June 2000 - openSUSE Security - openSUSE Mailing Lists

Forwarded mail....
by Thomas Biege 20 Jun '00

20 Jun '00

Hi, the QPop RPMs for 6.1 (6.0) are available.... 0e2d6f49e4b246a2f737020b018de778 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2000.6.18-0.alpha.rpm 69739b549fcc564bf77afb54111d6ee9 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2000.6.18-0.i386.rpm Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Can Linux Protect ECommerce?
by Fred A. Miller 20 Jun '00

20 Jun '00

Can Linux Protect ECommerce? Is your free OS running servers for expensive ecommerce? In this live RoundTable discussion, you can ask the guest expert on SolutionCentral, Randy Thorburn of Knox Software, about robust data protection engines that live up to the Linux hype. http://www.solutioncentral.com/knoxdpe -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

2 1

permissions question
by alex medvedev 18 Jun '00

18 Jun '00

hallo, can a root user create a file in a regular user's home directory so that the regular user can not remove it? it does not seem to work... ----------------- start ------------------------------------ $ pwd /home/alexm $ id uid=1000(alexm) gid=100(users) groups=100(users) $ ls -l file1 -rwx------ 1 root root 0 Jun 17 14:35 file1 $ rm file1 rm: remove write-protected file `file1'? y $ ls -l file1 ls: file1: No such file or directory $ ------------------ end -------------------------------------- thanks, -alexm

5 4

SuSEfirewall for DEV_WORLD=eth1:0
by Winfried Trautsch 16 Jun '00

16 Jun '00

Hi, I'm running SuSEfirewall V2.0. One of my "DEV_WORLD"-devices is eth1:0, which is an alternate IP-Address for eth0. SuSEfirewall complaints about "no such command", obviously when executing FW_DEV_WORLD_eth1:0="62.153.66.51 255.255.255.248". What's wrong there? Regards - Winni -

4 6

[suse-security] Re: Qpop versions pre 2.53
by Carsten Tumma 16 Jun '00

16 Jun '00

--- Ruediger Oertel <ro(a)suse.de> wrote: > AFAIR it says: "user must agree to license prior to > installation", The licence in http://www.eudora.com/qpopper/license.html says "... and distribute unmodified complete copies of Qpopper to any third party provided that such third party must agree to these terms and conditions prior to any use of Qpopper" - In my understanding this applies to unmodified copies of Qpopper and SuSE may use a different licence agreement for a modified version (see section 4e of the licence). - Does the term "prior to any use" include the installation of Qpopper or just the execution of the program? I'm german and not very familiar with U.S. legal affairs. BTW: What are the advantages of Qpopper 3.x excpet for the fixes regarding the vulnerabilities which have already been applied to Qpopper 2.53 by SuSE? Regards, Carsten Tumma __________________________________________________ Do You Yahoo!? Send instant messages with Yahoo! Messenger. http://im.yahoo.com/

2 1

Qpop versions pre 2.53
by bolo＠lupa.de 16 Jun '00

16 Jun '00

Hi, we are concerned about some security issues of the program Qpop which is part of the "pop" package of serial n1. Until SuSE 6.2 Qpop 2.53 has been part of this package which is infamous for some security holes, including the ability for remote users with a valid (mail-) account to gain access to the mail host via shell with GID "mail". This would allow r/w to all mail spools and more nasty things. The authors of Qpop state quite clearly on their website (www.eudora.com/qpopper/) that Qpop versions <= 3.0.x should _not_ be used in productive Linux environments because of the known bux. Will the package "pop" be updated accordingly? Regards, Boris Lorenz <bolo(a)lupa.de> (SysAd) --- Landwehr & Partner ---

5 5

Re: [suse-security] Qpop versions pre 2.53
by rhoerbe＠netpromote.co.at 16 Jun '00

16 Jun '00

1. I downloaded Qpopper 3.02 from www.eudora.com, but was not required to acknowledge any licence. So, there might be a difference between the licence text and actual practice by qualcomm. 2. Thomas, you listed "patch" and "drop" as only options. But wouldn't it be an option to include qpopper 3.02 in series "commercial software". Or anything, which is not installed by default, but a user could install manually. 3. As I understand from Qualcomm's release notes, V 3.02 does not only fix known security deficiencies, but lines up new defenses agains buffer overflow exploits. Hence it should be inherently more secure than Suse's patched 2.53. Although I acknowledge your efforts to fix qpopper 2.53, you should make it clear to users, that this is not the technically best solution. Brgds Rainer Thomas Biege <thomas(a)suse.de> Sent by: suse-security-return-1955-rhoerbe=netpromote.co.at(a)suse.com 15.06.00 18:53 To: bolo(a)lupa.de cc: suse-security(a)suse.com Subject: Re: [suse-security] Qpop versions pre 2.53 Hi, On Thu, 15 Jun 2000 bolo(a)lupa.de wrote: > Hi, > > we are concerned about some security issues of the program Qpop which is part > of the "pop" package of serial n1. Until SuSE 6.2 Qpop 2.53 has been part > of this package which is infamous for some security holes, including the > ability for remote users with a valid (mail-) account to gain access to the mail > host via shell with GID "mail". This would allow r/w to all mail spools and > more nasty things. > > The authors of Qpop state quite clearly on their website > (www.eudora.com/qpopper/) that Qpop versions <= 3.0.x should _not_ be used in > productive Linux environments because of the known bux. > > Will the package "pop" be updated accordingly? AFAIK does the eudora license deny us to ship qpop 3.x. So, we have two options: 1) patch it 2) drop it. We patched 2.53, so all known bugs were fixed. You could use _our_ 2.53 update or install qpop 3.x from eudora. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] SuSEfirewall for DEV_WORLD=eth1:0
by Samartha 16 Jun '00

16 Jun '00

I have not read thru the whole thread - but I just ran the firewall. In my FW_DEV_WORLD, I have "eth0 eth0:1 eth0:2" which works just fine. Maybe it's redundant - but there is the firewall script in /sbin/SuSEfirewall which deals with the FW_DEV_WORLD around line 260. This script parses the variables set from /etc/rc.config.d/firewall.rc.config and executes ipchain commands to set the filter rules. what you can do is to set a "set -x" in that script to get an execution trace or (what I would do) - take the chunk of code, put it in a file, replace, assign values from the firewall.rc.config and run it with dummy commands. As an example, I set up a similar script for the FW_REDIRECT_TCP to figure something out - but I got it to work without it, but you may get the idea: FW_REDIRECT_TCP="4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" for i in $FW_REDIRECT_TCP; do PARAMS=`echo $i | $AWK 'BEGIN {FS=","} \ {printf ( "-s %s -d %s %s -j REDIRECT %s", $1, $2, $3, $4) }'` test -z "$LAC" || $IPCHAINS -A input -p tcp $PARAMS -y $LAC echo IIII -A input -p tcp -b $PARAMS $LAA done the echo IIII replaces the ipchains command and of cause, you would need to set the AWK=awk and IPCHAINS=ipchains to make it run. maybe it helps, Samartha At 12:05 AM 6/16/00 +0200, you wrote: * Gerhard Sittig wrote on Mon, Jun 12, 2000 at 22:11 +0200: > On Mon, Jun 12, 2000 at 20:41 +0200, Winfried Trautsch wrote: > > Escaping the colon is not sufficiant (especially when you don't > know how many times the parameters get passed down the chain from > the rc.config(?) parameter bundle to the shell assigning the > value and evaluating it -- how is the variable's name > generated?).

1 0

re: [suse-security] Re: Kernel 2.2.16 as sprm /rpm
by Bauer, Juergen 14 Jun '00

14 Jun '00

hi, in spite of these 'issues', will suse provide new sources or not ??? bye, jb Hi, On Fri, Jun 09, Thomas Biege wrote: > > I have a question. I would like to know if kernel 2.2.16 will be > > available as rpm package? Can i download new kernels on the suse ftp > > site? It seems that the is a security hole in kernel 2.2.15 <= see: > > http://www.sendmail.net/?feed=000607linuxbug > > I think it'll be available today... stay tuned and watch out for an > advisory or check our ftp servers. 2.2.16 still has issues... > Bye, > Thomas -o) Hubert Mantel Goodbye, dots... /\\ _\_v --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

SuSE 6.4 SSH?
by Phillip Beal 13 Jun '00

13 Jun '00

Hey, I have a question about the SuSE 6.4 ssh rpm. I know from isupport(a)suse.com that it is version 1.2.27. Which if built against rsaref libs can have a major security flaw. So my question is, was the SuSE 6.4 SSH 1.2.27 rpm built against rsaref? Thanks, -- Phillip Beal Evil Genius In Training Electrical and Computer Engineering "God, Root, what is difference?" S+LUG Vice-President -Userfriendly.org GPG Key fingerprint = 3335 BF29 5180 42DF D7BB 484C 78E0 B0F3 6FB9 81D0

2 3