December 2003 - openSUSE Security - openSUSE Mailing Lists

Crackers Trap tool/project
by Mario Ohnewald 03 Dec '03

03 Dec '03

Hello List! I have the book "Linux Security" by Bob Toxen and he has a tool in his book called "Crackers Trap" which looks for "funny" connections and then bans the source ip. Is there a open project which is similar? Cheers, Mario -- +++ GMX - die erste Adresse für Mail, Message, More +++ Neu: Preissenkung für MMS und FreeMMS! http://www.gmx.net

3 2

suse 8.1 : ptrace exploit still working fine!?
by Olivier M. 03 Dec '03

03 Dec '03

A suse 8.1 based server has been cracked, and the "visitor" left all his tools, so I've been able to play with it as well. The server was kept "up to date", but look at that: om@box:~/tmp> uname -a Linux box 2.4.19-4GB #1 Fri Sep 13 13:14:56 UTC 2002 i686 unknown om@box:~/tmp> cat /etc/issue Welcome to SuSE Linux 8.1 (i386) - Kernel \r (\l). om@box:~/tmp> rpm -qa|grep k_ k_deflt-2.4.19-340 om@box:~/tmp> id uid=400(om) gid=500(nofiles) groups=500(nofiles) om@box:~/tmp> ./ptrace [*] PID of Parent: 22768 [*] PID of Child: 22769 [*] Attaching to PID 22770 [*] Got registers! [!] EIP: 0x4000eaed [!] ESP: 0xbffffa48 [!] EBP: 0xffffffda [!] EAX: 0xbffffa8c [!] EBX: 0xbffffc74 [!] ECX: 0xbfffff7c [!] EDX: 0x400130ec [!] EDI: 0x00000000 [!] ESI: 0x400135fc [*] Injecting shellcode (0x4000eaed) [*] Detaching from PID 22770 [*] Voila baby, entering rootshell! sh-2.05b# [*] waiting for SIGCHLD... sh-2.05b# id uid=0(root2) gid=0(root) groups=500(nofiles) sh-2.05b# Well... I thought that ptrace problem has been fixed... ? (in suse 8.2 it's fine, the exploit is not working) Regards, Olivier -- _________________________________________________________________ Olivier Mueller - om(a)8304.ch - PGPkeyID: 0E84D2EA - Switzerland

7 10

RE: [suse-security] IPTables and GRE Packets
by Peer Stefan 03 Dec '03

03 Dec '03

Hi, > From: Drew J. Como [mailto:dcomo@bascom.com] > All, > > I am having a problem that I hope someone could shed > some light on. I have a machine running 3COM VPN software > behind a SuSE 7.3 system running the 2.4.20 kernel. > > I am having a problem writing the appropriate rules that > will allow this machine to talk to a VPN server that is sitting > on the outside world. > > I know I have to write a protocol 47 rule, but am not sure > the exact syntax. > > I tried the following: > iptables -A FORWARD -i eth0 -o eth1 -p 47 -j ACCEPT Shouldn't that read iptables -A INPUT -i eth0 -p 47 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -p 47 -j ACCEPT iptables -A OUTPUT -o eth1 -p 47 -j ACCEPT And what about replies? I would not use -i for such a rule, I'd rather use --source and --destination Could you give some more details about your rules? Maybe the connection gets denied by an other rule. > However, running a tcpdump while trying the connection shows: > 172.16.0.1 > 172.16.0.16: icmp: x.x.x.x protocol 47 port > 34827 unreachable > (x.x.x.x = outside address) > > Do I need to add additional support rules, or is my syntax just > incorrect? > > Any assistance that can be offered is greatly appreciated. > > Drew cheers, Stefan

3 2

ulimit -v workaround for the do_brk() bug does not work
by Erik Hensema 02 Dec '03

02 Dec '03

Hi, Maybe this has been discussed earlier today on this list, but I've just joined it. I was told that doing a 'limit -v 2097151' would work around the do_brk() bug. Unfortunately it does not :-( The sample exploit posted on bugtraq manages to reboot my SuSE 8.2 machine (standard kernel) despite the ulimit. -- Erik Hensema (erik(a)hensema.net)

1 0

Re: [suse-security] suse 8.1 : ptrace exploit (Solved)
by GarUlbricht7＠netscape.net 02 Dec '03

02 Dec '03

Kastus <NOSPAM(a)tprfct.net> wrote: > >On Mon, Dec 01, 2003 at 12:22:52AM +0100, Olivier M. wrote: >> >> I don't remember when the update has been installed, >> so I can't tell if server has been rebooted since then. > > rpm -qi k_deflt > > It tells package installation date. > > Regards, -Kastus > >-- Kastus, Another good command for Oliver to have run, would have been "uptime" It would have told him how long the system has been running (man uptime). For as you had surmised early on, after installing the new Kernel last September, they (probably not Oliver but SyS Admin on that machine) forgot to "re-boot" the machine. Hence their machine was still running the old kernel. If they had used either YOU or fou4s, the "script" would have reminded them to re-boot. Or if they had read SuSE-Security Readme: http://www.suse.de/de/security/2003_034_kernel.html Step 4: "Re-boot." the problem would have been solved last September, without worrying the rest of us who are running 8.1, with the vanila k_deflt kernel. Oh well. Bottom line, another mystery solved. Gar -- __________________________________________________________________ McAfee VirusScan Online from the Netscape Network. Comprehensive protection for your entire computer. Get your free trial today! http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397 Get AOL Instant Messenger 5.1 free of charge. Download Now! http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

2 1

Fdisk fails while creating a raid-1
by Kai Pfeiffer 02 Dec '03

02 Dec '03

hello all, I want to create a raid-1-array on my SUSE 8.0 machine. I have built two 10.6 GB raid-partitions on hda(40GB) and hdc(20GB) both in the extended partition of the harddisks. If I tell Yast to create the raid, I get the error that Fdisk failed while creating the raid-array. Is there a possibility to create the raid-array "by hand" (without Yast), and could someone describe me, how to install the raid with alternative Tools. Thanks Kai Pfeiffer

2 1

RE: [suse-security] Bugs on Kernel 2.4
by GarUlbricht7＠netscape.net 02 Dec '03

02 Dec '03

"M. Edwin" <edwin(a)nsi.co.id> wrote: > >Dear all, > >One of my friend here just told me that there are some weaknesses on kernel >2.4.0 to 2.5.69. He kows it after reading e-week report. It told that after >several attack on Debian server, the researcher know that the weaknesses is >come from the kernel. > >I just curios is there any patch from suse about this matter? > >Regards, >M. Edwin > Hi Edwin, This is my take and not offical. However, a posting at Slashdot indicates that both SuSE and Redhat are working on it. http://developers.slashdot.org/developers/03/12/01/2133249.shtml?tid=106&ti… The "newest kernels" apparently have already solved the problem, so I expect that there will soon be a SuSE patch. Friendly greetings. Gar -- In the Beginning was the Command Line ---Neal Stephenson -- __________________________________________________________________ McAfee VirusScan Online from the Netscape Network. Comprehensive protection for your entire computer. Get your free trial today! http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397 Get AOL Instant Messenger 5.1 free of charge. Download Now! http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

4 4

Bugs on Kernel 2.4
by M. Edwin 02 Dec '03

02 Dec '03

Dear all, One of my friend here just told me that there are some weaknesses on kernel 2.4.0 to 2.5.69. He kows it after reading e-week report. It told that after several attack on Debian server, the researcher know that the weaknesses is come from the kernel. I just curios is there any patch from suse about this matter? Regards, M. Edwin

1 0

Re: [suse-security] Forward requests
by GarUlbricht7＠netscape.net 02 Dec '03

02 Dec '03

"Chris Bek" on Mon, 1 Dec 2003 6:30:31 AM EST (approx)wrote: > >Still I have no answer regarding how to do this!! >Thanks for the information though. >Chris > >----- Original Message ----- >From: "Markus Gaugusch" <markus(a)gaugusch.at> >To: "SuSE-Security" <suse-security(a)suse.com> >Sent: Monday, December 01, 2003 12:52 PM >Subject: Re: [suse-security] Forward requests > ----<text snipped>--- >> >> > PS: SuSE 8.1 out of the box >> No updates?! PLEASE update your box using YOU or fou4s >> (fou4s.gaugusch.at)! >> >> -- >> __________________ /"\ >> Markus Gaugusch \ / ASCII Ribbon Campaign >> markus(a)gaugusch.at X Against HTML Mail >> / \ >> Chris, it is my experience that no one on this list (ie suse-security) will take you seriously if you haven't "patched" your box. If you don't know how, write me "off-list" or subscribe to SLE (suse-linux-e) http://www.suse.de/en/private/support/online_help/mailinglists/index.html (I am currently running SuSE 8.1, with up to date patches using fou4s) Friendly greetings, Gar -- PS see: http://www.suse.com/de/security/announcements/index.html PPS. If nothing else you need to update your 8.1 Kernel, see: http://www.suse.com/de/security/2003_034_kernel.html -- __________________________________________________________________ McAfee VirusScan Online from the Netscape Network. Comprehensive protection for your entire computer. Get your free trial today! http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397 Get AOL Instant Messenger 5.1 free of charge. Download Now! http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

1 0

IPTables and GRE Packets
by Drew J. Como 01 Dec '03

01 Dec '03

All, I am having a problem that I hope someone could shed some light on. I have a machine running 3COM VPN software behind a SuSE 7.3 system running the 2.4.20 kernel. I am having a problem writing the appropriate rules that will allow this machine to talk to a VPN server that is sitting on the outside world. I know I have to write a protocol 47 rule, but am not sure the exact syntax. I tried the following: iptables -A FORWARD -i eth0 -o eth1 -p 47 -j ACCEPT However, running a tcpdump while trying the connection shows: 172.16.0.1 > 172.16.0.16: icmp: x.x.x.x protocol 47 port 34827 unreachable (x.x.x.x = outside address) Do I need to add additional support rules, or is my syntax just incorrect? Any assistance that can be offered is greatly appreciated. Drew

1 0