June 2000 - openSUSE Security - openSUSE Mailing Lists

masquerading and a monolithic kernel
by Arjen Runsink 05 Jun '00

05 Jun '00

L.S. Experimenting with a firewall I compiled a monolithic kernel with masquerading and without loadable module support so as to make it impossible to subvert the kernel by a malicious module. But alas, the special masq modules for irc and ftp and so forth are only made and available as modules :( This is handy, especially a modified ftp module that snoops passwords would work for whatever-your-color-of-hat to do his thing. So this brings security but partially hast the functionality of a disconnected system.:) Is there a way to not make them a module but put them into my kernel? BB, Arjen -- Sell what you use, use what you sell.

4 5

Sendmail: Security Problem???
by Boris Kantwerk 04 Jun '00

04 Jun '00

Hi on my SuSe 6.2 I found following ps-entry: 1714 ? S 0:00 sendmail: startup with 195.212.91.200 2384 ? S 0:00 sendmail: accepting connections on port 25 21231 ? S 0:00 /usr/sbin/sendmail -FCronDaemon -odi -oem root |-cron(184)---cron(21044)-+-sendmail(21231) | `-sh(21047) # nslookup 195.212.91.200 Name: d12lmsgate-2.de.ibm.com Address: 195.212.91.200 1) Why startup with 195.212.91.200? 2) Pid 2384: This is the only instance that's OK, isn't it? 3) Why does cron starts a sendmail? Any ideas?

2 1

SuSEfirewall-2.5 - ipchains error and possibly separate networking error (long)
by Andrew Hougie 04 Jun '00

04 Jun '00

I've downloaded SuSEfirewall-2.5.tar.gz and Installed it. I've edited firewall.rc.config and if I start the "firewall" I get the "done" message and in my log the message "SuSEfirewall: Firewall rules successfully set" However if I call /usr/sbin/openports I get: ipchains produced errors, no default routing set up? /sbin/route -n gives: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 xxx.xx.xxx.48 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.49 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 192.168.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 xxx.xx.xxx.40 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.41 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.42 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.43 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.44 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.45 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.46 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 xxx.xx.xxx.47 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 xxx.xx.xxx.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 xxx.xx.xxx.1 0.0.0.0 UG 0 0 0 eth0 The last line looks to me like a correct default gateway. It is the IP address of my ISP's router sitting on a network to which eth0 on the linux box is also connected. Internet connections from this linux box also work. One point which I did note, although the message does not indicate that this is the issue - openports has the line "requires iproute2 to be installed and in the path". What is iproute2? I'm pretty sure that I don't have it and it is certainly not in the path. I don't know if the two are connected but the other thing that does not work at all is the network connected to eth1. I'd love to test the firewall using it (because that's what I installed the firewall for, but I cannot get that far. I have a laptop with a PCMCIA 10/100 network card running Windows 98. I have set it up with IP address 192.168.1.10, netmask 255.255.255.0 and gateway 192.168.1.1. eth1 is an SMC EtherPower II 10/100 which is using the epic100 module and has IP address 192.168.1.1. From my linux box I can ping 192.168.1.1 and from the laptop I can ping 192.168.1.10 but I cannot ping one from the other. The hub (Intel InBusiness 4-port Fast Hub) shows green lights for the status link indicators for the two NICs. The PCMCIA card has an indicator that says it is connecting at 100 Mbs and the "activity light" flashes briefly when ping is run either from the laptop or the linux box. The SMC NIC has four LEDs - a Link Integrity Indicator which is on, a 10Mbs/100Mbs Indicator which indicates 100Mbs a Full duplex/half duplex Indicator which is showing half duplex and an activity indicator which flashes briefly when ping is run either from the laptop or the linux box. If I run /sbin/ifconfig I get: eth0 Link encap:Ethernet HWaddr 00:A0:24:B7:yy.yy inet addr:xxx.xx.xxx.4 Bcast:xxx.xx.xxx.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:14814 errors:0 dropped:0 overruns:0 frame:0 TX packets:10553 errors:0 dropped:0 overruns:0 carrier:0 collisions:201 txqueuelen:100 Interrupt:10 Base address:0x300 eth0:0 Link encap:Ethernet HWaddr 00:A0:24:B7:yy.yy inet addr:xxx.xx.xxx.40 Bcast:xxx.xx.xxx.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:10 Base address:0x300 eth0:1 Link encap:Ethernet HWaddr 00:A0:24:B7:yy.yy inet addr:xxx.xx.xxx.41 Bcast:xxx.xx.xxx.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:10 Base address:0x300 .. for eth0:2 to eth0:9 .. eth1 Link encap:Ethernet HWaddr 00:E0:29:2D:zz.zz inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:452 dropped:453 overruns:0 frame:0 TX packets:170 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:11 Base address:0xe400 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:3924 Metric:1 RX packets:3172 errors:0 dropped:0 overruns:0 frame:0 TX packets:3172 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 I guess that the 452 errors and the 453 dropped are not good! For completeness /etc/route.conf is as follows: # # /etc/route.conf # # In this file you can configure your static routing... # # This file is read by /sbin/init.d/route. # # # Destination Dummy/Gateway Netmask Device 192.168.1.0 0.0.0.0 255.255.255.0 eth1 xxx.xx.xxx.0 0.0.0.0 255.255.255.0 eth0 default xxx.xx.xxx.1 Any help gratefully appreciated. Many thanks Andrew -- Andrew Hougie, Grinton, Aldenham Grove, Radlett, Hertfordshire, England, WD7 7BW Email: andrew(a)hougie.co.uk WWW: http://www.hougie.co.uk

1 0

Majordomo vulnerabilty
by Ali Parlar 03 Jun '00

03 Jun '00

Hi, I heard that redhat-majordomo package has a vulnerabiliy in resend and wrapper. What about suse-majordomo? Thanks, Ali

2 1

Fw: KDE::KApplication feature?
by bacano 03 Jun '00

03 Jun '00

Hi2all I did get this just now, and didn't test it, but the author says that tests were performed on suse 6.4 [ ]'s bacano ----- Original Message ----- From: "Sebastian" <krahmer(a)CS.UNI-POTSDAM.DE> To: <BUGTRAQ(a)SECURITYFOCUS.COM> Sent: Wednesday, May 31, 2000 9:38 AM Subject: KDE::KApplication feature? > hi, > > Can someone check this for some KDE Versions/Linux distributions? > > thanx, > Sebastian > > P.S.: Exploit etc. as always on my homepage or at > http://teso.scene.at > > ---------------------------------------------------------------------------- ---- > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > - ------ > > TESO Security Advisory > 2000/05/29 > > KDE KApplication {} configfile vulnerability > > > Summary > =================== > > A bug within the KDE configuration-file management has been > discovered. > Due to insecure creation of configuration files via KApplication-class, > local lusers can create arbitrary files when running setuid root > KDE-programs. > This can result in a complete compromise of the system. > > > Systems Affected > =================== > > The vulnerability is at least present within KDE 1.1.2. > All tests were performed on a SuSE 6.4 standard installation. > > > Tests > =================== > > bash-2.03$ nl /tmp/a.out.cc > 1 #include <string.h> > 2 #include <stdlib.h> > 3 #include <stdio.h> > 4 #include <kapp.h> > > > 5 int main(int argc, char **argv) > 6 { > 7 KApplication *base = new KApplication(argc, argv); > > 8 base->exec(); > 9 return 0; > 10 } > 11 > bash-2.03$ ls -la /etc/foo > ls: /etc/foo: No such file or directory > > bash-2.04$ ln -s /etc/foo ~/.kde/share/config/a.outrc > bash-2.03$ ls -la /tmp/a.out > -rwsr-sr-x 1 root root 19450 May 28 14:14 /tmp/a.out > bash-2.03$ /tmp/a.out > ^C > > bash-2.03$ ls -la /etc/foo > -rw-rw-rw- 1 stealth 500 0 May 28 14:26 /etc/foo > bash-2.03$ > > (Output formatted to improve readability). > > > Impact > =================== > > An attacker may gain local root-access to a system where vulnerable KDE > distributions are installed. > Due to the GUI-nature of KDE, it might become difficult for an attacker > to gain a root-shell on a remote system. However, the individual could > modify the DISPLAY environment variable to redirect the output to one > of his own machines. > A vulnerable system must have at least one setuser-id program > installed which utilizes the KApplication class. > Such programs include ktvision and ktuner, for an example. > > > Explanation > =================== > > Obviously, KDE doesn't check for possible symlinks when creating > configuration-files. This may result in arbitrary file-creation or > chmod's of any file. > We assume the bug is within the KApplication::init() function: > > ... > > // now for the local app config file > QString aConfigName = KApplication::localkdedir(); > aConfigName += "/share/config/"; > aConfigName += aAppName; > aConfigName += "rc"; > > QFile aConfigFile( aConfigName ); > ... > > > This instanciation probably creates the file. However we haven't checked > QFile {} further. > > > Solution > =================== > > Neither run KDE applications setuid nor setgid. > The KDE developers have been informed. A patch should be made available > soon. Upgrade as promptly as possible. > > > Acknowledgments > ================ > > The bug-discovery and the demonstration programs are due to > Sebastian "Stealth" Krahmer [1]. > Further checking on different distributions have been made > by Scut. > > This advisory was written by Sebastian and Scut. > > > Contact Information > =================== > > The TESO crew can be reached by mailing to teso(a)coredump.cx. > Our web page is at http://teso.scene.at/ > > Stealth may be reached through [1]. > > > References > =================== > > [1] http://www.cs.uni-potsdam.de/homepages/students/linuxer/ > > [2] TESO > http://teso.scene.at or https://teso.scene.at/ > > > Disclaimer > =================== > > This advisory does not claim to be complete or to be usable for any > purpose. Especially information about the vulnerable systems may be > inaccurate or wrong. The supplied exploit is not to be used for malicious > purposes, but for educational purposes only. > > This advisory is free for open distribution in unmodified form. > Articles that are based on information from this advisory should include > links [1] and [2]. > > > Exploit > =================== > > We've created a working demonstration program to exploit the vulnerability. > > The exploit is available from > > http://teso.scene.at/ or https://teso.scene.at/ > > and > > http://www.cs.uni-potsdam.de/homepages/students/linuxer/ > > > - ------ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.0 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > iD8DBQE5MWgLcZZ+BjKdwjcRAqJfAJwM5ksv/2dm7liESPMlYkQevZcfiACfb45I > 0Xp/9kMRr1FTMV6r0qh+lao= > =6q3d > -----END PGP SIGNATURE----- >

2 1

[suse-security]: Netscape certificate
by Timo Schulz 02 Jun '00

02 Jun '00

Hi, is it possible to use OpenSSL/SSL to generate a certificate that can be use by Netscape as a digital user id for encryption? If yes, how? Thanks in advance. Timo -- Two-a-Day at joesixpack.net www.freenet.de/joesixpack keyid BF3DF9B4

2 1

merge harden_suse w/ new Bastille 1.1.0pre1?
by Monte Milanuk 02 Jun '00

02 Jun '00

I was trolling thru FreshMeat, and noticed a new update for Bastille, the very thorough hardening script for RedHat/Mandrake Linux systems. I used to run Redhat, and then Mandrake, so I checked it out. The release info on the new alpha 1.1.0pre1 says that most of the Redhat specific stuff, like file locations, has been changed to variables instead, so it should be easier to modify/extend for other Linux systems besides RedHat. Then I started getting excited. Please don't take this as a slight towards harden_suse, as I think it is outstanding that SuSE includes it and the other security packages, which have probably kept me out of more trouble than I know ;)! But my overall impression of Bastille is that it is a little more polished, and I especially like the explanations given for each section/question. Now for the flame-bait question -- Would it be possible to merge harden_suse w/ Bastille, using the new variables in the latest release of Bastille, to set up SuSE systems, including setting the FW_* options in the config file? Thanks for your time and effort, Monte __________________________________________________ Do You Yahoo!? Yahoo! Photos -- now, 100 FREE prints! http://photos.yahoo.com

1 0

Antwort: Re: [suse-security] chroot manual [Virus checked]
by Dirk.Nitka＠ages.de 02 Jun '00

02 Jun '00

Thanks in advance, I will try it and let you know, if it worked. Dirk Peter Jägle <peja(a)ise.fhg.de> am 02.06.2000 12:17:35 An: Dirk Nitka/AGES/DE Kopie: Thema: Re: [suse-security] chroot manual [Virus checked] from man login on a HP-UX system (description how login uses the password file): If the command name field is *, a chroot() to the directory named in [...] Try this, maybe it works with linux too. (please let me know)

1 0

Re: [suse-security] IPCHAINS again (because first mail was digital signed)
by Per R Laursen 02 Jun '00

02 Jun '00

It sounds like you have disablet icmp at your input or output chain. Kind regards Per R Laursen http://www.websecure.dk -----Original Message----- From: Gerling, Stephan <gerling(a)kub.de> To: 'suse-security(a)suse.com' <suse-security(a)suse.com> Date: 25. maj 2000 13:20 Subject: [suse-security] IPCHAINS again (because first mail was digital signed) >Hi list, >I'am trying to set up an firewall with IPCHAINS. >If the IPCHAINS-Script is not started, i kann do everything. (i use the same >script on an other >maschine and it works very fine and i want to change the maschines) >But now wenn i start the script, the rules are loaded, but i cannot ping to >the outside >here the error messages >ping wrote xxx.xxx.xxx.xxx 64 chars, ret=-1 >ping sendto :Operating is not permitted >ip-forwarding is enabled. >Has anyone an idea. I'm going sick about this >regards, Stephan Gerling > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

Apache mod_ssl problem
by Harald Scharf 01 Jun '00

01 Jun '00

Hello, to all. I have an interesting problem. I have installed Apache 1.3.12 with mod_ssl 2.6.3 php 3.0.16 , mysql and sybase support. The Configuration works well, but there is a strange phenomenon : If i try to connect with : http://192.168.100.1/mrtg, i do not get any connect. If i try to connect with : https://192.168.100.1/mrtg i get a connect, but i CAN connect with http://192.168.100.1/mrtg/ So, if i supply the last slash, the Browser establishes the Connection.... WHY ? I think this should work with both urls, because apache is configured with : listen 80 listen 443 Any Idea ? tia Harald Scharf

3 2