November 2000 - openSUSE Security - openSUSE Mailing Lists

How secure is sendmail
by Max Lindner 30 Nov '00

30 Nov '00

Hi! I'm must make a decision wether to install sendmail or not. I've heard that sendmail is unsecure, but it is also used very often. My case would be a server without really sensitive data, only public html-files on apache and so on. What do you think about sendmail? Do you know other mail-deamons which are more secure? Thanks for help, Max Lindner

16 18

seccheck package
by Impriser 30 Nov '00

30 Nov '00

I just ran the checkneverlogin command out of the seccheck.rpm. There I realized that the script warns me about users which have the shell set to /bin/false which should be perfectly okay. Or do I have to erase the /bin/false in the /etc/shells file in order for the script to work right? Thanks Raffy

1 0

AW: [suse-security] Scanning encrypted Mails
by Stiefenhofer, Marek ECOFIS 30 Nov '00

30 Nov '00

I don't know about products, but here're some ideas: You need clients that encrypt mails with two public keys: first the usual encryption by the recipients public key. Second encryption by your scanners public key. So your scanner is able to decrypt the Email, scan it and probably drop it if it is infected. But you've still the problem, that the scanners private key must be located in a very safe environment. bye marek

1 0

Scanning encrypted Mails
by Peter Lange 30 Nov '00

30 Nov '00

Hi folk, I look for a solution to encrypt/decrypt mails. But, I have to scan them for malicous code also. All suggestions are welcome. I would prefer a centralized solution (8 Branches 500 Mails per day) I thought about a second DMZ to encrypt/decrypt on something like a keyserver. Then forward to the Contentscanner and then if the mails are clean forward to the internal Mailserver. Anybody out there know about a "keyserver"? thanks Peter

3 2

Re: SuSE Linux 6.x 7.0 Ident buffer overflow (fwd)
by Roman Drahtmueller 30 Nov '00

30 Nov '00

This is my answer to bugtraq. Roman. ---------- Forwarded message ---------- _From: Roman Drahtmueller <draht(a)SUSE.DE> _To: BUGTRAQ(a)SECURITYFOCUS.COM Date: Wed, 29 Nov 2000 05:50:05 +0100 Subject: Re: SuSE Linux 6.x 7.0 Ident buffer overflow > Platforms: SuSE Linux 6.x 7.0 > Risk Level: High > Author: Niels Heinen > Vendor Status: Notified patches will be available today. > *************************************************************************** First off, we thank Niels Heinen for contacting us at our security contact address security(a)suse.de. We have agreed on this date to release the information about the bug. > Impact of the vulnerability: > ==================== > This advisory details a buffer overflow vulnerability under SuSE Linux > that can enable a malicious user to cause Identification Protocol > (Ident) handling to crash. Due to the overflow, the system will no > longer be able to establish certain connections which use Ident, for > example IRC (Internet Relay Chat) connections. If the Ident daemon is > not running, users wishing to connect to IRC will not be allowed to > make a connection. In the this case the vulnerability could be used in > a denial of service attack to keep a person of irc. It's not clear at > this present time whether this vulnerability could be exploited in > such a way that arbitrary code is executed. If so, this will happen > with the privileges of the user "nobody" in a default installation. Thomas Biege, Sebastian Krahmer, Adrian Schröter and myself have been looking at the code, each of us having found a glitch (the multithreaded implementation makes debugging an interesting adventure! :-). It turned out that the daemon dies because of a misinterpretation of the return value of vsnprintf() (which was subject to a change in glibc2.1). Upon detecting that the buffer is too short to keep the data, the daemon decides to "int *p = (int *) NULL; *p = 4711;", or, in other words, segfault and commit suicide. This is bright because a return address on the stack that might have been overwritten is not used (An actual buffer overflow doesn't take place, though.). OTOH, it's not very bright since the auth service is denied as a consequence of the daemon shooting itself in the foot. The risk imposed by the crashed daemon is considerably low. Personally, I find that this behaviour suits the necessity and the usefulness of the protocol itself. > Who's vulnerable ? > ============== > This vulnerability has been tested on SuSE version 6.x and version > 7.0. Previous versions may also be affected. Further testing will > reveal whether other Linux distributions are vulnerable. in.identd in older releases of the SuSE Linux distribution can be crashed, too. Other vendors ship this daemon, too, and will release advisories about the issue soon. With the release of the SuSE-7.0 distribution, the in.identd daemon is contained in a seperate package - before 7.0, it was included in the nkitb package. We will provide updates for the 6.x and 7.0 distributions as usual, but it will take another few days since changes in the nkitb package need thorough testing. In the meanwhile, you may want to disable the service by changing START_IDENTD="yes" # default to START_IDENTD="no" in /etc/rc.config and by killing the daemon (`killall in.identd´. Thanks to Niels for pointing this out, too. If you want to know more about the identd, please install the package "rfc" that can be found in the documentation series of all SuSE distributions and read rfc1413.txt, to be found in /usr/doc/rfc or /usr/share/doc/rfc (SuSE-7.0). Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSE Linux 6.x 7.0 Ident buffer overflow (fwd)
by Roman Drahtmueller 30 Nov '00

30 Nov '00

This mail is from Niels Heinen. He has been in contact with us and reported the problem earlier. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ---------- Forwarded message ---------- _From: Niels Heinen <niels.heinen(a)UBIZEN.COM> _To: BUGTRAQ(a)SECURITYFOCUS.COM Date: Tue, 28 Nov 2000 17:20:11 +0100 Subject: SuSE Linux 6.x 7.0 Ident buffer overflow *************************************************************************** Subject: Ident buffer overflow Platforms: SuSE Linux 6.x 7.0 Risk Level: High Author: Niels Heinen Vendor Status: Notified patches will be available today. *************************************************************************** Impact of the vulnerability: ==================== This advisory details a buffer overflow vulnerability under SuSE Linux that can enable a malicious user to cause Identification Protocol (Ident) handling to crash. Due to the overflow, the system will no longer be able to establish certain connections which use Ident, for example IRC (Internet Relay Chat) connections. If the Ident daemon is not running, users wishing to connect to IRC will not be allowed to make a connection. In the this case the vulnerability could be used in a denial of service attack to keep a person of irc. It's not clear at this present time whether this vulnerability could be exploited in such a way that arbitrary code is executed. If so, this will happen with the privileges of the user "nobody" in a default installation. Who's vulnerable ? ============== This vulnerability has been tested on SuSE version 6.x and version 7.0. Previous versions may also be affected. Further testing will reveal whether other Linux distributions are vulnerable. Technical description: ================ By sending longer than expected strings to the identd port, a remote attacker can crash the daemon. The daemon will also fail to leave any log message given the right length of he string. Seeing the following in the logfile (/var/log/messages) date: suse-machine in.identd[xxx]: s_snprintf(...) = ?: buffer overrun is a clear indication of being attacked by a message length producing log entries. Some other Linux distributions are not vulnerable in the same way, but have to be looked at for suspicious log entries. Another test machine running Red Hat issued here a "Full buffer closing connection" error. Workarounds: =========== If you don't need the Ident, you can keep risk lowest by disabling the ident deamon. This can be done by editing /etc/rc.config. Look for a line like below: START_INDENTD="yes" Change the yes value into no and save the file. After that type as root killall -9 in.identd to stop the ident deamon. More information: ============== Bug finder: Niels Heinen (niels.heinen(a)ubizen.com) Suse web site: http://www.suse.com Suse security email: security(a)suse.com SecurityWatch.com: http://www.securitywatch.com Ident RFC: http://andrew2.andrew.cmu.edu/rfc/rfc1413.html The Disclaimer: ============= *********************************************************************************** All documents and services are provided as is. Ubizen expressly disclaims all warranties, express or implied, including without limitation any implied warranties of merchantability or fitness for a particular purpose, and warranties as to accuracy, completeness or adequacy of information. Ubizen cannot be held accountable for any incorrect or erroneous information. By using the provided documents or services, the user assumes all risks. ***********************************************************************************

1 0

Re: Re: [suse-security] dowloading pictures
by admin＠eregion.de 30 Nov '00

30 Nov '00

> > Hey guys; > > I use to download a lot of pictures of the Net. > > Uhh huh...... look, this is suse-security not using-suse-to-download-porn. Yea.. as if the fact which kind of files he is concerned/worried about matters... > > How can a deleted picture reappear again as thumbnail? > > Is this a bug or do I have a hacker controlling my Trash? > > Yes, a hacker hacked your system and took control of your trash. That's > obviously the explanation. We really need a moderator :P. Yea.. a KDE 'hacker' as in kernel hacker, i.e. programmer... this orginates in the fact that kfm does not update the thumbnails properly... no black hat in that... and I think we really need a moderator, but not to rule out such questions... If someone is concerned that Weird Thnigs(TM) happening on his box might orginate in some intrusive action by someone else, why shouldn't he/she ask here... bye M.H.

1 0

sinusfirewall
by Ralf Palmisano 29 Nov '00

29 Nov '00

Friends, don´t mind please! Can someone tell me what happend to www.sinusfirewall.org? Thanx and stay tuned ... Ralf

2 1

dowloading pictures
by Faessen Jean-Paul 29 Nov '00

29 Nov '00

Hey guys; I use to download a lot of pictures of the Net. As I have yet no CD Rewritable I put some on floppy. Let's say I put picture A on the floppy. After putting it on I delete the picture so it goes to Trash. After the work is done,I empty Trash. I go surfing again,with the necessary downloads. I open my user home directory,I open my floppy and kdf. Then I click "show thumbnails". Weird thing happens as often the old picture A is shown as a thumbnail,but if you open it it's the newly downloaded picture you see. How can a deleted picture reappear again as thumbnail? Is this a bug or do I have a hacker controlling my Trash? Greetings Jean-Paul

2 1

count traffic
by vladimir m. bondarev 29 Nov '00

29 Nov '00

Hello, suse-security. i'm sorry to bother you with this question, but i've spent much time with this problem and haven't solved it yet. so, the situation: eth0 is connected to local network (vlan-29) (10.51.29.x) eth1 is connected to internet eth2 is connected to local network (vlan-30, vlan-31) (10.51.30.x and 10.51.31.x) there is a very big lan and just one server connects it to internet. i need to count traffic for all ips in lan (vlan-29,30,31) that goes from server (10.51.29.50 for vlan-29, 10.51.30.10 for vlans-30,31) to users. i count web traffic with squid, but i also need to count icq (we're using socks for it) and mail (everybody have mailboxes on server) traffic. masq enabled only for chosen users (not so many), so i don't need to count ftp, irc traffic. can anyone help me to solve this problem? thanks in advance. Friday, November 24, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

5 11