March 2002 - openSUSE Security - openSUSE Mailing Lists

Goodbye
by Sven Michels 21 Mar '02

21 Mar '02

Hi all, i'm sorry but i'll leave this list now. We're bankrupt and have no gurantee for connectivity any longer. To avoid bounces etc. i'll unsubscribe. The last 2 years was a good time with many security nightmares and some funny meetings like the small on Linuxtag 2001. I'll join the list again asap. Best wishes for you all and keep your servers secure :) Thanks to the SuSE Security Team also for good support, code reviews and one of the most usefull security list. Bye, Sven Michels -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256 Junk mail is war. RFCs do not apply.

1 0

Suse security announcment re zlib
by elfed lewis 21 Mar '02

21 Mar '02

The announcment mentions netcape is affected. Does this mean Mozilla is similarly affected? Mozilla.org doesnt seem to have a "security announcment" page, so i cant figure if its affected or not. Anyone know? Elf.

6 7

Re: RE : [suse-security] IP conflict and takeover
by Martin Peikert 21 Mar '02

21 Mar '02

Miguel Albuquerque wrote: > > -----Message d'origine----- > De : Martin Peikert [mailto:Martin.Peikert@discon.de] > Envoyé : jeudi, 21. mars 2002 10:28 > À : Miguel Albuquerque > Cc : suse-security(a)suse.com > Objet : Re: [suse-security] IP conflict and takeover > > Miguel Albuquerque wrote: > >>I realised that if I use any of those IP's to another machine (it >>happened by mistake.), I lose internet access in my Linux box, and the >>domain is unreachable. Kinda normal(?), but it could be dangerous if >>someone hack into one of the Win boxes and start changing IP's.that > > > If someone is able to change the IP-adress on a Windows box, he might > be able to do some other things, too. > > >>won't be problem if there is a way to block giving the same IP to 2 >>machines (just like the Win boxes do when you try to give them an IP >>already used in the same netmask). Otherwise, it can be considered as an >>important security hole, am I wrong? > > > To change IP adresses is neither a bug nor a security hole, it's a > feature :-) > > That reminds me that all the exploitable features in Win boxes... OOPS! Would you please _learn to quote_? I didn't write 'That reminds me that all the exploitable features in Win boxes...' Add your comment, but clarify what is from me and what is _your_ (new) comment/answer/whatever. GTi

1 0

SuSEfirewall2 ftp redirecting
by Michael Appeldorn 21 Mar '02

21 Mar '02

Hi list, using SuSEfirewall2 following line makes transparent proxy for http FW_REDIRECT="192.168.1.0/24,0/0,tcp,80,8080" but how to do same for ftp FW_REDIRECT="192.168.1.0/24,0/0,tcp,21,8080" wont work. Proxy is squid 2.4 on kernel 2.4.18 Thx in advance Michael

1 0

IP conflict and takeover
by Miguel Albuquerque 21 Mar '02

21 Mar '02

Hi all, I'm not sure if this is the most appropriated list to submit my question but however it might be a security issue. OK, here it goes: we have 3 boxes in the same netmask, broadcasting 62 public IP address. One (mine) is running SuSE 7.2, and I'm hosting 16 domain names. I've 2 network cards and a couple of virtual net address. I realised that if I use any of those IP's to another machine (it happened by mistake.), I lose internet access in my Linux box, and the domain is unreachable. Kinda normal(?), but it could be dangerous if someone hack into one of the Win boxes and start changing IP's.that won't be problem if there is a way to block giving the same IP to 2 machines (just like the Win boxes do when you try to give them an IP already used in the same netmask). Otherwise, it can be considered as an important security hole, am I wrong? The thing is I just don't know how fix that. Thanks, M.Albuquerque

2 1

Transfering syslogs to a loghost
by Drew J. Como 21 Mar '02

21 Mar '02

All, I was hoping that someone can answer this quick question for me... I am setting up a loghost where all syslogs will be transfered to. I have already made the changes to all of the remote systems (adding the @), but I am having a problem with the loghost system not receiving the logs. I changed the syslog daemon to add the '-r' switch, but my other systems are still showing the following error...: syslogd: sendto: Connection refused However, when I run netstat -a on the loghost, the syslog daemon is listening... What am I missing? Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com Bascom Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed."

3 2

amavis-postfix mime decoding problem
by Oyku Gencay 20 Mar '02

20 Mar '02

Hi, I'm receiving a mail virus from a hotmail account. The message passes through amavis-postfix with antivir. The mail contains "HappyWorm". When I forward the mail, it does not pass through the mail server and antivir can detect the virus. Tracking down the problem I found out the following oddity ? When amavis decodes the mail, it creates the following file. msg-20298-4.txt The content is base64 encoded and starts as Content-Type: application/octet-stream; name=query[1].htm Content-Transfer-Encoding: base64 Content-ID: <S7K21Y.....> PasdASDasdSDQWEASdaseRQDSAdCeTLs...... and continues. When I decode this part with mimencode -u, it's plain html file with worm code in it. antivir can detect the virus in the htm file but amavis does not decode and scan the file. Is there anything I'm missing? Other than this, everything works fine with amavis-postfix and antivir. I also tried f-prot but it didn't recognize the encoded file either. Does anyone know why amavis is not decoding the mime part? I'm using amavis-postfix, postfix from the suse 7.3 CD's and antivir (latest) Regards, Oyku Gencay BTW I tried to scan the encoded file with Norton Antivirus (Win) and it recognized it's encoded and found the virus.

3 2

RE: [suse-security] What to do against ARP-Poisoning?
by Reckhard, Tobias 20 Mar '02

20 Mar '02

> here in my company the management decided to use VLANs to separate > nets of different security levels. (Not implemented yet) > Therefore i would very much like to get you started on VLANs... ;-) > > Did you have security-related problems with VLAN? Not myself, no, I have been blissfully spared VLANs up to now except for the CCNA course and exam. ;-) However, VLAN capability is quite obviously (IMHO) a feature slapped onto big switches to justify their price. If you've paid big money for a switch with a gazillion ports, you don't want to have to buy another few while having half a gazillion ports free on the expensive machine. Where security is concerned, I am more in favour of very simple layer 2 devices, such as hubs or dumb, unmanaged switches. Sure, traffic can be sniffed off a hub, but switches don't give good enough protection against that either, while the proper thing to do is to use cryptographic means to ensure data integrity and confidentiality. However, the intelligence of switches, especially managed ones, can quite easily be used against them and defending against that can be quite a challenge. If you need the throughput, go for a switch. On a backbone, you may even want to use managed switches, perhaps even those completely misnomered 'layer 3 switches'. On a DMZ or otherwise security-critical segment, however, security is very important and should have a higher factor associated with it than on a (busy) backbone, for example, where almost nothing but speed counts. I have found the original link, though, it was the first one on the Google list I just posted: http://www.sans.org/newlook/resources/IDFAQ/vlan.htm The following link looks interesting as well: http://rr.sans.org/switchednet/switch_security.php You may also want to search the firewall mailing list archives for the term 'vlan', it's been discussed a couple of times before: http://www.nextrieve.com/cgi-bin/firewalls Tobias

2 1

pine vulnerability?
by James Ferrando 20 Mar '02

20 Mar '02

Hi List, I received this notice about vulnerabilities in pine as used by Red Hat, do these vulnerabilities apply to SuSE distribution versions of pine? James Ferrando Forwarded notice follows ... Complete information about this errata can be found at the following location: https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1009 Security Advisory - RHSA-2002:009-08 ------------------------------------------------------------------------------ Summary: Updated pine packages are available Pine (version 4.43 and earlier) as released with all currently supported versions of Red Hat Linux (6.2, 7, 7.1, 7.2), contains a URL handling bug. This bug can allow a malicious attacker to cause arbitrary commands embedded in a URL to be executed on the users system upon attempting to view the URL. Description: The purpose of this release is to fix a security bug with the treatment of quotes in the URL-handling code. The bug allows a malicious sender to embed commands in a URL. This bug is present in all versions of UNIX Pine 4.43 or earlier. Example: A URL constructed as: http://www.somewhere.com/'&touch${IFS}/tmp/foo${IFS}/tmp/bar' would cause the files /tmp/foo and /tmp/bar to be created on the user's machine if the URL is viewed. Thanks to zen-parse for discovering and reporting this problem. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0014 to this issue. --------------------------------------------------------- James Ferrando james(a)ferrando.co.uk Oxford ZEUS Group

2 1

RE: [suse-security] What to do against ARP-Poisoning?
by Reckhard, Tobias 20 Mar '02

20 Mar '02

> > Now don't get me started on VLANs. Just this much: don't > use VLANs to > > 'separate' networks of (more or less substantially) different trust. > > Instead, implement physical separation. > > Obviously physical separation would clearly be better but do > you have any > links to any information about the circumstances in which VLAN > failure/overriding/etc. might occur and if there are > weaknesses in any > particular switch OSes? You've got me worried now :-) I'm sorry, I don't have any specifics anymore after a recent crash annihilated all of my browser bookmarks. I had read an article on the SANS website in which they reported the results of one test of VLAN strength. The flaws they found could be avoided by proper configuration. However, http://www.google.com/search?q=sans+vlan+switch+security&sourceid=opera&num= 0&ie=utf-8&oe=utf-8 turns up quite a number of links and at least one document that I don't know, so more may have happened. Regardless, the security community pretty much agrees that VLANs aren't meant to enforce security, the connection between VLANs and security that, for one, Cisco mentions, is drawn when comparing a VLANed switch with a non-VLANed one, not by comparison of VLANs versus physically distinct switches. As such, the argument is highly misleading, IMHO. It may well be that you won't find a lot of information on actual vulnerabilities of existing VLAN implementations. Even if you would, they should hopefully be fixed by now. However, it is probable that these vulnerabilities were found more or less by chance, not by thorough means such as a code audit. And as such, you have to assume that there'll be more problems. As is always the case, if you can't find anything in the Bugtraq archives on a certain product, that doesn't in any way mean the product is free of vulnerabilities. It just means noone has bothered to look yet. Tobias

1 0