November 1999 - openSUSE Security - openSUSE Mailing Lists

ipchains and masquerading (fwd)
by Thomas Biege 17 Nov '99

17 Nov '99

Hi Rene, please subscribe to suse-security mailinglist. I'll fwd. your question to this list. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 ---------- Forwarded message ---------- Date: Wed, 17 Nov 1999 11:49:08 +0100 From: Rene Bangemann <rbrabe(a)wvr.tfh-wildau.de> To: Thomas Biege <thomas(a)suse.de> Subject: ipchains and masquerading Hi, I´m using S.u.S.E. Linx 6.1 with ipchains as a firewall. I´ve got a problem using ftp through the firewall from a private network using IP´s 192.168.x.x. If I connect to an ftp-Server I can login, but if I use commands like "ls" (which is using the PORT Command) I always get error 500 ("500 Invalid PORT Command. ftp: bind: Address already in use") or 501 ("501 IP Address for data destination doesn't match client's. ftp: bind: Address already in use"). This happens only, if masquerading is used. If I use ftp from a computer which got a official IP, everything works fine. Does anyone got an idea or a solution of this problem?? Thx in advance for your help. Rene P.S.: port number 20 and 21 are open to outwards.

3 2

bind8
by Oliver Leue 17 Nov '99

17 Nov '99

hi .... while i updatet yesterday the actual bind8 from ftp.suse i'm missing now nslookup and dig and something else. i can't find it now on the system. it looks like it was deleted. someone else too? gruß oliver -------------------------------------------- E-Mail: Oliver Leue <artus-ol(a)gmx.net> Date: 17-Nov-99 Time: 12:47:53 This message was sent by XFMail/Linux 2.2.10 --------------------------------------------

4 4

rplayd
by Security Webmaster OKDesign oHG 17 Nov '99

17 Nov '99

Hi, I recently found some of the following messages in my /var/log/messages: Nov 14 23:29:10 server2 rplayd[9800]: connect from xxx.xxx.xxx.xxx Nov 14 23:29:10 server2 rplayd[9800]: error: cannot execute /usr/sbin/rplayd: No such file or directory What daemon is rplayd ? Is this some kind of breakin-attempt ? I never had such a message before. Thanks in advance for your help. --- Stephan

3 2

SuSE Security Announcement - bind
by Marc Heuse 17 Nov '99

17 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind8 < 8.2.2p2 + bind4 < 4.9.7-REL Date: Fri, 12 Nov 1999 01:56:04 GMT Affected SuSE versions: all Vulnerability Type: remote root compromise, denial of service SuSE default package: yes (not activated by default) Other affected systems: all unix systems using bind8 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description Several vulnerabilities were found within bind4 and bind8. 2. Impact All bind4 and bind8 versions can be crashed in certain circumstances. bind8 8.2 until 8.2.1 can be compromised remotely through a buffer overflow. 3. Solution Updated the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) 76afbb91c001880687e47f4dc0404807 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.2-8.alpha.rpm a5f453329a023221476143956cf11b2d ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bindutil-8.2.2-8.alpha.rpm f510a224c9f45014853c128bb0f0d0da ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/bind-4.9.7-101.i386.rpm 1e6234a05cbe7dd3c4e207743d3b4f6f ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/bind8-8.2.2-8.i386.rpm 036fbc51c9902f7fe5cba1db5ef171e0 ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/bindutil-8.2.2-8.i386.rpm bca65a23d1e6ffe284956549e8eda731 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind-4.9.7-101.i386.rpm d0bb5a9d2e4a0bb918856681828d677a ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.2-8.i386.rpm 23a77b3103ce7cae0003d632a228ce87 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bindutil-8.2.2-8.i386.rpm 3a69c1344e970d1edb580420614d052f ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind-4.9.7-101.i386.rpm e621dff7568fc5a6933e19df40283d0a ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.2-8.i386.rpm e3c23546e73f3cffeea662c9de953d99 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bindutil-8.2.2-8.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBODA5eney5gA9JdPZAQFLrQf/X1rtLhCY/LsaT/vhqe3NcgfUQ5hU1RUg yNpJGanWMafehZDQzAd/z7Uh92rGOmIqBKbDKKRV2CBuNPuyQZOrmrQLIjVtpdqA Jh1HLzWcPoyleFpXj7WLBuKogRLNG5b28QBffhAfP0tGRsCA3qZivTEfO7BKjqFY bDd/jqiywGhw3iobwi3uqi3D3MBdkjLhpmxZdtjU2hTSyVPYytkI90CeezdSkL+Z iI3AVW7OOQbRL0Jf1AfxyyGRMHb9AWfMEasusmEQeHgyokLrRt3OSAHvLqCDWH39 E2uA8C+91yNwmSzWlTfuWDCZ3EaSNSOOqpTBDy3gKwqEM+8jDto82g== =OT4w -----END PGP SIGNATURE-----

4 3

unsubscribe cguillen2@prcnet.com
by Guillen, Carlos 17 Nov '99

17 Nov '99

unsubscribe cguillen2(a)prcnet.com

1 0

MS-Exchange Folders convert to LINUX-Files ?
by MichaelRoth＠schmuecker.de 17 Nov '99

17 Nov '99

Hi, is there any way to convert the "Public Folders" from MS-Exchange-Servers (--> Outlook-Clients) to "Linux-Files" ? I am planning a security-Intranet with Apache-Webserver (i want to abolish the MS-NT-Server; it has to many sec. holes) Regards Michael J. Roth ************************************************************************ Schmücker & Partner GmbH Telefon 069/57005-421 Lurgiallee 14 Telefax 069/57005-800 60439 Frankfurt Mobil 0171/3213343 HTTP://www.schmuecker.de MichaelRoth(a)schmuecker.de ***********************************************************************

5 4

ipchains and masquerading
by Rene Bangemann 17 Nov '99

17 Nov '99

Hi, I´m using S.u.S.E. Linx 6.1 with ipchains as a firewall. I´ve got a problem using ftp through the firewall from a private network using IP´s 192.168.x.x. If I connect to an ftp-Server I can login, but if I use commands like "ls" (which is using the PORT Command) I always get error 500 ("500 Invalid PORT Command. ftp: bind: Address already in use") or 501 ("501 IP Address for data destination doesn't match client's. ftp: bind: Address already in use"). This happens only, if masquerading is used. If I use ftp from a computer which got a official IP, everything works fine. Does anyone got an idea or a solution of this problem?? Thx in advance for your help. Rene P.S.: port number 20 and 21 are open to outwards.

3 2

Re: [suse-security] Re: identd (was: SuSE ssh Distro in US)
by Eilert Brinkmann 17 Nov '99

17 Nov '99

"Torsten Behle" <tbehle(a)fcb-wilkens.com> wrote: > > This is not totally correct. I had port 113 disabled (&logged) a long > > time. I got denys during FTP transfers nethertheless FTP worked. > > But there are some FTP-Servers, which need the port open, else no > > connection will be made. > > I think the question also involved: If *yes*, how secure is it? > (And: If *not secure*, is there a way to secure it?) > Does anyone have information on that? It's totally insecure. The results of an identd request are only as trustworthy as the host running the identd. And usually you can't trust any foreign host. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

Re: [suse-security] SuSE ssh Distro in US
by Eilert Brinkmann 17 Nov '99

17 Nov '99

"Leopold Toetsch" <lt(a)toetsch.at> wrote: > > No. None of the usual services depends on the ident daemon. > > This is not totally correct. I had port 113 disabled (&logged) a long > time. I got denys during FTP transfers nethertheless FTP worked. > But there are some FTP-Servers, which need the port open, else no > connection will be made. I agree, a server can be implemented that way. (I saw this with the finger service on some hosts, too.) But this is not part of any standard (FTP, HTTP, ...) and will exclude *many* clients. You will hardly find an identd on non-UNIX platforms, and even many UNIX/Linux hosts are run with identd disabled. Therefore, IMHO in general it's a very bad idea to implement such a "feature". (Maybe there are exceptions in some very special cases.) Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

RE: [suse-security] MS-Exchange Folders convert to LINUX-Files ?
by Freudenberger Joerg 17 Nov '99

17 Nov '99

Hallo Miteinander Leider ist die bei Freashmeat angegebenen Adressen Download: http://www.halcyon.com/mango/mstons/MsToNs-1.0.tar.gz Homepage: http://www.halcyon.com/mango/mstons/ nicht mehr existent. Dummerweise auch keine Treffer in den üblichen Software-Suchmaschinen. Gruß Jörg > Try "MSToNS": MsToNs will convert your Microsoft Outlook Express and > Internet Mail e-mail folders to Netscape e-mail folders. Using Outlook > Express you can convert Outlook 9X and other e-mail formats as well. > http://freshmeat.net/appindex/1998/09/13/905661610.html Bye, LenZ

1 0