August 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] So, is Suse working on a fix for the mysqld problem?
by Marcus Meissner 13 Aug '04

13 Aug '04

On Thu, Aug 12, 2004 at 04:31:38PM +0200, Kai Schaetzl wrote: > Marcus Meissner wrote on Thu, 12 Aug 2004 13:55:16 +0200: > > The 9.0 kernel we released yesterday does not contain the fix due to a small > > technical problem here. > That explains my observations. > > All others kernels did contain the bugfix. > I can confirm that. > > > We will try to push out the fixed 9.0 kernel as soon as possible. > > Will this be a new (241) kernel or still only a replacement for 238? A kernel with a newer release larger than 238 definitely. Most likely 243. Ciao, Marcus

2 3

So, is Suse working on a fix for the mysqld problem?
by Kai Schaetzl 12 Aug '04

12 Aug '04

Unfortunately, I didn't read that thread until now and updated all of our machines to kernel 2.4.21-238 yesterday and hit the mysql problem already discussed on the weekend. Since then the thread has been quiet. So, is Suse working on a fix for this? After all, mysqld processes maxing out is a *serious* problem, the systems are effectively DoSing themselves. I urge Suse to issue a new announcement that warns about this problem, so vendors are warned and can consider halting on the upgrade. What I know so far is: - it seems all 2.4.21-238 (no matter, if Athlon, Intel or smp) on all newer Suse systems (we have 8.1 and 9.0 at the moment) are affected (maybe only 32bit, we don't have any 64bit). All systems run with latest standard Suse programs. - each time a mysql connection is closed that mysqld process goes <defunct> and stays forever until killed with "killall -9 mysqld", it's sufficient to "mysql -pxxx" and just quit, so it is surely not a problem of corrupted databases or specific programs - mysql-max does *not* seem to be affected - I have one system (Suse 9.0) with normal mysqld which doesn't seem to be affected. I don't know why. But all other 9.0 systems are affected. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.org

6 15

SUSE Security Announcement: gaim (SUSE-SA:2004:025)
by Thomas Biege 12 Aug '04

12 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: gaim Announcement-ID: SUSE-SA:2004:025 Date: Thursday, Aug 12th 2004 12:00 MEST Affected products: 9.1 Vulnerability Type: remote code execution Severity (1-10): 6 SUSE default package: No Cross References: CAN-2004-0500 Content of this advisory: 1) security vulnerability resolved: - buffer overflow in gaim problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - KDE - mozilla/firefox - ethereal - arts 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion Gaim is an instant messaging client which supports a wide range of protocols. Sebastian Krahmer of the SuSE Security Team discovered various remotely exploitable buffer overflows in the MSN-protocol parsing functions during a code review of the MSN protocol handling code. Remote attackers can execute arbitrary code as the user running the gaim client. The vulnerable code exists in SUSE Linux 9.1 only. 2) solution/workaround There is no known workaround. 3) special instructions and notes Before applying the update, all instances of the gaim client should be closed. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gaim-0.75-79.2.i586.rpm 860321d82ba69b52420f20a79d85e1cf patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gaim-0.75-79.2.i586.pa… 4f1fc5407a2edf9483103cf1e4c9667b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gaim-0.75-79.2.src.rpm 3944443b7a6739d24737eca93cc48e98 x86-64 Platform: SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gaim-0.75-79.2.x86… d6cf6e00d46bf3098f4b3a384e14b27f patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gaim-0.75-79.2.x86… 35aa894e1a3f51fa4e210d0d01bfdd17 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gaim-0.75-79.2.src.rpm 02e49732c72aec9d928a01491bca68fd ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - KDE The KDE libs package contained two occureneces of insecure handling of temporary files in the mcoputils code (Thanks to Andrew Tuitt for reporting this to us) and in the dcopserver code. These two bugs can be exploited locally to remove and/or overwrite files with the privileges of the user running a vulnerable KDE application. A bug in the kdebase3 package allows the content of unrelated browser windows to be modified. This issue may be used to trick users into entering sensitive informations on a malicious web-site. New packages will be available soon. - mozilla/firefox We are currently testing new mozilla/firefox packages that include several fixes for security-related bugs. New packages will be available soon. - ethereal It may be possible to make Ethereal crash or run arbitrary code by injecting a malformed packet or by convincing someone to read a malformed packet trace file. (CAN-2004-0633, CAN-2004-0634, CAN-2004-0635) New packages are available at our FTP servers. - arts This update removes an inconsistency in the comparsion of credentials while creating temporary files. This flaw can be exploited locally in conjunction with setuid Arts applications. (very unlikely) ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iQEVAwUBQRtg6Hey5gA9JdPZAQHLzQf/XkHTl/qHDMtyNluHXvyuVSJhqPWmZhEr FgkBtCtbmb4ni4vMpfWYhF6QSxARdRtDWT8ejhMcheswMgCQkOJCo95ecLOfXYLs V8aR/cyZMgQX0i9ph2ZZkuwcNDGBAGV6GBN3B6AcjL1db5xXPDeI1LLmqkQnWOdr FLptFIPwMsmmx40/W5ICg5xlO5GtQE94aW+zB1qLYdAHFs1mFM1o8GMHllbzZiqf wW/ZqJK2eFeg3Lq9H7s6ZHBtsMbEFPv+UNzCQexQviTiDBv98FvBDakdyORrTnaS 6JYfdLjeZqBmESdgVBeRvcgR+96TwTByaDkZK0lckOG7lHBaNbP5gw== =j6iP -----END PGP SIGNATURE-----

1 0

How to allow fragmented packets through SuSEfirewall2
by Simon Oliver 12 Aug '04

12 Aug '04

My goal here is to allow NFS/NIS traffic through the SuSE Firewall on a 9.1 system. > I did find a useful resource at > http://www.lowth.com/LinWiz/nfs_help.html > but it is a little out of date (SuSE 7.3). This recommends > tying down nfsd (and associated services) to specific ports > so that less holes need to be opened in the firewall. > > Tying down the ports seems quite messy according to the > guide, and I'm worried that an automatic update could > overwrite one of the altered files and cause something to > stop working. I decided to read through the sysconfig files and init.d scripts in order to work out the best way to open holes in the firewall for NFS and NIS. At this point I noticed that in 9.1 SuSE don't provide any mechanism to assign static ports to rpc services such as rpc.mountd. Instead they simply scan the ports (rpcinfo -p) to build a service-to-port mapping and dynamically add firewall rules for the ports associated with selected services (FW_SERVICES_EXT_RPC in /etc/sysconfig/SuSEfirewall2). This is not only a more elegant solution but also solves the problem where an rpc service has no mechanism for binding to a specific port. Well done SuSE! But I now have another problem, due to my lack of experience with configuring SuSEfirewall2... It is my understanding that as well as opening the appropriate rpc ports and port 111 in the firewall, it is also necessary to allow fragmented through. Under RHEL I do this by adding a rule to the start of the INPUT chain: iptables -I INPUT -f -j ACCEPT. However, I'm not how to accomplish this with SuSEfirewall2. I've looked through /etc/sysconfig/SuSEfirewall2 and can't see any easy was to allow fragmented packets through. I've scanned /sbin/SuSEfirewall2 and can't find any reference to fragmented packets there either. I guess I have to create a custom rule via the file specified by FW_CUSTOMRULES - but how to do that? So I have two questions: - If SuSE recognise the need to open up rpc ports for NFS why do they not provide the functionality to allow packet fragments through? - Can anyone help me solve this problem right now? Thanks -- Simon Oliver

2 2

completed automatic online updates
by Kurt R. Rahlfs 12 Aug '04

12 Aug '04

I am using the automatic yast online update. It's output shows an "I" before some of the updates. The "I" could be for the english work "install." Are these updates that have been applied to my system? Or is there further work for me to do? TIA, KurtRR -- Kurt R. Rahlfs affinity Computer Masters, LLC 721 South Mustang Road Yukon, OK 73099-6778 http://www.affinityCM.com 405.350.6984

2 1

Re: ArGoSoft Mailing List Server
by Roman Drahtmueller 12 Aug '04

12 Aug '04

On Thu, 12 Aug 2004 postmaster(a)elliscomp.com wrote: > From: postmaster(a)elliscomp.com > To: draht(a)suse.de > Date: Thu, 12 Aug 2004 04:06:41 +0200 (CEST) > Subject: ArGoSoft Mailing List Server > > Command > > > > > not understood. > > Please send mail to postmaster(a)elliscomp.com, containing word HELP as the first non-blank line for the list of available commands. > > ArGoSoft Mailing List Server > *zap* R.

1 0

sorry for this test
by Kurt R. Rahlfs 12 Aug '04

12 Aug '04

will it bouce now?

2 1

reiserfs strange behavior
by Uwe Debacher 12 Aug '04

12 Aug '04

Hi, I have a strange problem with reiserfs and SuSE 9.1. There seem to be pairs of filenames which are not different in the same directory. An example is nb3001/mm3001: /tmp> mkdir nb3001 /tmp> mkdir mm3001 mkdir: kann Verzeichnis „mm3001“ nicht anlegen: Die Datei existiert bereits /tmp> rm -r mm3001 > ls nb3001 /bin/ls: nb3001: Datei oder Verzeichnis nicht gefunden This problem exists on any reiserfs partition an any of my SuSE 9.1 systems. If I change to ext3 everything is OK. Even reiserfs on SuSE 9.0 ist OK. No matter whether you create files ore directories. ls always shows the created file, but rm, chown, ... may use both! Some other pairs are bb3001/am3001 gb3001/fm3001 mb4001/lm4001. Any hint where the problem or better the solution is? Best Uwe

8 13

Hardware dependency - Is SuSE working on it ...
by Bill.Light＠kp.org 11 Aug '04

11 Aug '04

I had to rebuild after the last kernel update - will this "new and improved" mysql fix kernel also be unavailable if you want the machine to ever re-boot again ? Is SuSE going to address the issues from the last "wonderful" experience ? ================= From Monday ================= EXT2 - AMD 1Ghz Athlon with 512Mb memory - just "ate it" with Kernel update. I decided to try "standard" YAST2 update and took the kernel selection, now it won't even find the disk (IBM 18G connected to Adaptec 29160) pretty vanilla if you ask me. Pretty "secure" kernel if it won't boot. There's nobody that's hacking this box now... Is there a way to get the security part of the update without the wonderful disk destruction ?

1 0

harden_suse
by tfulton9909＠comcast.net 11 Aug '04

11 Aug '04

Hello, What is that status of harden_suse in SLES 9 in light of Bastille being released? thanks

2 1