January 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Oliver Teuber 29 Jan '01

29 Jan '01

hello i have created bind 8.2.3 rpms for 6.4 ... seems to work fine on our server ... use it on your own risk. http://www.teuber.com/bind/ cu, oliver On Mon, Jan 29, 2001 at 04:16:53PM +0100, Stefan Suurmeijer wrote: > Hi all, > > I haven't seen this on SuSE yet, so I thought I'd forward it. It seems > almost every nameserver we have running is vulnerable. See: > > http://www.cert.org/advisories/CA-2001-02.html > > have fun upgrading :-( > > Stefan > >

1 0

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Franco Galian 29 Jan '01

29 Jan '01

just thinking the same as you ;-) tinydns works just fine and it doesn't have those problems.../// > ----- Original Message ----- > From: "Jurjen Oskam" <jurjen(a)quadpro.stupendous.org> > To: "Stefan Suurmeijer" <stefan(a)symbolica.nl> > Cc: "Suse-security list" <suse-security(a)suse.com> > Sent: Monday, January 29, 2001 2:55 PM > Subject: Re: [suse-security] CERT Advisory CA-2001-02 Multiple > Vulnerabilities in BIND (fwd) > > > On Mon, 29 Jan 2001 16:16:53 +0100 (CET), Stefan Suurmeijer > <stefan(a)symbolica.nl> wrote: > > >I haven't seen this on SuSE yet, so I thought I'd forward it. It seems > >almost every nameserver we have running is vulnerable. See: > > > >http://www.cert.org/advisories/CA-2001-02.html > > > >have fun upgrading :-( > > You might want to take a look at http://cr.yp.to/djbdns.html . > > > end > -- > Jurjen Oskam * carnivore! * http://www.stupendous.org/ for PGP key > assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill > president wall street ruin economy disrupt phonenetwork atomic bomb sarin > nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*- > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

Re: [suse-security] Mysterious Mail with uknown Attachment
by AndriusD＠labas.com 29 Jan '01

29 Jan '01

once received, the similar e-mail attachement was detected by antivirus program as "hybris" virus you can find more info on this at: http://www.europe.f-secure.com/v-descs/hybris.shtml "...The worm can also send itself with a random, 8-letter name, for example UKSJHHKW.EXE. " "...Hybris is an Internet worm that spreads itself as an attachment to email messages. The worm works under Win32 systems only. The worm contains components (plugins) in its code that are executed depending on what worm needs, and these components can be upgraded from an Internet Web site. The major worm versions are encrypted with semi-polymorphic encryption loop. " regards, ------------------ andriusd(a)labas.com Max Lindner <ml(a)lofl.de> To: <suse-security(a)suse.com> cc: 2001.01.28 Subject: [suse-security] Mysterious Mail with 14:25 uknown Attachment Please respond to Max Lindner Hi! I got a mail with the following header: >From MAILER-DAEMON Sat Jan 27 17:17:40 2001 Return-Path: <> Delivered-To: mlindner(a)agentur-lindner.de Received: from webserver.hlg-fuerth.de (unknown [212.204.100.206]) by www1.agentur-lindner.de (Postfix) with ESMTP id 19EDA111E84 for <ml(a)agentur-lindner.de>; Sat, 27 Jan 2001 17:17:35 +0100 (CET) Received: by webserver.hlg-fuerth.de (Postfix) id 9EC366695B; Sat, 27 Jan 2001 17:18:42 +0100 (CET) Delivered-To: webmaster(a)hlg-fuerth.de Received: from mout02.kundenserver.de (mout02.kundenserver.de [195.20.224.133]) by webserver.hlg-fuerth.de (Postfix) with ESMTP id 57F7766959 for <webmaster(a)hlg-fuerth.de>; Sat, 27 Jan 2001 17:18:36 +0100 (CET) Received: from [195.20.224.151] (helo=mrelay01.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 14MY2y-0003ix-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:52 +0100 Received: from p3ee386f8.dip0.t-ipconnect.de ([62.227.134.248] helo=ayla) by mrelay01.kundenserver.de with smtp (Exim 2.12 #2) id 14MY2c-0001ga-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:30 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE96FW1QV0X2J49MBGHIF0T" Message-Id: <E14MY2c-0001ga-00(a)mrelay01.kundenserver.de> From: Remote Mail Delivery System <> Date: Sat, 27 Jan 2001 17:17:30 +0100 Status: RO X-Status: X-Keywords: X-UID: 737 There was no message in it and has had a quite strong attachment named: 'PKCBLMPK.EXE' Is this malware? Anyone knows this file? I didn't execute it yet... Is it possible that relay01.kundenserver.de is an open relay? Thanks for help and suggestions... Max --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Message frozen
by Carlos Manuel Duclos Vergara 29 Jan '01

29 Jan '01

Hi, seeing the last talk about weird mails i remember this, do you think that this maybe a misconfigured mail server or is some kind of attack ? bye ---------- Forwarded Message ---------- Subject: Message frozen Date: Sun, 28 Jan 2001 23:25:52 -0300 From: Mail Delivery System <Mailer-Daemon(a)embedded.cl> To: postmaster(a)embedded.cl Message 14N40q-00047m-00 has been frozen (delivery error message). The sender is <>. The following address(es) have yet to be delivered: aulap1(a)ee.cl: unknown local-part "aulap1" in domain "ee.cl" ------------------------------------------------------- -- Carlos Manuel Duclos Vergara carlos(a)embedded.cl http://www.embedded.cl/~carlos

1 0

Re: [suse-security] Re: Getting weird FETCHMAIL-DAEMON messages...
by Nix 29 Jan '01

29 Jan '01

At 12:40 PM 29/01/2001, you wrote: >Dear All > > > > Here is the contents of that e-mail: > > > > From: FETCHMAIL-DAEMON(a)josswinn.org > > To: matthew(a)psychohorse.com > > Date: Mon, 29 Jan 2001 07:04:08 +0900 > >I've been getting these for a few days. Not sure where from ? > >On Thursday night at midnight my net facing box was broken into and >someone replaced sendmail.cf with another one. What this meant was >that when my box downloaded mail it then forwarded ti to many people >on the internet. I discovered this and replaced sendmail.cf before >any damage was done. > >Tonight I was about to reply to this e-mail at about midnight and >someone broke in and destroyed my Pine 4.32 mail app. That meant that >I couldn't send this mail either. > >So, what's going on ? I don't know either. Mate, Unplug the box from the net. If it has been broken into you don't know what has been compromised Please email me back privately if you need help. I will be contactable for the next 8hrs or so by email. (I am ducking out to grab some lunch now, but will be back in 20min..) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

4 7

Re: Getting weird FETCHMAIL-DAEMON messages...
by Richard 29 Jan '01

29 Jan '01

Dear All > Here is the contents of that e-mail: > > From: FETCHMAIL-DAEMON(a)josswinn.org > To: matthew(a)psychohorse.com > Date: Mon, 29 Jan 2001 07:04:08 +0900 I got a load of these after my own net facing box was attacked at midnight on Thursday night. I'm still getting some of them now. Bit difficult to do it on a dialup box which is only connected for a few minutes. But, someone did just that. Myself and a friend couldn't work out what the purpose of the attack was. We re-installed sendmail.cf and that sorted out the problem. As far as we could see someone was using my box to forward mail. That is very difficult on a dialup box. Specially when I sit in front of it and watch /var/log/messages all the time. So, whoever did it didn't seem to know too much at all. Tonight as I was about to reply to this mail someone broke in again and destroyed sendmail.cf on another machine. So, whoever he or she is they have a thing about sendmail.cf files on SuSE home user's machines. Thanks Richard

1 0

Getting weird FETCHMAIL-DAEMON messages...
by Matthew 29 Jan '01

29 Jan '01

Here is the contents of that e-mail: From: FETCHMAIL-DAEMON(a)josswinn.org To: matthew(a)psychohorse.com Date: Mon, 29 Jan 2001 07:04:08 +0900 Some addresses were rejected by the MDA fetchmail forwards to. Attachment: 1 Attachment: 2 I have opened up attachment 1 and this is the contents: From: To: Date: Final-Recipient: rfc822; josswinn Last-Attempt-Date: Mon, 29 Jan 2001 07:04:08 +0900 (JST) Action: failed Status: j.0.0 Diagnostic-Code: josswinn: 550 5.1.1 <josswinn@localhost>... User unknown I have not opened attachment 2 as it comes with an icon that is a big black T and I get warning that opening it might compromise system security. Its happened 5 times now, all from josswin.org. Is this a cracker attempt, or most likely his fetchmail daemon is not working? I have looked under www.josswinn.org and he has a web page (Flash heavily enabled). There is nothing in my log files.....Maybe this poor guy has been attacked himself? How should I proceed? Many thanks, Matt

2 1

openssh && hardensuse problem
by Br�ulio Gergull 28 Jan '01

28 Jan '01

Hi, I'm using SuSE 7.0 Professional to build a firewall. I've installed the necessary packages, upgraded to latest release and after running "harden_suse yes" opensshd just refuses to accept connections, the following message appears on the logs: Jan 27 15:53:32 maestro sshd[887]: refused connect from 192.168.0.100 (192.168.0.100) sshd is running, of course. Last week the same problem occurred on another machine and it was "solved" (?) uninstalling openssh-2.3.0p1-0 and installing openssh-2.1.1p1-43 (vulnerable) :( Versions: SuSE 7.0 openssh-2.3.0p1-0 hardensuse-2.6-1 rgrds, Bráulio Gergull

2 2

Re: [suse-security]about: was Fwd: Do I have a virus on my MBR?
by Aaron Matas 28 Jan '01

28 Jan '01

About is an internal browser command. You can check the source code for Mozilla. Netscape has some information also. Different browsers or versions of browsers give different results. The Willis message is probably in a Netscape .dll file as are the logo's. about:document shows information about current document - same as edit/view info about:cache about:memory-cache about:image-cache can use this to find images in cache about:security about:authors removed in some browser versions about:fonts about:logo WARNING: about:xxxLOGO may cause multiple about:rsalogo windows to open depending on your browers, about:javalogo if so keep hitting the Esc key till it stops about:license about:editfilenew title about:mozilla or about:moz ..got curious one day and started looking :>) Aaron Matas IBM xSeries Performance Analyst Phone: 919-254-2508 LAB: 919-486-0306 Fax: 919-254-9267 LAB-Fax: 919-547-0083 juergen.braukmann@ruhr-west.de@ruhr-west.de on 01/27/2001 11:44:24 AM To: ghamblin(a)btinternet.com cc: suse-security(a)suse.com Subject: Re: [suse-security] Fwd: Do I have a virus on my MBR? Graham Hamblin wrote: > > Hi > This is a copy of a message I have sent to Support at S.u.S.E. and put on here > for the information of all. Hope it is of help. > > I am using S.u.S.E. 7.0 Professional on a PC at home with a modem connection to > the internet. If I invoke security in Netscape whatever is showing in the > window and invoke Open Page Information there are two windows. In the top one > is the page information but in the bottom one is the following text, "Whatchew > talkin' 'bout, Willis?" and try as I may I cannot find it or get rid of it. > ... First don't Panic. Try to type something like "about:lxdkrjgklxdgjghklxd" in the address field and watch the browser window. Juergen -- =========================================== __ _ Juergen Braukmann juergen.braukmann(a)gmx.de| -o)/ / (_)__ __ ____ __ Tel: 0201-743648 dk4jb(a)db0qs.#nrw.deu.eu | /\\ /__/ / _ \/ // /\ \/ / ===========================================_\_v __/_/_//_/\_,_/ /_/\_\ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Mysterious Mail with uknown Attachment
by Max Lindner 28 Jan '01

28 Jan '01

Hi! I got a mail with the following header: >From MAILER-DAEMON Sat Jan 27 17:17:40 2001 Return-Path: <> Delivered-To: mlindner(a)agentur-lindner.de Received: from webserver.hlg-fuerth.de (unknown [212.204.100.206]) by www1.agentur-lindner.de (Postfix) with ESMTP id 19EDA111E84 for <ml(a)agentur-lindner.de>; Sat, 27 Jan 2001 17:17:35 +0100 (CET) Received: by webserver.hlg-fuerth.de (Postfix) id 9EC366695B; Sat, 27 Jan 2001 17:18:42 +0100 (CET) Delivered-To: webmaster(a)hlg-fuerth.de Received: from mout02.kundenserver.de (mout02.kundenserver.de [195.20.224.133]) by webserver.hlg-fuerth.de (Postfix) with ESMTP id 57F7766959 for <webmaster(a)hlg-fuerth.de>; Sat, 27 Jan 2001 17:18:36 +0100 (CET) Received: from [195.20.224.151] (helo=mrelay01.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 14MY2y-0003ix-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:52 +0100 Received: from p3ee386f8.dip0.t-ipconnect.de ([62.227.134.248] helo=ayla) by mrelay01.kundenserver.de with smtp (Exim 2.12 #2) id 14MY2c-0001ga-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:30 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE96FW1QV0X2J49MBGHIF0T" Message-Id: <E14MY2c-0001ga-00(a)mrelay01.kundenserver.de> From: Remote Mail Delivery System <> Date: Sat, 27 Jan 2001 17:17:30 +0100 Status: RO X-Status: X-Keywords: X-UID: 737 There was no message in it and has had a quite strong attachment named: 'PKCBLMPK.EXE' Is this malware? Anyone knows this file? I didn't execute it yet... Is it possible that relay01.kundenserver.de is an open relay? Thanks for help and suggestions... Max

3 2