a)lists.fedoraproject.org >>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>> >>> >>> -- >>> 389 users mailing list >>> 389-users(a)lists.fedoraproject.org >>> >>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>> >>> >>> >>> -- >>> 389 users mailing list >>> 389-users(a)lists.fedoraproject.org >>> https://admin.fedoraproject.org/mailman/listinfo/389-users >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> >> https://admin.fedoraproject.org/mailman/listinfo/389-users >> >> >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users > = > = > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > = > = > = > = > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > = --===============4579255319380920123==-- From trumpjk at gmail.com Thu May 29 17:27:52 2014 Content-Type: multipart/mixed; boundary="===============1864296737802636852==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 13:27:09 -0400 Message-ID: In-Reply-To: 53876CFC.5080209@redhat.com --===============1864296737802636852== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I believe they are false positives. I am just searching for "proof" to provide to person running sans. On Thu, May 29, 2014 at 1:23 PM, Rob Crittenden wro= te: > John Trump wrote: > > In /etc/dirsrv/admin-serv there is a httpd.conf file. Does the > > admin-serv use the httpd system rpm or does it use a http server > > distributed with the admin-serv rpm? If it is distributed with the > > admin-serv rpm than I would say the scan is saying that the > > vulnerabilities exist in that http server. The httpd rpm installed on > > the system is the latest httpd-2.2.15-30 > > 389-admin runs a separate instance of the system httpd. > > I know nothing about this scanner but based on these logs it is just > doing server version string comparisons which are rather meaningless in > this context. There seems to be a lot of false-positives merely because > the Apache version is 2.2. > > rob > > > > > > > On Thu, May 29, 2014 at 12:28 PM, Noriko Hosoi > > wrote: > > > > John Trump wrote: > >> > >> Does the admin server or admin console run a webserver? > >> > > Yes, the admin server depends upon httpd. > > > >> On May 29, 2014 11:59 AM, "Noriko Hosoi" >> > wrote: > >> > >> Sorry, I don't know what the tool does. You may want to ask > >> the tool's provider the question. > >> Thanks. > >> > >> John Trump wrote: > >>> > >>> I am running RHEL 6. Why does the scan show the > >>> vulnerabilities on the port that directory administration > >>> server is using? > >>> > >>> On May 28, 2014 8:25 PM, "Noriko Hosoi" >>> > wrote: > >>> > >>> Hello, as you mentioned, all of the CVEs are quite old > >>> (older than RHEL-6). For instance, the last one > >>> CVE-2009-1956 was fixed in apr-util-1.2.7-7.el5_3.1. As > >>> long as you use RHEL-6, the CVEs you listed are all > >>> fixed. Also, please note that the CVEs are all httpd > >>> related, not 389-ds. > >>> > >>> CVE: > >>> CVE-2008-0005 > >>> CVE-2007-6388 > >>> CVE-2007-6422 > >>> CVE-2007-6420 > >>> CVE-2007-5000 > >>> CVE-2007-6421 > >>> CVE-2008-1678 > >>> > >>> CVE-2007-1862 > >>> CVE-2007-3847 > >>> CVE-2007-3304 > >>> CVE-2006-5752 > >>> CVE-2007-1863 > >>> > >>> CVE-2009-1891 > >>> CVE-2009-1955 > >>> CVE-2009-1191 > >>> CVE-2009-0023 > >>> CVE-2009-1956 > >>> CVE-2009-1195 > >>> CVE-2009-1890 > >>> > >>> John Trump wrote: > >>>> I have a system running 389-ds that was scanned using > >>>> retna. Retna showed vulnerabilities which are fairly > >>>> old. Can anyone confirm that these were fixed. Only > >>>> thing using port 9830 is the admin-serv. Below are the > >>>> rpm versions I have installed and the CVE's retna > >>>> supposidly detected. > >>>> > >>>> 389-adminutil-1.1.19-1.el6.x86_64 > >>>> 389-ds-console-doc-1.2.6-1.el6.noarch > >>>> 389-admin-1.1.35-1.el6.x86_64 > >>>> 389-admin-console-1.1.8-5.fc19.noarch > >>>> 389-console-1.1.7-1.el6.noarch > >>>> 389-ds-1.2.2-1.el6.noarch > >>>> 389-ds-base-libs-1.2.11.25-1.el6.x86_64 > >>>> 389-ds-base-1.2.11.25-1.el6.x86_64 > >>>> 389-dsgw-1.1.11-1.el6.x86_64 > >>>> 389-ds-console-1.2.6-1.el6.noarch > >>>> 389-admin-console-doc-1.1.8-5.fc19.noarch > >>>> > >>>> Audit ID:6310Vul ID:N/A > >>>> Risk Level:Medium > >>>> Sev Code:Category II > >>>> PCI Level:Medium (Fail) - CVSS Score > >>>> CVSS Score:5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] > >>>> BugTraq ID27234,26838,27236,27237 > >>>> CVE:CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 > >>>> 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 > >>>> CCE:N/A > >>>> Exploit:No > >>>> IAV:N/A > >>>> STIG: > >>>> Context:TCP:9830 > >>>> Result:Success > >>>> Tested Value:BR T WB Server: > >>>> > (Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-2= ])) > >>>> > ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+\= ..*)) > >>>> ($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$)) > >>>> Found Value:Server: Apache/2.2##Content-Length: > >>>> 301##Connection: > >>>> close##Content-Type: text/html; > >>>> charset[=3D]iso-8859-1#### >>>> "-//IETF//DTD HTML 2.0//EN">##404 Not > >>>> Found##

Not Found

> >>>> (truncated...) > >>>> > >>>> Audit ID:6059Vul ID:N/A > >>>> Risk Level:Medium > >>>> Sev Code:Category II > >>>> PCI Level:Medium (Fail) - CVSS Score > >>>> CVSS Score:5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] > >>>> BugTraq ID24215,24645,25489,24649,24553 > >>>> CVE:CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 > >>>> 52,CVE-2007-1863 > >>>> CCE:N/A > >>>> Exploit:No > >>>> IAV:N/A > >>>> STIG: > >>>> Context:TCP:9830 > >>>> Result:Success > >>>> Tested Value:RR T WB > >>>> > (Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]^)= ]*\) > >>>> )*[[]^()]*$)) > >>>> Found Value:Apache/2.2 > >>>> > >>>> Audit ID:9820Vul ID:N/A > >>>> Risk Level:Medium > >>>> Sev Code:Category II > >>>> PCI Level:High (Fail) - CVSS Score > >>>> CVSS Score:7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] > >>>> BugTraq ID35565,35253,35623,35251,34663,35221,35115 > >>>> CVE:CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 > >>>> 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 > >>>> CCE:N/A > >>>> Exploit:Yes > >>>> IAV:N/A > >>>> STIG: > >>>> Context:TCP:9830 > >>>> Result:Success > >>>> Tested > >>>> > Value:APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 > >>>> -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) > >>>> Found Value:APACHE/2.2 > >>>> > >>>> > >>>> > >>>> > >>>> -- > >>>> 389 users mailing list > >>>> 389-users(a)lists.fedoraproject.org 389-users(a)lists.fedoraproject.org> > >>>> > https://admin.fedoraproject.org/mailman/listinfo/389-users > >>> > >>> > >>> -- > >>> 389 users mailing list > >>> 389-users(a)lists.fedoraproject.org > >>> > >>> https://admin.fedoraproject.org/mailman/listinfo/389-users > >>> > >>> > >>> > >>> -- > >>> 389 users mailing list > >>> 389-users(a)lists.fedoraproject.org 389-users(a)lists.fedoraproject.org> > >>> https://admin.fedoraproject.org/mailman/listinfo/389-users > >> > >> > >> -- > >> 389 users mailing list > >> 389-users(a)lists.fedoraproject.org > >> > >> https://admin.fedoraproject.org/mailman/listinfo/389-users > >> > >> > >> > >> -- > >> 389 users mailing list > >> 389-users(a)lists.fedoraproject.org 389-users(a)lists.fedoraproject.org> > >> https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > --===============1864296737802636852== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SSBiZWxpZXZlIHRoZXkgYXJlIGZhbHNlIHBvc2l0aXZlcy4gSSBhbSBq dXN0IHNlYXJjaGluZyBmb3IgJnF1b3Q7cHJvb2YmcXVvdDsgdG8gcHJvdmlkZSB0byBwZXJzb24g cnVubmluZyBzYW5zLjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGJyPjxkaXYg Y2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBUaHUsIE1heSAyOSwgMjAxNCBhdCAxOjIzIFBNLCBSb2Ig Q3JpdHRlbmRlbiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpyY3JpdHRlbkBy ZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+cmNyaXR0ZW5AcmVkaGF0LmNvbTwvYT4mZ3Q7PC9z cGFuPiB3cm90ZTo8YnI+Cgo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJt YXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6 MWV4Ij48ZGl2IGNsYXNzPSIiPkpvaG4gVHJ1bXAgd3JvdGU6PGJyPgomZ3Q7IEluIC9ldGMvZGly c3J2L2FkbWluLXNlcnYgdGhlcmUgaXMgYSBodHRwZC5jb25mIGZpbGUuIERvZXMgdGhlPGJyPgom Z3Q7IGFkbWluLXNlcnYgdXNlIHRoZSBodHRwZCBzeXN0ZW0gcnBtIG9yIGRvZXMgaXQgdXNlIGEg aHR0cCBzZXJ2ZXI8YnI+CiZndDsgZGlzdHJpYnV0ZWQgd2l0aCB0aGUgYWRtaW4tc2VydiBycG0/ IElmIGl0IGlzIGRpc3RyaWJ1dGVkIHdpdGggdGhlPGJyPgomZ3Q7IGFkbWluLXNlcnYgcnBtIHRo YW4gSSB3b3VsZCBzYXkgdGhlIHNjYW4gaXMgc2F5aW5nIHRoYXQgdGhlPGJyPgomZ3Q7IHZ1bG5l cmFiaWxpdGllcyBleGlzdCBpbiB0aGF0IGh0dHAgc2VydmVyLiBUaGUgaHR0cGQgcnBtIGluc3Rh bGxlZCBvbjxicj4KJmd0OyB0aGUgc3lzdGVtIGlzIHRoZSBsYXRlc3QgaHR0cGQtMi4yLjE1LTMw PGJyPgo8YnI+CjwvZGl2PjM4OS1hZG1pbiBydW5zIGEgc2VwYXJhdGUgaW5zdGFuY2Ugb2YgdGhl IHN5c3RlbSBodHRwZC48YnI+Cjxicj4KSSBrbm93IG5vdGhpbmcgYWJvdXQgdGhpcyBzY2FubmVy IGJ1dCBiYXNlZCBvbiB0aGVzZSBsb2dzIGl0IGlzIGp1c3Q8YnI+CmRvaW5nIHNlcnZlciB2ZXJz aW9uIHN0cmluZyBjb21wYXJpc29ucyB3aGljaCBhcmUgcmF0aGVyIG1lYW5pbmdsZXNzIGluPGJy Pgp0aGlzIGNvbnRleHQuIFRoZXJlIHNlZW1zIHRvIGJlIGEgbG90IG9mIGZhbHNlLXBvc2l0aXZl cyBtZXJlbHkgYmVjYXVzZTxicj4KdGhlIEFwYWNoZSB2ZXJzaW9uIGlzIDIuMi48YnI+Cjxicj4K cm9iPGJyPgo8ZGl2IGNsYXNzPSIiPjxicj4KJmd0Ozxicj4KJmd0Ozxicj4KJmd0OyBPbiBUaHUs IE1heSAyOSwgMjAxNCBhdCAxMjoyOCBQTSwgTm9yaWtvIEhvc29pICZsdDs8YSBocmVmPSJtYWls dG86bmhvc29pQHJlZGhhdC5jb20iPm5ob3NvaUByZWRoYXQuY29tPC9hPjxicj4KPC9kaXY+PGRp diBjbGFzcz0iIj4mZ3Q7ICZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOm5ob3NvaUByZWRoYXQu Y29tIj5uaG9zb2lAcmVkaGF0LmNvbTwvYT4mZ3Q7Jmd0OyB3cm90ZTo8YnI+CiZndDs8YnI+CiZn dDsgwqAgwqAgSm9obiBUcnVtcCB3cm90ZTo8YnI+CiZndDsmZ3Q7PGJyPgomZ3Q7Jmd0OyDCoCDC oCBEb2VzIHRoZSBhZG1pbiBzZXJ2ZXIgb3IgYWRtaW4gY29uc29sZSBydW4gYSB3ZWJzZXJ2ZXI/ PGJyPgomZ3Q7Jmd0Ozxicj4KJmd0OyDCoCDCoCBZZXMsIHRoZSBhZG1pbiBzZXJ2ZXIgZGVwZW5k cyB1cG9uIGh0dHBkLjxicj4KJmd0Ozxicj4KJmd0OyZndDsgwqAgwqAgT24gTWF5IDI5LCAyMDE0 IDExOjU5IEFNLCAmcXVvdDtOb3Jpa28gSG9zb2kmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpu aG9zb2lAcmVkaGF0LmNvbSI+bmhvc29pQHJlZGhhdC5jb208L2E+PGJyPgo8L2Rpdj48ZGl2IGNs YXNzPSIiPiZndDsmZ3Q7IMKgIMKgICZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOm5ob3NvaUBy ZWRoYXQuY29tIj5uaG9zb2lAcmVkaGF0LmNvbTwvYT4mZ3Q7Jmd0OyB3cm90ZTo8YnI+CiZndDsm Z3Q7PGJyPgomZ3Q7Jmd0OyDCoCDCoCDCoCDCoCBTb3JyeSwgSSBkb24mIzM5O3Qga25vdyB3aGF0 IHRoZSB0b29sIGRvZXMuIMKgWW91IG1heSB3YW50IHRvIGFzazxicj4KJmd0OyZndDsgwqAgwqAg wqAgwqAgdGhlIHRvb2wmIzM5O3MgcHJvdmlkZXIgdGhlIHF1ZXN0aW9uLjxicj4KJmd0OyZndDsg wqAgwqAgwqAgwqAgVGhhbmtzLjxicj4KJmd0OyZndDs8YnI+CiZndDsmZ3Q7IMKgIMKgIMKgIMKg IEpvaG4gVHJ1bXAgd3JvdGU6PGJyPgomZ3Q7Jmd0OyZndDs8YnI+CiZndDsmZ3Q7Jmd0OyDCoCDC oCDCoCDCoCBJIGFtIHJ1bm5pbmcgUkhFTCA2LiBXaHkgZG9lcyB0aGUgc2NhbiBzaG93IHRoZTxi cj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIHZ1bG5lcmFiaWxpdGllcyBvbiB0aGUgcG9ydCB0 aGF0IGRpcmVjdG9yeSBhZG1pbmlzdHJhdGlvbjxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKg IHNlcnZlciBpcyB1c2luZz88YnI+CiZndDsmZ3Q7Jmd0Ozxicj4KJmd0OyZndDsmZ3Q7IMKgIMKg IMKgIMKgIE9uIE1heSAyOCwgMjAxNCA4OjI1IFBNLCAmcXVvdDtOb3Jpa28gSG9zb2kmcXVvdDsg Jmx0OzxhIGhyZWY9Im1haWx0bzpuaG9zb2lAcmVkaGF0LmNvbSI+bmhvc29pQHJlZGhhdC5jb208 L2E+PGJyPgo8L2Rpdj48ZGl2PjxkaXYgY2xhc3M9Img1Ij4mZ3Q7Jmd0OyZndDsgwqAgwqAgwqAg wqAgJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86bmhvc29pQHJlZGhhdC5jb20iPm5ob3NvaUBy ZWRoYXQuY29tPC9hPiZndDsmZ3Q7IHdyb3RlOjxicj4KJmd0OyZndDsmZ3Q7PGJyPgomZ3Q7Jmd0 OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgSGVsbG8sIGFzIHlvdSBtZW50aW9uZWQsIGFsbCBvZiB0 aGUgQ1ZFcyBhcmUgcXVpdGUgb2xkPGJyPgomZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAg KG9sZGVyIHRoYW4gUkhFTC02KS4gwqBGb3IgaW5zdGFuY2UsIHRoZSBsYXN0IG9uZTxicj4KJmd0 OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENWRS0yMDA5LTE5NTYgd2FzIGZpeGVkIGluIGFw ci11dGlsLTEuMi43LTcuZWw1XzMuMS4gwqBBczxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKg IMKgIMKgIGxvbmcgYXMgeW91IHVzZSBSSEVMLTYsIHRoZSBDVkVzIHlvdSBsaXN0ZWQgYXJlIGFs bDxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIGZpeGVkLiDCoEFsc28sIHBsZWFz ZSBub3RlIHRoYXQgdGhlIENWRXMgYXJlIGFsbCBodHRwZDxicj4KJmd0OyZndDsmZ3Q7IMKgIMKg IMKgIMKgIMKgIMKgIHJlbGF0ZWQsIG5vdCAzODktZHMuPGJyPgomZ3Q7Jmd0OyZndDs8YnI+CiZn dDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBDVkU6PGJyPgomZ3Q7Jmd0OyZndDsgwqAgwqAg wqAgwqAgwqAgwqAgQ1ZFLTIwMDgtMDAwNTxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKg IMKgIENWRS0yMDA3LTYzODg8YnI+CiZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBDVkUt MjAwNy02NDIyPGJyPgomZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQ1ZFLTIwMDctNjQy MDxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENWRS0yMDA3LTUwMDA8YnI+CiZn dDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBDVkUtMjAwNy02NDIxPGJyPgomZ3Q7Jmd0OyZn dDsgwqAgwqAgwqAgwqAgwqAgwqAgQ1ZFLTIwMDgtMTY3ODxicj4KJmd0OyZndDsmZ3Q7PGJyPgom Z3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQ1ZFLTIwMDctMTg2Mjxicj4KJmd0OyZndDsm Z3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENWRS0yMDA3LTM4NDc8YnI+CiZndDsmZ3Q7Jmd0OyDCoCDC oCDCoCDCoCDCoCDCoCBDVkUtMjAwNy0zMzA0PGJyPgomZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAg wqAgwqAgQ1ZFLTIwMDYtNTc1Mjxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENW RS0yMDA3LTE4NjM8YnI+CiZndDsmZ3Q7Jmd0Ozxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKg IMKgIMKgIENWRS0yMDA5LTE4OTE8YnI+CiZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBD VkUtMjAwOS0xOTU1PGJyPgomZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQ1ZFLTIwMDkt MTE5MTxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENWRS0yMDA5LTAwMjM8YnI+ CiZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBDVkUtMjAwOS0xOTU2PGJyPgomZ3Q7Jmd0 OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQ1ZFLTIwMDktMTE5NTxicj4KJmd0OyZndDsmZ3Q7IMKg IMKgIMKgIMKgIMKgIMKgIENWRS0yMDA5LTE4OTA8YnI+CiZndDsmZ3Q7Jmd0Ozxicj4KJmd0OyZn dDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEpvaG4gVHJ1bXAgd3JvdGU6PGJyPgomZ3Q7Jmd0OyZn dDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEkgaGF2ZSBhIHN5c3RlbSBydW5uaW5nIDM4OS1kcyB0 aGF0IHdhcyBzY2FubmVkIHVzaW5nPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKg IMKgIHJldG5hLiBSZXRuYSBzaG93ZWQgdnVsbmVyYWJpbGl0aWVzIHdoaWNoIGFyZSBmYWlybHk8 YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgb2xkLiBDYW4gYW55b25lIGNv bmZpcm0gdGhhdCB0aGVzZSB3ZXJlIGZpeGVkLiBPbmx5PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKg IMKgIMKgIMKgIMKgIMKgIHRoaW5nIHVzaW5nIHBvcnQgOTgzMCBpcyB0aGUgYWRtaW4tc2Vydi4g QmVsb3cgYXJlIHRoZTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBycG0g dmVyc2lvbnMgSSBoYXZlIGluc3RhbGxlZCBhbmQgdGhlIENWRSYjMzk7cyByZXRuYTxicj4KJmd0 OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBzdXBwb3NpZGx5IGRldGVjdGVkLjxicj4K Jmd0OyZndDsmZ3Q7Jmd0Ozxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCAz ODktYWRtaW51dGlsLTEuMS4xOS0xLmVsNi54ODZfNjQ8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAg wqAgwqAgwqAgwqAgwqAgMzg5LWRzLWNvbnNvbGUtZG9jLTEuMi42LTEuZWw2Lm5vYXJjaDxicj4K Jmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCAzODktYWRtaW4tMS4xLjM1LTEuZWw2 Lng4Nl82NDxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCAzODktYWRtaW4t Y29uc29sZS0xLjEuOC01LmZjMTkubm9hcmNoPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKg IMKgIMKgIMKgIDM4OS1jb25zb2xlLTEuMS43LTEuZWw2Lm5vYXJjaDxicj4KJmd0OyZndDsmZ3Q7 Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCAzODktZHMtMS4yLjItMS5lbDYubm9hcmNoPGJyPgomZ3Q7 Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIDM4OS1kcy1iYXNlLWxpYnMtMS4yLjExLjI1 LTEuZWw2Lng4Nl82NDxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCAzODkt ZHMtYmFzZS0xLjIuMTEuMjUtMS5lbDYueDg2XzY0PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKg IMKgIMKgIMKgIMKgIDM4OS1kc2d3LTEuMS4xMS0xLmVsNi54ODZfNjQ8YnI+CiZndDsmZ3Q7Jmd0 OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgMzg5LWRzLWNvbnNvbGUtMS4yLjYtMS5lbDYubm9hcmNo PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIDM4OS1hZG1pbi1jb25zb2xl LWRvYy0xLjEuOC01LmZjMTkubm9hcmNoPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7PGJyPgo8L2Rpdj48 L2Rpdj4mZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEF1ZGl0IElEOjYzMTBWdWwg SUQ6Ti9BPGJyPgo8ZGl2IGNsYXNzPSIiPiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAg wqAgUmlzayBMZXZlbDpNZWRpdW08YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAg wqAgU2V2IENvZGU6Q2F0ZWdvcnkgSUk8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAg wqAgwqAgUENJIExldmVsOk1lZGl1bSAoRmFpbCkgLSBDVlNTIFNjb3JlPGJyPgomZ3Q7Jmd0OyZn dDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENWU1MgU2NvcmU6NSBbQVY6Ti9BQzpML0F1Ok4vQzpO L0k6Ti9BOlBdPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEJ1Z1RyYXEg SUQyNzIzNCwyNjgzOCwyNzIzNiwyNzIzNzxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDC oCDCoCDCoCBDVkU6Q1ZFLTIwMDgtMDAwNSxDVkUtMjAwNy02Mzg4LENWRS0yMDA3LTY0MjIsQ1ZF LTIwMDctNjQ8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgMjAsQ1ZFLTIw MDctNTAwMCxDVkUtMjAwNy02NDIxLENWRS0yMDA4LTE2Nzg8YnI+CiZndDsmZ3Q7Jmd0OyZndDsg wqAgwqAgwqAgwqAgwqAgwqAgQ0NFOk4vQTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDC oCDCoCDCoCBFeHBsb2l0Ok5vPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKg IElBVjpOL0E8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgU1RJRzo8YnI+ CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQ29udGV4dDpUQ1A6OTgzMDxicj4K Jmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBSZXN1bHQ6U3VjY2Vzczxicj4KJmd0 OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBUZXN0ZWQgVmFsdWU6QlIgVCBXQiBTZXJ2 ZXI6PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIChBcGFjaGUoXChbW11e KV0qXCkpPy8oKDJcLigoMihcLltbXTAtN10pPyl8KDAoXC4oW1tdMS01XT9bW10wLTldfDZbW10w LTJdKSk8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgPyl8KDEoXC4uKik/ KSkpfCgxXC4oKDMoXC4oW1tdMS0zXT9bW10wLTldfDQwKSk/KXwoW1tdMC0yXShcLi4qKT8pKSl8 KDArXC4uKikpPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgICgkfFtbXV4w LTkuXShbW11eKF0qXChbW11eUl1bW11eKV0qXCkpKltbXV4oKV0qJCkpPGJyPgomZ3Q7Jmd0OyZn dDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEZvdW5kIFZhbHVlOlNlcnZlcjogQXBhY2hlLzIuMiMj Q29udGVudC1MZW5ndGg6PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIDMw MSMjQ29ubmVjdGlvbjo8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgY2xv c2UjI0NvbnRlbnQtVHlwZTogdGV4dC9odG1sOzxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDC oCDCoCDCoCDCoCBjaGFyc2V0Wz1daXNvLTg4NTktMSMjIyMmbHQ7IURPQ1RZUEUgSFRNTCBQVUJM SUM8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgJnF1b3Q7LS8vSUVURi8v RFREIEhUTUwgMi4wLy9FTiZxdW90OyZndDsjJmx0O2h0bWwmZ3Q7Jmx0O2hlYWQmZ3Q7IyZsdDt0 aXRsZSZndDs0MDQgTm90PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEZv dW5kJmx0Oy90aXRsZSZndDsjJmx0Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyMmbHQ7aDEmZ3Q7Tm90 IEZvdW5kJmx0Oy9oMSZndDs8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAg KHRydW5jYXRlZC4uLik8YnI+CiZndDsmZ3Q7Jmd0OyZndDs8YnI+CjwvZGl2PiZndDsmZ3Q7Jmd0 OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQXVkaXQgSUQ6NjA1OVZ1bCBJRDpOL0E8YnI+CjxkaXYg Y2xhc3M9IiI+Jmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBSaXNrIExldmVsOk1l ZGl1bTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBTZXYgQ29kZTpDYXRl Z29yeSBJSTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBQQ0kgTGV2ZWw6 TWVkaXVtIChGYWlsKSAtIENWU1MgU2NvcmU8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAg wqAgwqAgwqAgQ1ZTUyBTY29yZTo1IFtBVjpOL0FDOkwvQXU6Ti9DOlAvSTpOL0E6Tl08YnI+CiZn dDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQnVnVHJhcSBJRDI0MjE1LDI0NjQ1LDI1 NDg5LDI0NjQ5LDI0NTUzPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENW RTpDVkUtMjAwNy0xODYyLENWRS0yMDA3LTM4NDcsQ1ZFLTIwMDctMzMwNCxDVkUtMjAwNi01Nzxi cj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCA1MixDVkUtMjAwNy0xODYzPGJy PgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENDRTpOL0E8YnI+CiZndDsmZ3Q7 Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgRXhwbG9pdDpObzxicj4KJmd0OyZndDsmZ3Q7Jmd0 OyDCoCDCoCDCoCDCoCDCoCDCoCBJQVY6Ti9BPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKg IMKgIMKgIMKgIFNUSUc6PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENv bnRleHQ6VENQOjk4MzA8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgUmVz dWx0OlN1Y2Nlc3M8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgVGVzdGVk IFZhbHVlOlJSIFQgV0I8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgKEFw YWNoZShcKFtbXV4pXSpcKSk/LygyXC4yKFwuW1tdMC01XSk/KSgkfFtbXV4wLTkuXShbW11eKF0q XChbW11eUl1bW11eKV0qXCk8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAg KSpbW11eKCldKiQpKTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCBGb3Vu ZCBWYWx1ZTpBcGFjaGUvMi4yPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7PGJyPgo8L2Rpdj4mZ3Q7Jmd0 OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEF1ZGl0IElEOjk4MjBWdWwgSUQ6Ti9BPGJyPgo8 ZGl2IGNsYXNzPSIiPiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgUmlzayBMZXZl bDpNZWRpdW08YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgU2V2IENvZGU6 Q2F0ZWdvcnkgSUk8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgUENJIExl dmVsOkhpZ2ggKEZhaWwpIC0gQ1ZTUyBTY29yZTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDC oCDCoCDCoCDCoCBDVlNTIFNjb3JlOjcuOCBbQVY6Ti9BQzpML0F1Ok4vQzpOL0k6Ti9BOkNdPGJy PgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEJ1Z1RyYXEgSUQzNTU2NSwzNTI1 MywzNTYyMywzNTI1MSwzNDY2MywzNTIyMSwzNTExNTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDC oCDCoCDCoCDCoCDCoCBDVkU6Q1ZFLTIwMDktMTg5MSxDVkUtMjAwOS0xOTU1LENWRS0yMDA5LTEx OTEsQ1ZFLTIwMDktMDA8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgMjMs Q1ZFLTIwMDktMTk1NixDVkUtMjAwOS0xMTk1LENWRS0yMDA5LTE4OTA8YnI+CiZndDsmZ3Q7Jmd0 OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgQ0NFOk4vQTxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDC oCDCoCDCoCDCoCDCoCBFeHBsb2l0Olllczxicj4KJmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDC oCDCoCDCoCBJQVY6Ti9BPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIFNU SUc6PGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIENvbnRleHQ6VENQOjk4 MzA8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgUmVzdWx0OlN1Y2Nlc3M8 YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgVGVzdGVkPGJyPgomZ3Q7Jmd0 OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIFZhbHVlOkFQQUNIRSgtQURWQU5DRURFWFRSQU5F VFNFUlZFUik/LzJcLjIoXC4oMVtbXTAxXXxbW10wPGJyPgomZ3Q7Jmd0OyZndDsmZ3Q7IMKgIMKg IMKgIMKgIMKgIMKgIC05XSkoXC5bW10wLTldKykqKT8oJHxbW11eMC05Ll0pPGJyPgomZ3Q7Jmd0 OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIEZvdW5kIFZhbHVlOkFQQUNIRS8yLjI8YnI+CiZn dDsmZ3Q7Jmd0OyZndDs8YnI+CiZndDsmZ3Q7Jmd0OyZndDs8YnI+CiZndDsmZ3Q7Jmd0OyZndDs8 YnI+CiZndDsmZ3Q7Jmd0OyZndDs8YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAg wqAgLS08YnI+CiZndDsmZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgMzg5IHVzZXJzIG1h aWxpbmcgbGlzdDxicj4KPC9kaXY+Jmd0OyZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCA8 YSBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNl cnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+ICZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRv OjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9y YXByb2plY3Qub3JnPC9hPiZndDs8YnI+CgoKPGRpdiBjbGFzcz0iIj4mZ3Q7Jmd0OyZndDsmZ3Q7 IMKgIMKgIMKgIMKgIMKgIMKgIDxhIGhyZWY9Imh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5v cmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2Fk bWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzPC9hPjxicj4K Jmd0OyZndDsmZ3Q7PGJyPgomZ3Q7Jmd0OyZndDs8YnI+CiZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDC oCDCoCDCoCAtLTxicj4KJmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIMKgIMKgIDM4OSB1c2VycyBt YWlsaW5nIGxpc3Q8YnI+CiZndDsmZ3Q7Jmd0OyDCoCDCoCDCoCDCoCDCoCDCoCA8YSBocmVmPSJt YWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNlcnNAbGlzdHMu ZmVkb3JhcHJvamVjdC5vcmc8L2E+PGJyPgo8L2Rpdj4mZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAg wqAgwqAgJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXBy b2plY3Qub3JnIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+Jmd0Ozxicj4K PGRpdiBjbGFzcz0iIj4mZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgwqAgwqAgPGEgaHJlZj0iaHR0 cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9s aXN0aW5mby8zODktdXNlcnM8L2E+PGJyPgomZ3Q7Jmd0OyZndDs8YnI+CiZndDsmZ3Q7Jmd0Ozxi cj4KJmd0OyZndDsmZ3Q7PGJyPgomZ3Q7Jmd0OyZndDsgwqAgwqAgwqAgwqAgLS08YnI+CiZndDsm Z3Q7Jmd0OyDCoCDCoCDCoCDCoCAzODkgdXNlcnMgbWFpbGluZyBsaXN0PGJyPgo8L2Rpdj4mZ3Q7 Jmd0OyZndDsgwqAgwqAgwqAgwqAgPGEgaHJlZj0ibWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRv cmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9hPiAmbHQ7 bWFpbHRvOjxhIGhyZWY9Im1haWx0bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmci PjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZzwvYT4mZ3Q7PGJyPgoKCjxkaXYgY2xh c3M9IiI+Jmd0OyZndDsmZ3Q7IMKgIMKgIMKgIMKgIDxhIGhyZWY9Imh0dHBzOi8vYWRtaW4uZmVk b3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVz ZXJzPC9hPjxicj4KJmd0OyZndDs8YnI+CiZndDsmZ3Q7PGJyPgomZ3Q7Jmd0OyDCoCDCoCDCoCDC oCAtLTxicj4KJmd0OyZndDsgwqAgwqAgwqAgwqAgMzg5IHVzZXJzIG1haWxpbmcgbGlzdDxicj4K Jmd0OyZndDsgwqAgwqAgwqAgwqAgPGEgaHJlZj0ibWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRv cmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9hPjxicj4K PC9kaXY+Jmd0OyZndDsgwqAgwqAgwqAgwqAgJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86Mzg5 LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNlcnNAbGlzdHMuZmVkb3JhcHJv amVjdC5vcmc8L2E+Jmd0Ozxicj4KPGRpdiBjbGFzcz0iIj4mZ3Q7Jmd0OyDCoCDCoCDCoCDCoCA8 YSBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8v Mzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9y Zy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VyczwvYT48YnI+CiZndDsmZ3Q7PGJyPgomZ3Q7Jmd0 Ozxicj4KJmd0OyZndDs8YnI+CiZndDsmZ3Q7IMKgIMKgIC0tPGJyPgomZ3Q7Jmd0OyDCoCDCoCAz ODkgdXNlcnMgbWFpbGluZyBsaXN0PGJyPgo8L2Rpdj4mZ3Q7Jmd0OyDCoCDCoCA8YSBocmVmPSJt YWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNlcnNAbGlzdHMu ZmVkb3JhcHJvamVjdC5vcmc8L2E+ICZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOjM4OS11c2Vy c0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qu b3JnPC9hPiZndDs8YnI+CjxkaXYgY2xhc3M9IiI+Jmd0OyZndDsgwqAgwqAgPGEgaHJlZj0iaHR0 cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9s aXN0aW5mby8zODktdXNlcnM8L2E+PGJyPgomZ3Q7PGJyPgomZ3Q7PGJyPgomZ3Q7IMKgIMKgIC0t PGJyPgomZ3Q7IMKgIMKgIDM4OSB1c2VycyBtYWlsaW5nIGxpc3Q8YnI+CiZndDsgwqAgwqAgPGEg aHJlZj0ibWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZyI+Mzg5LXVzZXJz QGxpc3RzLmZlZG9yYXByb2plY3Qub3JnPC9hPjxicj4KPC9kaXY+Jmd0OyDCoCDCoCAmbHQ7bWFp bHRvOjxhIGhyZWY9Im1haWx0bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmciPjM4 OS11c2Vyc0BsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZzwvYT4mZ3Q7PGJyPgo8ZGl2IGNsYXNzPSJI T0VuWmIiPjxkaXYgY2xhc3M9Img1Ij4mZ3Q7IMKgIMKgIDxhIGhyZWY9Imh0dHBzOi8vYWRtaW4u ZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2FkbWluLmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5 LXVzZXJzPC9hPjxicj4KJmd0Ozxicj4KJmd0Ozxicj4KJmd0Ozxicj4KJmd0Ozxicj4KJmd0OyAt LTxicj4KJmd0OyAzODkgdXNlcnMgbWFpbGluZyBsaXN0PGJyPgomZ3Q7IDxhIGhyZWY9Im1haWx0 bzozODktdXNlcnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmciPjM4OS11c2Vyc0BsaXN0cy5mZWRv cmFwcm9qZWN0Lm9yZzwvYT48YnI+CiZndDsgPGEgaHJlZj0iaHR0cHM6Ly9hZG1pbi5mZWRvcmFw cm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4OS11c2VycyIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vYWRtaW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnM8 L2E+PGJyPgomZ3Q7PGJyPgo8YnI+Ci0tPGJyPgozODkgdXNlcnMgbWFpbGluZyBsaXN0PGJyPgo8 YSBocmVmPSJtYWlsdG86Mzg5LXVzZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIj4zODktdXNl cnNAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2FkbWlu LmZlZG9yYXByb2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvLzM4 OS11c2VyczwvYT48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pgo= --===============1864296737802636852==-- From david_list at boreham.org Thu May 29 17:31:05 2014 Content-Type: multipart/mixed; boundary="===============1112564556242014305==" MIME-Version: 1.0 From: David Boreham To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 11:30:48 -0600 Message-ID: <53876EC8.5060700@boreham.org> In-Reply-To: CANd=zCh0oFuOeLsow9ZX96L29hrkQ1G5OQC=545DFqoJCBEoiA@mail.gmail.com --===============1112564556242014305== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 5/29/2014 11:27 AM, John Trump wrote: > I believe they are false positives. I am just searching for "proof" to = > provide to person running sans. > If it were really testing for the vulnerabilities it would have to be = presenting requests that exploit them and checking the the desired = outcome (for example that it can crash the httpd process). You could = look for evidence of such activity using tcpdump, and also in the httpd = access logs. --===============1112564556242014305==-- From trumpjk at gmail.com Thu May 29 17:33:54 2014 Content-Type: multipart/mixed; boundary="===============5222632491642243283==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 13:33:10 -0400 Message-ID: In-Reply-To: 53876EC8.5060700@boreham.org --===============5222632491642243283== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable With the answer Rob gave of "389-admin runs a separate instance of the system httpd" I think this should be proof enough that the hits are false positives. I can show that I have the latest update installed from Red Hat. I appreciate everyone's help. On Thu, May 29, 2014 at 1:30 PM, David Boreham wr= ote: > > On 5/29/2014 11:27 AM, John Trump wrote: > >> I believe they are false positives. I am just searching for "proof" to >> provide to person running sans. >> >> > If it were really testing for the vulnerabilities it would have to be > presenting requests that exploit them and checking the the desired outcome > (for example that it can crash the httpd process). You could look for > evidence of such activity using tcpdump, and also in the httpd access log= s. > > > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > --===============5222632491642243283== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+V2l0aCB0aGUgYW5zd2VyIFJvYiBnYXZlIG9mICZxdW90OzM4OS1hZG1p biBydW5zIGEgc2VwYXJhdGUgaW5zdGFuY2Ugb2YgdGhlIHN5c3RlbSBodHRwZCZxdW90OyBJIHRo aW5rIHRoaXMgc2hvdWxkIGJlIHByb29mIGVub3VnaCB0aGF0IHRoZSBoaXRzIGFyZSBmYWxzZSBw b3NpdGl2ZXMuIEkgY2FuIHNob3cgdGhhdCBJIGhhdmUgdGhlIGxhdGVzdCB1cGRhdGUgaW5zdGFs bGVkIGZyb20gUmVkIEhhdC48ZGl2PgoKPGJyPjwvZGl2PjxkaXY+SSBhcHByZWNpYXRlIGV2ZXJ5 b25lJiMzOTtzIGhlbHAuPC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48 YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFRodSwgTWF5IDI5LCAyMDE0IGF0IDE6MzAg UE0sIERhdmlkIEJvcmVoYW0gPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86ZGF2 aWRfbGlzdEBib3JlaGFtLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRhdmlkX2xpc3RAYm9yZWhhbS5v cmc8L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPgoKPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1 b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7 cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBjbGFzcz0iIj48YnI+Ck9uIDUvMjkvMjAxNCAxMToyNyBB TSwgSm9obiBUcnVtcCB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRp bmctbGVmdDoxZXgiPgpJIGJlbGlldmUgdGhleSBhcmUgZmFsc2UgcG9zaXRpdmVzLiBJIGFtIGp1 c3Qgc2VhcmNoaW5nIGZvciAmcXVvdDtwcm9vZiZxdW90OyB0byBwcm92aWRlIHRvIHBlcnNvbiBy dW5uaW5nIHNhbnMuPGJyPgo8YnI+CjwvYmxvY2txdW90ZT4KPGJyPjwvZGl2PgpJZiBpdCB3ZXJl IHJlYWxseSB0ZXN0aW5nIGZvciB0aGUgdnVsbmVyYWJpbGl0aWVzIGl0IHdvdWxkIGhhdmUgdG8g YmUgcHJlc2VudGluZyByZXF1ZXN0cyB0aGF0IGV4cGxvaXQgdGhlbSBhbmQgY2hlY2tpbmcgdGhl IHRoZSBkZXNpcmVkIG91dGNvbWUgKGZvciBleGFtcGxlIHRoYXQgaXQgY2FuIGNyYXNoIHRoZSBo dHRwZCBwcm9jZXNzKS4gWW91IGNvdWxkIGxvb2sgZm9yIGV2aWRlbmNlIG9mIHN1Y2ggYWN0aXZp dHkgdXNpbmcgdGNwZHVtcCwgYW5kIGFsc28gaW4gdGhlIGh0dHBkIGFjY2VzcyBsb2dzLjxkaXYg Y2xhc3M9IkhPRW5aYiI+Cgo8ZGl2IGNsYXNzPSJoNSI+PGJyPgo8YnI+Cjxicj4KPGJyPgo8YnI+ Ci0tPGJyPgozODkgdXNlcnMgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86Mzg5LXVz ZXJzQGxpc3RzLmZlZG9yYXByb2plY3Qub3JnIiB0YXJnZXQ9Il9ibGFuayI+Mzg5LXVzZXJzQGxp c3RzLmZlZG9yYXByb2plY3QuPHU+PC91Pm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vYWRt aW4uZmVkb3JhcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby8zODktdXNlcnMiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL2FkbWluLmZlZG9yYXByb2plY3QuPHU+PC91Pm9yZy9tYWlsbWFuL2xp c3RpbmZvLzM4OS11c2VyczwvYT48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwv ZGl2Pgo= --===============5222632491642243283==-- From david_list at boreham.org Thu May 29 17:42:32 2014 Content-Type: multipart/mixed; boundary="===============2152399751818106572==" MIME-Version: 1.0 From: David Boreham To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 11:42:19 -0600 Message-ID: <5387717B.4010408@boreham.org> In-Reply-To: CANd=zCiT7T9xyxsgggmkYn1cYdPmkA+1EVCQC28hc_Scedo1oA@mail.gmail.com --===============2152399751818106572== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 5/29/2014 11:33 AM, John Trump wrote: > With the answer Rob gave of "389-admin runs a separate instance of the = > system httpd" I think this should be proof enough that the hits are = > false positives. I can show that I have the latest update installed = > from Red Hat. I wouldn't take his word for it ;) Identify the process listening on the port using netstat -nlp then use = lsof -p to verify the location of that process' binary files. Check that = those files came from the system httpd package. --===============2152399751818106572==-- From rcritten at redhat.com Thu May 29 18:02:37 2014 Content-Type: multipart/mixed; boundary="===============6522689285174117817==" MIME-Version: 1.0 From: Rob Crittenden To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 14:02:32 -0400 Message-ID: <53877638.4000507@redhat.com> In-Reply-To: 5387717B.4010408@boreham.org --===============6522689285174117817== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable David Boreham wrote: > = > On 5/29/2014 11:33 AM, John Trump wrote: >> With the answer Rob gave of "389-admin runs a separate instance of the >> system httpd" I think this should be proof enough that the hits are >> false positives. I can show that I have the latest update installed >> from Red Hat. > = > I wouldn't take his word for it ;) Hey now! > Identify the process listening on the port using netstat -nlp then use > lsof -p to verify the location of that process' binary files. Check that > those files came from the system httpd package. You can optionally set ServerTokens to Prod in the admin server httpd.conf and restart the server, then re-run the scanner. That should make the version-based errors go away (or it could make matters worse). See http://httpd.apache.org/docs/2.2/mod/core.html#servertokens rob --===============6522689285174117817==-- From trumpjk at gmail.com Thu May 29 18:12:09 2014 Content-Type: multipart/mixed; boundary="===============8502316659846180530==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: Re: [389-users] Retna Scan Results Date: Thu, 29 May 2014 14:11:27 -0400 Message-ID: In-Reply-To: 5387717B.4010408@boreham.org --===============8502316659846180530== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Verified the process running is using system httpd: /usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf httpd.worker is provided by system httpd rpm. On Thu, May 29, 2014 at 1:42 PM, David Boreham wr= ote: > > On 5/29/2014 11:33 AM, John Trump wrote: > >> With the answer Rob gave of "389-admin runs a separate instance of the >> system httpd" I think this should be proof enough that the hits are false >> positives. I can show that I have the latest update installed from Red H= at. >> > > I wouldn't take his word for it ;) > > Identify the process listening on the port using netstat -nlp then use > lsof -p to verify the location of that process' binary files. Check that > those files came from the system httpd package. > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > --===============8502316659846180530== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+VmVyaWZpZWQgdGhlIHByb2Nlc3MgcnVubmluZyBpcyB1c2luZyBzeXN0 ZW0gaHR0cGQ6PGRpdj48YnI+PC9kaXY+PGRpdj4vdXNyL3NiaW4vaHR0cGQud29ya2VyIC1rIHN0 YXJ0IC1mIC9ldGMvZGlyc3J2L2FkbWluLXNlcnYvaHR0cGQuY29uZjxicj48L2Rpdj48ZGl2Pjxi cj48L2Rpdj48ZGl2Pmh0dHBkLndvcmtlciBpcyBwcm92aWRlZCBieSBzeXN0ZW0gaHR0cGQgcnBt LjwvZGl2PgoKPC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48YnI+PGRpdiBjbGFz cz0iZ21haWxfcXVvdGUiPk9uIFRodSwgTWF5IDI5LCAyMDE0IGF0IDE6NDIgUE0sIERhdmlkIEJv cmVoYW0gPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86ZGF2aWRfbGlzdEBib3Jl aGFtLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRhdmlkX2xpc3RAYm9yZWhhbS5vcmc8L2E+Jmd0Ozwv c3Bhbj4gd3JvdGU6PGJyPgoKPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0i bWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0 OjFleCI+PGRpdiBjbGFzcz0iIj48YnI+Ck9uIDUvMjkvMjAxNCAxMTozMyBBTSwgSm9obiBUcnVt cCB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdp bjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgi PgpXaXRoIHRoZSBhbnN3ZXIgUm9iIGdhdmUgb2YgJnF1b3Q7Mzg5LWFkbWluIHJ1bnMgYSBzZXBh cmF0ZSBpbnN0YW5jZSBvZiB0aGUgc3lzdGVtIGh0dHBkJnF1b3Q7IEkgdGhpbmsgdGhpcyBzaG91 bGQgYmUgcHJvb2YgZW5vdWdoIHRoYXQgdGhlIGhpdHMgYXJlIGZhbHNlIHBvc2l0aXZlcy4gSSBj YW4gc2hvdyB0aGF0IEkgaGF2ZSB0aGUgbGF0ZXN0IHVwZGF0ZSBpbnN0YWxsZWQgZnJvbSBSZWQg SGF0Ljxicj4KCgo8L2Jsb2NrcXVvdGU+Cjxicj48L2Rpdj4KSSB3b3VsZG4mIzM5O3QgdGFrZSBo aXMgd29yZCBmb3IgaXQgOyk8YnI+Cjxicj4KSWRlbnRpZnkgdGhlIHByb2Nlc3MgbGlzdGVuaW5n IG9uIHRoZSBwb3J0IHVzaW5nIG5ldHN0YXQgLW5scCB0aGVuIHVzZSBsc29mIC1wIHRvIHZlcmlm eSB0aGUgbG9jYXRpb24gb2YgdGhhdCBwcm9jZXNzJiMzOTsgYmluYXJ5IGZpbGVzLiBDaGVjayB0 aGF0IHRob3NlIGZpbGVzIGNhbWUgZnJvbSB0aGUgc3lzdGVtIGh0dHBkIHBhY2thZ2UuPGRpdiBj bGFzcz0iSE9FblpiIj48ZGl2IGNsYXNzPSJoNSI+Cgo8YnI+Cjxicj4KPGJyPgotLTxicj4KMzg5 IHVzZXJzIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOjM4OS11c2Vyc0BsaXN0cy5m ZWRvcmFwcm9qZWN0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjM4OS11c2Vyc0BsaXN0cy5mZWRvcmFw cm9qZWN0Ljx1PjwvdT5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2FkbWluLmZlZG9yYXBy b2plY3Qub3JnL21haWxtYW4vbGlzdGluZm8vMzg5LXVzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0 cHM6Ly9hZG1pbi5mZWRvcmFwcm9qZWN0Ljx1PjwvdT5vcmcvbWFpbG1hbi9saXN0aW5mby8zODkt dXNlcnM8L2E+PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4K --===============8502316659846180530==--