November 1999 - openSUSE Security - openSUSE Mailing Lists

[suse-security] Possible Hack attack ?
by Jürgen Eder 29 Nov '99

29 Nov '99

I found some entries like: connect from 195.119.130.86 to dump(): request from unauthorized host As I have some entries with different IPs, I'm not shure - Is this a hack attack or not ?

1 0

nfs-server bug
by Juergen Hannappel 26 Nov '99

26 Nov '99

Hello, concerning the security hole in the NFS-server (as announced in http://lists.suse.com/archives/suse-security-announce/1999-Nov/0000.html) i wonder if the bug also affects the kmountd, which is used when the kernel based nfs server is used? Greetings, Juergen -- Dr. Juergen Hannappel Office: W148 Phone: +49 228 73 2447 FAX +49 228 73 7869 mailto:hannappe@lisa2.physik.uni-bonn.de Physikalisches Institut der Uni Bonn http://lisa2.physik.uni-bonn.de/~hannappe Nussallee 12, D-53115 Bonn, Germany CERN: Phone: +412276 76461 Fax: 77930 Bat. 892-R-A13 F-01631 CERN CEDEX, France

1 0

why do they scan port 31337?
by alex medvedev 26 Nov '99

26 Nov '99

hi, i am often scanned on the port 31337. why? thanks, -alexm the bandwidthwaister

5 4

Re: why do they scan port 31337?
by Jochen Lillich 25 Nov '99

25 Nov '99

Stu Green <stugreen(a)inetport.com> writes: > > i am often scanned on the port 31337. > > why? > That's where Back Orifice defaults to. "31337" reads "ELEET" (elite) in hacker writing. Best regards, Jochen -- *** Linux BBS: Die deutsche Website fuer Linux-News und -Infos *** http://www.linuxbbs.org/

1 0

bug in /usr/bin/find ?
by Vladimir Kukuruzovic 25 Nov '99

25 Nov '99

Hi This is very odd: (suse 6.2 - updated from 6.0) kuki@c00l:~ > pwd /home/office/kuki kuki@c00l:~ > find /home/office/kuki/ -name linux-* -print /home/office/kuki/linux-animation.html kuki@c00l:~ > find /home/office/kuki/dl/ -name linux-* -print kuki@c00l:~ > cd dl kuki@c00l:~/dl > find /home/office/kuki/dl/ -name linux-* -print /home/office/kuki/dl/linux-2.3.28.tar.bz2 kuki@c00l:~/dl > cd .. kuki@c00l:~ > find . -name linux-* -print ./linux-animation.html kuki@c00l:~ > cd dl kuki@c00l:~/dl > find . -name linux-* -print ./linux-2.3.28.tar.bz2 kuki@c00l:~/dl > if I try find /home -name linux-* -print the program finds it. It also succedes if I use path /home/office On suse 6.0 this works ok Regards, Vladimir

2 1

find with * :)
by Vladimir Kukuruzovic 24 Nov '99

24 Nov '99

Thanx to all for very quick answer :) Regards, Vladimir

1 0

Re: [linux-security] Ipchains
by Martin P. Peikert 24 Nov '99

24 Nov '99

On Mon, 22 Nov 1999 Notedite Nada wrote: > >Hi- > >I heard about a bug in ipchains, could you please tell me what to do? >Thanks > > Hi, on the bugtraq archives (bugtraq id: 543) one can find: # BEGIN BUGTRAQ Linux IPChains Fragment Overlap Vulnerability: This patch was provided with the DataProtect advisory posted to BugTraq on July 27, 1999. The solution was incorporated into the 2.2.11 kernel, released in August 1999. *** linux.old/net/ipv4/ip_fw.c Wed Jun 9 05:33:07 1999 --- linux/net/ipv4/ip_fw.c Fri Jul 23 19:20:45 1999 *************** *** 37,42 **** --- 37,45 ---- * 19-May-1999: Star Wars: The Phantom Menace opened. Rule num * printed in log (modified from Michael Hasenstein's patch). * Added SYN in log message. --RR + * 23-Jul-1999: Fixed small fragment security exposure opened on 15-May-1998. + * John McDonald <jm(a)dataprotect.com> + * Thomas Lopatic <tl(a)dataprotect.com> */ /* *************** *** 644,650 **** default: size_req = 0; } ! offset = (ntohs(ip->tot_len) < (ip->ihl<<2)+size_req); } src = ip->saddr; --- 647,666 ---- default: size_req = 0; } ! ! /* If it is a truncated first fragment then it can be ! * used to rewrite port information, and thus should ! * be blocked. ! */ ! ! if (ntohs(ip->tot_len) < (ip->ihl<<2)+size_req) ! { ! if (!testing && net_ratelimit()) { ! printk("Suspect short first fragment.\n"); ! dump_packet(ip,rif,NULL,NULL,0,0,0,0); ! } ! return FW_BLOCK; ! } } src = ip->saddr; # END BUGTRAQ So, if you have a kernel >= 2.2.11 you are not vulnerable to the "Linux IPChains Fragment Overlap Vulnerability". If your kernel is <2.2.11, update or patch your sources and build a new one. I hope that helps. Regards, Martin -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

2 1

geheimnis
by george steward 24 Nov '99

24 Nov '99

Hi all, I've just installed gnupg-version 1.0.0 (http://www.gnupg.org) and have being trying to install geheimnis-version 0.90 (http://members.home.com/cdwiegand/geheimnis) to use with my kde desktop-version 1.1.2 (http://www.kde.org). Problem is that './configure' is unable to find my 'x includes' even when I specify them with the suggested options: ./configure --x-includes=/usr/include/X11/ --x-libraries=/usr/lib/X11/ I found their locations using 'whereis X11' and they definetely contain files but './configure' fails with: 'checking for X... configure: error: Can't find X includes. Please check your installation and add the correct paths!' I am running SuSE 6.2 and X runs perfectly and so does kde. I've also used rpm to uninstall qt2.0.1 and installed both the main and development rpm packages for qt1.4.4 as required in the geheimnis 'INSTALL' It looks as if I'm doing something wrong with the 'x-include' and 'x-libraries' paths but what? Can anyone give me a file name from each location that I can search for on my system just in case the above paths don't contain them and they have in fact been moved somewhere else on my system, please?

4 3

thanks
by Chrissy LeMaire 23 Nov '99

23 Nov '99

thanks for all who offered webmail solutions.. I went with Endymion's Mailman for various reasons (boy was it easy to setup. Its pretty much 1 cgi file and some graphics). I've heard Roxon is a super great httpd, but I dont have the time and energy to switch from Apache at this moment ;) Now to find the time for SSL...... :/ Thanks again Chrisy

1 0

Re: [suse-security] nfs-exports ro are writeable
by tschweikle＠FIDUCIA.de 23 Nov '99

23 Nov '99

Lutz.Jaenicke(a)aet.TU-Cottbus.DE wrote: > On Tue, Nov 23, 1999 at 11:19:21AM +0100, tschweikle(a)FIDUCIA.de wrote: >... >> That is correct, while the 'w' reflects only the state >> of the 'w' bit on the reomte fs. Not the permission it >> is exported with. >> >>> Please make also sure, that you understand the concept of root->nobody >>> mapping when using NFS. >> >> /usr isn't writable localy by 'nobody'. Shouldn't be >> writable by 'nobody' mounted remote. > > Indeed. > > So, let's try to reproduce: I have SuSE 6.2 with the latest nkita-patch: > /usr**(ro) > (more export points listed below this entry...) > > NFS-Client is HP-UX 10.20: > # mount -F nfs XXXXXX:/usr /tmp_mnt > # mkdir /tmp_mnt/xyz > mkdir: cannot create /tmp_mnt/xyz: Read-only file system > # umount /tmp_mnt > > Sorry, I don't have a Linux client available in the moment. > > (remove /usr line from /etc/exports; /sbin/init.d/nfsserver stop ; > /sbin/init.d/nfsserver start ). > # mount -F nfs XXXXXX:/usr /tmp_mnt > XXXXXX:/usr: access denied > secured again. > > Best regards, Tryed it out with SuSE 6.2 new, clean system: Vulnerable. You are allowed to write to a ro exported fs. Applied latest nkit_a-patch. you are not vulnerable any more. ro exported fs isn't writeable. Thus I upgraded all servers to the latest nkit_a-patch. Thanks for all your help! -- Thomas

1 0