Paul Schmehl
02/06/06, 21:00
--==========159D6E491BD71FEC11E2==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
--On June 1, 2006 12:50:15 AM +0000 brokejunker@yahoo.com wrote:
> Squirrelmail local file inclusion bug in functions/plugin.php .
> Tested on the latest 1.4.x version.
> No authentication needed.
>
> if (isset($plugins) && is_array($plugins)) {
> foreach ($plugins as $name) {
> use_plugin($name);
> }
> ...
> function use_plugin ($name) {
> if (file_exists(SM_PATH . "plugins/$name/setup.php")) {
> include_once(SM_PATH . "plugins/$name/setup.php");
> $function =3D "squirrelmail_plugin_init_$name";
> if (function_exists($function)) {
> $function();
> }
> }
> }
> ....
>
> If register_globals is on we can control the $name variable.
>
This is the second "bug" I've seen in the past week that requires=20
register_globals to be on. Yet register_globals has been off by default=20
for the past four years. <http://us2.php.net/ChangeLog-4.php#4.2.0>
The developers of PHP specifically address its use and warn against it=20
unless you know what you're doing. <http://us2.php.net/register_globals>
Squirrelmail even warns specifically against using register_globals =3D on=20
and checks for it when installing.
grep register_globals /usr/local/share/doc/squirrelmail/*
/usr/local/share/doc/squirrelmail/ChangeLog: - Added PHP register_globals=20
check to configuration test utility.
/usr/local/share/doc/squirrelmail/ChangeLog: - Fixed use of=20
squirrelmail_language cookie with PHP register_globals =3D
/usr/local/share/doc/squirrelmail/ChangeLog: - Prefs caching didn't work=20
properly with register_globals off (#995102).
/usr/local/share/doc/squirrelmail/ChangeLog: by register_globals =3D =
off.
/usr/local/share/doc/squirrelmail/ChangeLog: - This release is compatible=20
with installations that have register_globals set to off.
/usr/local/share/doc/squirrelmail/INSTALL: It is highly advised to NOT=20
turn on register_globals, as this can lead
/usr/local/share/doc/squirrelmail/INSTALL: to security holes. If you must=20
use register_globals for some applications,
/usr/local/share/doc/squirrelmail/security.txt:- PHP configuration. It's=20
very important to turn register_globals OFF.
/usr/local/share/doc/squirrelmail/security.txt: could only be exploited=20
when register_globals was set to on. If you
/usr/local/share/doc/squirrelmail/security.txt: need register_globals for=20
other web applications, turn it on specifically
Yet know we're getting "security advisories" warning, hey, if you change=20
the defaults and ignore all the warnings, you too can write insecure code!
Is human stupidity a software bug?
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
--==========159D6E491BD71FEC11E2==========
Content-Type: application/pkcs7-signature
Content-Transfer-Encoding: base64
MIIO7AYJKoZIhvcNAQcCoIIO3TCCDtkCAQExCzAJBgUrDgMCGg UAMAsGCSqGSIb3
DQEHAaCCDFowggVzMIIE3KADAgECAhAhQ2wPNrJWs2gXrRmRcA j6MA0GCSqGSIb3
DQEBBAUAMIHqMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZi BUZXhhcyBTeXN0
ZW0xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOz A5BgNVBAsTMlRl
cm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb2 0vcnBhIChjKTk5
MTIwMAYDVQQLEylDbGFzcyAyIENBIC0gT25TaXRlIEluZGl2aW R1YWwgU3Vic2Ny
aWJlcjEtMCsGA1UEAxMkVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgYXQgRGFsbGFz
IENBMB4XDTA1MDgxMDAwMDAwMFoXDTA2MDgxMDIzNTk1OVowgf QxJzAlBgNVBAoU
HlRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIFN5c3RlbTEtMCsGA1 UECxQkVGhlIFVu
aXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFzIENBMUYwRAYDVQ QLEz13d3cudmVy
aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC4gYnkgUm VmLixMSUFCLkxU
RChjKTk5MRgwFgYDVQQLFA9NYWlsIFN0b3AgLSBVVEQxFTATBg NVBAMTDFBhdWwg
U2NobWVobDEhMB8GCSqGSIb3DQEJARYScGF1bHNAdXRkYWxsYX MuZWR1MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEoeaWOSJTLA4v6OJEuC fJukxz2ljvM2G7
CovCFsCYK7FnYSzTjFAk8Vhe+STjF4ehWIMnyGzWHYP6Vude2s WSxsXvUANOsjNK
eWZ5rSjFS52u+1JU2IiIiwISnlAmOKC9eqXGq7iIPz35w3Vbpx PeGe6GWK4ZfexT
KSQtfPYfSQIDAQABo4ICDDCCAggwCQYDVR0TBAIwADAdBgNVHR EEFjAUgRJwYXVs
c0B1dGRhbGxhcy5lZHUwggEkBgNVHSAEggEbMIIBFzCCARMGC2 CGSAGG+EUBBwEG
MIIBAjArBggrBgEFBQcCARYfaHR0cHM6Ly93d3cudmVyaXNpZ2 4uY29tL3JwYS1r
cjCB0gYIKwYBBQUHAgIwgcUagcJOT1RJQ0U6IFByaXZhdGUga2 V5IG1heSBiZSBy
ZWNvdmVyZWQgYnkgVmVyaVNpZ24ncyBjdXN0b21lciB3aG8gbW F5IGJlIGFibGUg
dG8gZGVjcnlwdCBtZXNzYWdlcyB5b3Ugc2VuZCB0byBjZXJ0aW ZpY2F0ZSBob2xk
ZXIuICBVc2UgaXMgc3ViamVjdCB0byB0ZXJtcyBhdCBodHRwcz ovL3d3dy52ZXJp
c2lnbi5jb20vcnBhLWtyIChjKTk5LjARBglghkgBhvhCAQEEBA MCB4AwdQYDVR0f
BG4wbDBqoGigZoZkaHR0cDovL29uc2l0ZWNybC52ZXJpc2lnbi 5jb20vVGhlVW5p
dmVyc2l0eW9mVGV4YXNTeXN0ZW1UaGVVbml2ZXJzaXR5b2ZUZX hhc2F0RGFsbGFz
Q0EvTGF0ZXN0Q1JMLmNybDALBgNVHQ8EBAMCB4AwHQYDVR0lBB YwFAYIKwYBBQUH
AwQGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBAUAA4GBAEHYOgkUsy vG/DYGFAKSJ+Iq
UY4NVstEHCKHim3Cckq0Chxf+yRQB4tvOrwPTFAHlMgqJKr4yV XEvwJmhAvJtO/V
nYex/brnBVky3UI288HXzk7439zbvmmczLZmOhsR3A3TnKHX9vdTmJ7 sxWExDszR
QntTfoUYcQihaFVOqZ9sMIID2DCCA0GgAwIBAgIQQewfPacUB5 bE9tUM3dEPZTAN
BgkqhkiG9w0BAQUFADCBwTELMAkGA1UEBhMCVVMxFzAVBgNVBA oTDlZlcmlTaWdu
LCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYX J5IENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOT k4IFZlcmlTaWdu
LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBg NVBAsTFlZlcmlT
aWduIFRydXN0IE5ldHdvcmswHhcNOTkwMzMxMDAwMDAwWhcNMD kwMzMwMjM1OTU5
WjCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgU3lzdGVtMR8w
HQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQ QLEzJUZXJtcyBv
ZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYS AoYyk5OTEyMDAG
A1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIF N1YnNjcmliZXIx
LTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IE RhbGxhcyBDQTCB
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv+rvh+seCsEA+S IRwdHBzNt62r42
0nBgMGDlGeBTLzX0yagpBdbePZ3zBppkfb7Rh1R4m/+iePH7h6vD/IdMwklBDeHA
0qXX/H7/QlFOdPMB1WhzpV0EMfjmKSVjqCOaRGqBiw+wOfHv20ZYw7q4z0 vzesGi
SZWDI0O6mxqPMoUCAwEAAaOBpTCBojApBgNVHREEIjAgpB4wHD EaMBgGA1UEAxMR
UHJpdmF0ZUxhYmVsMS0xNDAwEQYJYIZIAYb4QgEBBAQDAgEGME QGA1UdIAQ9MDsw
OQYLYIZIAYb4RQEHAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly 93d3cudmVyaXNp
Z24uY29tL1JQQTAPBgNVHRMECDAGAQH/AgEAMAsGA1UdDwQEAwIBBjANBgkqhkiG
9w0BAQUFAAOBgQBTCbXcsraJ0SBQg8k4edzICLJJv7hTg2+KzL Lkenz8o+gPX2Fe
X5cElRJa0pUBIvG87fFUtlSmVBihnVS8BmkExwIhN6KCOYinrK Cf6IMZXZJIORpZ
giQgQ7yGlRLcg3Th5uMTvmqkhwAxMSMHJZuvuixRkQ5ZpqMXiN K0zlQXHDCCAwMw
ggJsAhEAuS9gzIifoXpGCbhbcGyKrzANBgkqhkiG9w0BAQUFAD CBwTELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQ QLEzNDbGFzcyAy
IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaX R5IC0gRzIxOjA4
BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIG F1dGhvcml6ZWQg
dXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldH dvcmswHhcNOTgw
NTE4MDAwMDAwWhcNMjgwODAxMjM1OTU5WjCBwTELMAkGA1UEBh MCVVMxFzAVBgNV
BAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIF B1YmxpYyBQcmlt
YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4Bg NVBAsTMShjKSAx
OTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdX NlIG9ubHkxHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmswgZ8wDQYJKo ZIhvcNAQEBBQAD
gY0AMIGJAoGBAKeIASF0LOcaA/CY4Zc8DyEI8Zzbl+ma/MIEBhO+X1LIzB4sElYs
uAFpLMyZH62wlq55BPITOcF7mLoILOjChBMsqmnpCfTHqQKkQs IjT0rY8A6i+zFs
yeZvmScH9eb0THiebetGhvq5hslU8rLEr9RGHFrJFTD/DWz1LQ5tzn93AgMBAAEw
DQYJKoZIhvcNAQEFBQADgYEAci75f9HxcfvEnvbFXlGKQJi4aP ibHIPY4p29/+2h
5mbqLwn0ytfqpSuV9iRghk1ELoOlxC2g0654aW9y2myuCPBjkj fmu8QwF613zEk1
qs/Yj9G+txiWR3NqVCI0ZC22FptZW7RRWTqzCxT0Et9noPStMmRes UZyJ4wSe8VE
tK4xggJaMIICVgIBATCB/zCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2Yg
VGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdC BOZXR3b3JrMTsw
OQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudm VyaXNpZ24uY29t
L3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2 l0ZSBJbmRpdmlk
dWFsIFN1YnNjcmliZXIxLTArBgNVBAMTJFRoZSBVbml2ZXJzaX R5IG9mIFRleGFz
IGF0IERhbGxhcyBDQQIQIUNsDzayVrNoF60ZkXAI+jAJBgUrDg MCGgUAoIGxMBgG
CSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ 8XDTA2MDYwMjA0
MjEwMlowIwYJKoZIhvcNAQkEMRYEFBGn+r8Ok/0bZlR4tDyAyqm03sndMFIGCSqG
SIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAg CAMA0GCCqGSIb3
DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSI b3DQEBAQUABIGA
k7HuiyvKopewXdwTInjmJayxHo0wgqizG7/Op2M4UzPIkEzaYLDNcpwKU+7Y6dYp
omEoGyJ1uEPKs1inI1Vsy2+soN3AJ9kgzsb9gTQ7JWsRhjMnrT Wj3kBcqFZRMuQ3
H8nlFbGxDqJD9CN53EwjTJ8vWCplf4tDM+/ZZVDJT20=
--==========159D6E491BD71FEC11E2==========--
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
--On June 1, 2006 12:50:15 AM +0000 brokejunker@yahoo.com wrote:
> Squirrelmail local file inclusion bug in functions/plugin.php .
> Tested on the latest 1.4.x version.
> No authentication needed.
>
> if (isset($plugins) && is_array($plugins)) {
> foreach ($plugins as $name) {
> use_plugin($name);
> }
> ...
> function use_plugin ($name) {
> if (file_exists(SM_PATH . "plugins/$name/setup.php")) {
> include_once(SM_PATH . "plugins/$name/setup.php");
> $function =3D "squirrelmail_plugin_init_$name";
> if (function_exists($function)) {
> $function();
> }
> }
> }
> ....
>
> If register_globals is on we can control the $name variable.
>
This is the second "bug" I've seen in the past week that requires=20
register_globals to be on. Yet register_globals has been off by default=20
for the past four years. <http://us2.php.net/ChangeLog-4.php#4.2.0>
The developers of PHP specifically address its use and warn against it=20
unless you know what you're doing. <http://us2.php.net/register_globals>
Squirrelmail even warns specifically against using register_globals =3D on=20
and checks for it when installing.
grep register_globals /usr/local/share/doc/squirrelmail/*
/usr/local/share/doc/squirrelmail/ChangeLog: - Added PHP register_globals=20
check to configuration test utility.
/usr/local/share/doc/squirrelmail/ChangeLog: - Fixed use of=20
squirrelmail_language cookie with PHP register_globals =3D
/usr/local/share/doc/squirrelmail/ChangeLog: - Prefs caching didn't work=20
properly with register_globals off (#995102).
/usr/local/share/doc/squirrelmail/ChangeLog: by register_globals =3D =
off.
/usr/local/share/doc/squirrelmail/ChangeLog: - This release is compatible=20
with installations that have register_globals set to off.
/usr/local/share/doc/squirrelmail/INSTALL: It is highly advised to NOT=20
turn on register_globals, as this can lead
/usr/local/share/doc/squirrelmail/INSTALL: to security holes. If you must=20
use register_globals for some applications,
/usr/local/share/doc/squirrelmail/security.txt:- PHP configuration. It's=20
very important to turn register_globals OFF.
/usr/local/share/doc/squirrelmail/security.txt: could only be exploited=20
when register_globals was set to on. If you
/usr/local/share/doc/squirrelmail/security.txt: need register_globals for=20
other web applications, turn it on specifically
Yet know we're getting "security advisories" warning, hey, if you change=20
the defaults and ignore all the warnings, you too can write insecure code!
Is human stupidity a software bug?
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
--==========159D6E491BD71FEC11E2==========
Content-Type: application/pkcs7-signature
Content-Transfer-Encoding: base64
MIIO7AYJKoZIhvcNAQcCoIIO3TCCDtkCAQExCzAJBgUrDgMCGg UAMAsGCSqGSIb3
DQEHAaCCDFowggVzMIIE3KADAgECAhAhQ2wPNrJWs2gXrRmRcA j6MA0GCSqGSIb3
DQEBBAUAMIHqMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZi BUZXhhcyBTeXN0
ZW0xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOz A5BgNVBAsTMlRl
cm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb2 0vcnBhIChjKTk5
MTIwMAYDVQQLEylDbGFzcyAyIENBIC0gT25TaXRlIEluZGl2aW R1YWwgU3Vic2Ny
aWJlcjEtMCsGA1UEAxMkVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgYXQgRGFsbGFz
IENBMB4XDTA1MDgxMDAwMDAwMFoXDTA2MDgxMDIzNTk1OVowgf QxJzAlBgNVBAoU
HlRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIFN5c3RlbTEtMCsGA1 UECxQkVGhlIFVu
aXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFzIENBMUYwRAYDVQ QLEz13d3cudmVy
aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC4gYnkgUm VmLixMSUFCLkxU
RChjKTk5MRgwFgYDVQQLFA9NYWlsIFN0b3AgLSBVVEQxFTATBg NVBAMTDFBhdWwg
U2NobWVobDEhMB8GCSqGSIb3DQEJARYScGF1bHNAdXRkYWxsYX MuZWR1MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEoeaWOSJTLA4v6OJEuC fJukxz2ljvM2G7
CovCFsCYK7FnYSzTjFAk8Vhe+STjF4ehWIMnyGzWHYP6Vude2s WSxsXvUANOsjNK
eWZ5rSjFS52u+1JU2IiIiwISnlAmOKC9eqXGq7iIPz35w3Vbpx PeGe6GWK4ZfexT
KSQtfPYfSQIDAQABo4ICDDCCAggwCQYDVR0TBAIwADAdBgNVHR EEFjAUgRJwYXVs
c0B1dGRhbGxhcy5lZHUwggEkBgNVHSAEggEbMIIBFzCCARMGC2 CGSAGG+EUBBwEG
MIIBAjArBggrBgEFBQcCARYfaHR0cHM6Ly93d3cudmVyaXNpZ2 4uY29tL3JwYS1r
cjCB0gYIKwYBBQUHAgIwgcUagcJOT1RJQ0U6IFByaXZhdGUga2 V5IG1heSBiZSBy
ZWNvdmVyZWQgYnkgVmVyaVNpZ24ncyBjdXN0b21lciB3aG8gbW F5IGJlIGFibGUg
dG8gZGVjcnlwdCBtZXNzYWdlcyB5b3Ugc2VuZCB0byBjZXJ0aW ZpY2F0ZSBob2xk
ZXIuICBVc2UgaXMgc3ViamVjdCB0byB0ZXJtcyBhdCBodHRwcz ovL3d3dy52ZXJp
c2lnbi5jb20vcnBhLWtyIChjKTk5LjARBglghkgBhvhCAQEEBA MCB4AwdQYDVR0f
BG4wbDBqoGigZoZkaHR0cDovL29uc2l0ZWNybC52ZXJpc2lnbi 5jb20vVGhlVW5p
dmVyc2l0eW9mVGV4YXNTeXN0ZW1UaGVVbml2ZXJzaXR5b2ZUZX hhc2F0RGFsbGFz
Q0EvTGF0ZXN0Q1JMLmNybDALBgNVHQ8EBAMCB4AwHQYDVR0lBB YwFAYIKwYBBQUH
AwQGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBAUAA4GBAEHYOgkUsy vG/DYGFAKSJ+Iq
UY4NVstEHCKHim3Cckq0Chxf+yRQB4tvOrwPTFAHlMgqJKr4yV XEvwJmhAvJtO/V
nYex/brnBVky3UI288HXzk7439zbvmmczLZmOhsR3A3TnKHX9vdTmJ7 sxWExDszR
QntTfoUYcQihaFVOqZ9sMIID2DCCA0GgAwIBAgIQQewfPacUB5 bE9tUM3dEPZTAN
BgkqhkiG9w0BAQUFADCBwTELMAkGA1UEBhMCVVMxFzAVBgNVBA oTDlZlcmlTaWdu
LCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYX J5IENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOT k4IFZlcmlTaWdu
LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBg NVBAsTFlZlcmlT
aWduIFRydXN0IE5ldHdvcmswHhcNOTkwMzMxMDAwMDAwWhcNMD kwMzMwMjM1OTU5
WjCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgU3lzdGVtMR8w
HQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQ QLEzJUZXJtcyBv
ZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYS AoYyk5OTEyMDAG
A1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIF N1YnNjcmliZXIx
LTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IE RhbGxhcyBDQTCB
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv+rvh+seCsEA+S IRwdHBzNt62r42
0nBgMGDlGeBTLzX0yagpBdbePZ3zBppkfb7Rh1R4m/+iePH7h6vD/IdMwklBDeHA
0qXX/H7/QlFOdPMB1WhzpV0EMfjmKSVjqCOaRGqBiw+wOfHv20ZYw7q4z0 vzesGi
SZWDI0O6mxqPMoUCAwEAAaOBpTCBojApBgNVHREEIjAgpB4wHD EaMBgGA1UEAxMR
UHJpdmF0ZUxhYmVsMS0xNDAwEQYJYIZIAYb4QgEBBAQDAgEGME QGA1UdIAQ9MDsw
OQYLYIZIAYb4RQEHAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly 93d3cudmVyaXNp
Z24uY29tL1JQQTAPBgNVHRMECDAGAQH/AgEAMAsGA1UdDwQEAwIBBjANBgkqhkiG
9w0BAQUFAAOBgQBTCbXcsraJ0SBQg8k4edzICLJJv7hTg2+KzL Lkenz8o+gPX2Fe
X5cElRJa0pUBIvG87fFUtlSmVBihnVS8BmkExwIhN6KCOYinrK Cf6IMZXZJIORpZ
giQgQ7yGlRLcg3Th5uMTvmqkhwAxMSMHJZuvuixRkQ5ZpqMXiN K0zlQXHDCCAwMw
ggJsAhEAuS9gzIifoXpGCbhbcGyKrzANBgkqhkiG9w0BAQUFAD CBwTELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQ QLEzNDbGFzcyAy
IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaX R5IC0gRzIxOjA4
BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIG F1dGhvcml6ZWQg
dXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldH dvcmswHhcNOTgw
NTE4MDAwMDAwWhcNMjgwODAxMjM1OTU5WjCBwTELMAkGA1UEBh MCVVMxFzAVBgNV
BAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIF B1YmxpYyBQcmlt
YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4Bg NVBAsTMShjKSAx
OTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdX NlIG9ubHkxHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmswgZ8wDQYJKo ZIhvcNAQEBBQAD
gY0AMIGJAoGBAKeIASF0LOcaA/CY4Zc8DyEI8Zzbl+ma/MIEBhO+X1LIzB4sElYs
uAFpLMyZH62wlq55BPITOcF7mLoILOjChBMsqmnpCfTHqQKkQs IjT0rY8A6i+zFs
yeZvmScH9eb0THiebetGhvq5hslU8rLEr9RGHFrJFTD/DWz1LQ5tzn93AgMBAAEw
DQYJKoZIhvcNAQEFBQADgYEAci75f9HxcfvEnvbFXlGKQJi4aP ibHIPY4p29/+2h
5mbqLwn0ytfqpSuV9iRghk1ELoOlxC2g0654aW9y2myuCPBjkj fmu8QwF613zEk1
qs/Yj9G+txiWR3NqVCI0ZC22FptZW7RRWTqzCxT0Et9noPStMmRes UZyJ4wSe8VE
tK4xggJaMIICVgIBATCB/zCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2Yg
VGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdC BOZXR3b3JrMTsw
OQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudm VyaXNpZ24uY29t
L3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2 l0ZSBJbmRpdmlk
dWFsIFN1YnNjcmliZXIxLTArBgNVBAMTJFRoZSBVbml2ZXJzaX R5IG9mIFRleGFz
IGF0IERhbGxhcyBDQQIQIUNsDzayVrNoF60ZkXAI+jAJBgUrDg MCGgUAoIGxMBgG
CSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ 8XDTA2MDYwMjA0
MjEwMlowIwYJKoZIhvcNAQkEMRYEFBGn+r8Ok/0bZlR4tDyAyqm03sndMFIGCSqG
SIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAg CAMA0GCCqGSIb3
DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSI b3DQEBAQUABIGA
k7HuiyvKopewXdwTInjmJayxHo0wgqizG7/Op2M4UzPIkEzaYLDNcpwKU+7Y6dYp
omEoGyJ1uEPKs1inI1Vsy2+soN3AJ9kgzsb9gTQ7JWsRhjMnrT Wj3kBcqFZRMuQ3
H8nlFbGxDqJD9CN53EwjTJ8vWCplf4tDM+/ZZVDJT20=
--==========159D6E491BD71FEC11E2==========--