November 1999 - openSUSE Security - openSUSE Mailing Lists

SuSE Security Announcement - inn
by thomas＠suse.de 30 Nov '99

30 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- _____________________________________________________________________________ SuSE Security Announcement Package: inn <= 2.2.1 Date: Wed Nov 24 18:54:33 CET 1999 Affected SuSE versions: 5.3 - 6.3 Vulnerability Type: remote denial-of-service attack SuSE default package: no Other affected systems: all unix systems using inn <= 2.2.1 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The Inter Net News server inn does not do proper bounds checking. 2. Impact The daemon could be crashed remotely by overflowing the static buffers. 3. Solution Update the package from our FTP server. The fixed inn package for 6.3-AXP is included in the SuSE-AXP distribution. Our maintainer of inn tries to build a RPM for 5.3, which will as soon as possible be available if everything goes well. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: b37b74d4ca8e4a7a22e1e4bac620e68b inn-2.2.1-24.alpha.rpm (6.1, AXP) 51d1dd707a53eb9dc49eeac06c86e2c2 inn-2.2.1-24.i386.rpm (6.1, x86) 833f6814deefac2524cd3bac705a271d inn-2.2.1-24.i386.rpm (6.2, x86) fc4673cc8fd04dca5ff061a48e861b39 inn-2.2.1-23.i386.rpm (6.3, x86) ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/inn-2.2.1-24.alpha.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/inn-2.2.1-24.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/inn-2.2.1-24.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/inn-2.2.1-23.i386.rpm or try the following web pages for a list of mirrors: http://www.suse.de/de/support/download/ftp/inland.html http://www.suse.de/de/support/download/ftp/ausland.html or http://www.suse.de/en/support/download/ftp/germ_mirrors.html http://www.suse.de/en/support/download/ftp/int_mirrors.html Our webpage for patches: http://www.suse.de/de/support/download/updates/index.html or http://www.suse.de/en/support/download/updates/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOEPi6Xey5gA9JdPZAQGQOAf/acJjk3Ak0yc78GRglAwF+qEDINF9jMdm pZivtOSSuJ/ief4L/YQneEuO9x34+9fcUXVtr0ScD1MYrfKvTnDEAR3Tx4vuDQgE A4FHvb57tPwWO5Y34UzUfmqvLcTV0V2iNgZHhMB9haQ/+BAdCE6I1FuzyXqryzmb NCwPSiugcS8PO0dG1Ww9Uto5dsqpbxPj6KPRaAO0fXvxZ5pNtLDTJusq7Lh8VAOp QN+hmEZ3Bg9aoJCNiMilPTi3lF8+pG3rrs0U6pDXhoVI3Vk/wsOm6g1TviNjzpVl O23l1HPo3dIajDvKAeJIUdMMTLdPbWdoTDE7qdDmBIaVR63ESbxqgw== =tDUu -----END PGP SIGNATURE-----

1 0

Re: [suse-security] Possible Hack attack ?
by Martin P. Peikert 30 Nov '99

30 Nov '99

Dear Jürgen Eder, concerning your mail sent on Mon, 29 Nov 1999 let me reply the following: >Big deal, you speak of port scans like they are something illegal! There is >nothing illegal about port scanning. Right. But, as as my log-files show, in many cases an attack follows the port scan. I _always_ contact the gateway admin if I find a port scan, and, in some cases, they find out that somebody intruded in their systems. So I think it is helpful to inform admins about port scans that come from their systems. It's one way to avoid attacks followed by port scans. Regards, Martin -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

Re: [suse-security] portscanning and high ports
by Louis J. LaBash 30 Nov '99

30 Nov '99

On Mon, Nov 29, 1999 at 02:32:49PM -0700, -|D|- wrote: > On Mon, 29 Nov 1999, Chris Reeves wrote: ... > Big deal, you speak of port scans like they are something > illegal! There is nothing illegal about port scanning. Well, turning doorknobs is not illegal either; but when you stoop down and try to pick the lock: that is a different story. Chris is just being vigilant, *not* paranoid. Repeated probes need to be watched before they turn into lock picking. -- Louis-ljl-{labash(a)lou1.ll.siue.edu}

1 0

RE: [suse-security] Info on passwords
by Sandow, Malte 30 Nov '99

30 Nov '99

Hi, >when i install suse my passwd file have a lot of users, like dbmaker and so on. How can i know these users password ? If you look into /etc/shadow you see something like this: bin:*:8902:0:10000:-1:-1:-1: daemon:*:8902:0:10000:-1:-1:-1: lp:*:9473:0:10000:-1:-1:-1: uucp:*:0:0:10000:-1:-1:-1: games:*:0:0:10000:-1:-1:-1: The second field is for the password and as you can see it is a '*'. This means nobody can login as one of these users as they do not have a valid password. > Personally I think it is ridiculous that I have users: > informix, db2[...], > amande, virtuouso etc etc when I don't use or intend to use > them on this boxen. > Why should I have all these accounts and they are not even > attached to *real* > users or processes? Can you not make the installation remove > the users that > are not needed and install the users when an app does need > them? Why this effort? It is no security risk to have these users because as stated above, they can not log in. If anything is done by these users someone (root) has to su to one of them. >to increase the system-security set the shell of this user to "/bin/false" There is no reason to do this. Is there an account less dangerous than one whith a '*' in the pw field? - No. Greetings Malte Sandow

3 2

AW: [suse-security] portscanning and high ports
by Stephan Gerling 30 Nov '99

30 Nov '99

Hi Chris, Webmin is using Port 10000 by default, but you can change it to what ever you want. BO2K can use other Ports as by default are given. The other one can be used by an Trojan Horse maybe. Service Port Protokol Description AOL 5190 tcp/udp America-Online AOL-1 5191 tcp/udp America-Online-1 AOL-2 5192 tcp/udp America-Online-2 AOL-3 5193 tcp/udp America-Online-3 pcanywheredata 5631 tcp/udp PCAnywhere pcanywherestat 5632 tcp/udp PCAnywhere ????? 5800 ????? 5900 irdmi 8000 tcp/udp irdmi ????? 8010 http-alternate 8080 tcp/udp HTTP Alternate Port, can be used by some Proxy Server ????? 9100 ????? 25867 ????? 31787 ????? 33333 Good Luck Stephan Gerling -----Ursprüngliche Nachricht----- Von: Chris Reeves [SMTP:chris.reeves@iname.com] Gesendet am: Montag, 29. November 1999 21:14 An: SuSE Mailing List; suse-security(a)suse.com Betreff: [suse-security] portscanning and high ports Hi all, I have been portscanned a number of times recently by the same computer. I've used a combination of nslookup and finger and have the name of the culprit. It is being dealt with. This has prompted me to look even more closely at my firewalling. Ports <1024 are OK, as they are totally blocked, but those >1023 are pretty much open. Although virtually every single service is commented out in inetd.conf, I still want to block and log any connect attempts to 'special' ports. At the moment, these are the high numbered ports I block: 1433 Microsoft SQL 2049 NFS 5432 PostgreSQL 5999:6010 X-Windows 7100 X Font Server 12345:12346 NetBus 31337 Back Orifice I was having a look at the high numbered ports that he was scanning, and was wondering what the significance of these ports was (I couldn't see anything in /etc/services). By the way, the following are the high numbered ports that he tried to scan, have any ideas what they are used for? 5190 5191 5192 5193 5631 5632 5800 5900 8000 8010 8080 9100 25867 31787 33333 And finally, are there any other high numbered ports that you think could be potentially damaging (eg webmin - which port is that on)? Even if I'm not running that service, I would still like to know which ones pose a security threat so that I can block them anyway (in case I'm playing and start webmin, for example, without realilsing it). Is it generally considered safe to open up most high numbered ports? What do the people on these lists do? Do you close them all and open some, or open all and close some (all meaning all ports >1023)? One last question - I keep on coming around to this one every so often. If someone wants to connect to me using ICQ, they connect to a port >1023. I am assuming that ICQ doesn't have a daemon or anything listening on every possible port, so how does it know when another ICQ user is trying to connect? This isn't an ICQ specific question - I'm just using it as an example - it could apply to any remotely opened connection to a port >1023. How is this handled (how does the computer know whether ICQ should handle the connect attempt or whether it should be handled by some other process)? Thanks in advance, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Info on passwords
by "João Teles" 30 Nov '99

30 Nov '99

when i install suse my passwd file have a lot of users, like dbmaker and so on. How can i know these users password ? Um Abraco. Joao Teles teles(a)tecnolink.com

1 0

SMTP
by Security Webmaster OKDesign oHG 29 Nov '99

29 Nov '99

Hi, one of our clients wants to read his mailaccount with SMTP instead of POP3. Question one: What has to be changed/modified to prepare our server for this ? Question two (thats why I post to this list): It's told that this solution has some security-holes. What are these holes and how can the security be increased ? Is there a bug (for which a bugfix exists ?) in the smtpd or what ? BTW: Running SuSE-Linux 6.0 TIA. --- Stephan

3 2

UUCP and Kernel 2.2.5
by suse＠hsan.hh.schule.de 29 Nov '99

29 Nov '99

Hi, I am using SuSE 6.1 and an ISDN connection to WiNShuttle for some weeks now. Last week I realised a problem with UUCP. The connect alway runs into 'Time out' after about 400kByte. The transfer rate is less than 1000 Byte. This seems to me very slow. Is there a networking problem in Kernel 2.2.5? With SuSE 5.3 my configuration worked fine. Best Uwe -- **************************************************** * Uwe Debacher Uwe(a)Debacher.de Homepage http://www.debacher.de Tel. 0700-debacher (0700-33222437) * Hamburger Bildungsserver http://lbs.hh.schule.de

1 0

samba-2.0.6-3 and automounting smbfs
by Robert Casties 29 Nov '99

29 Nov '99

Hello! I just found a little error (at least I think it is) in the new samba-2.0.6-3 package. The package supplies an /sbin/mount.smbfs what I think should be called /sbin/mount.smb The problem is that you have to use "-fstype=smbfs" in your automounter map and it ignores "passwd=" and "guest" options. Then you get "Password:" prompts all over the place. That's because smbfs-support is allready built into autofs (I have autofs-3.1.3-48) so it ignores the mount.smbfs script. If you rename mount.smbfs to mount.smb and use "-fstype=smb" it works fine. Or does anyone know how to supply password or guest options to automounts smbfs? Cheers Robert -- Robert Casties --------------------- http://philoscience.unibe.ch/~casties History & Philosophy of Science Tel: +41/31/631-8505 Room: 216 Institute for Exact Sciences Sidlerstrasse 5, CH-3012 Bern Uni Bern (PGP key on homepage: D7 2B DE 64 2D 65 16 A0)

1 0

Re: [suse-security] Possible Hack attack ?
by Eilert Brinkmann 29 Nov '99

29 Nov '99

Jürgen Eder <juergen.eder(a)d33.net> wrote: > I found some entries like: connect from 195.119.130.86 to dump(): > request from unauthorized host As I have some entries with different > IPs, I'm not shure - Is this a hack attack or not ? This message says that someone tried to find out which RPC services (e.g., mountd) are running on your host. (Can be done by hand with the command `rpcinfo -p YOUR.HOST.NAME'). This request was rejected by your portmapper because the remote IP address is not listed in /etc/hosts.allow. Such an attempt may indicate that someone was looking for vulnerable services on your host that can allow him to break into it. This request for it's own is not an actual break in attempt -- that could have been the next step if your host had answered the request. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0