September 1999 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Location of the Apache document root (was: Apache Source Tree under 6.1)
by Volker Kuhlmann 19 Sep '99

19 Sep '99

> I'd place the apache manual to /usr/doc/packages/appache/manual/ and > set a symlink from /usr/local/httpd/htdocs/manual -> > /usr/doc/packages/appache/manual to allow the example page to refer to > the manual. Sounds like a good idea, anyway. But it's not that simple. Preferably, I would like local documents under /usr/local, and the rest of the material that comes with apache out of there - wherever, I don't care. There are a bunch of icons, include headers, and the test page plus associated bla bla. Not sure how to do that though, while keeping in touch with the apache security model. While we're on the security list, cgi-bin is non-empty. I remember that by some default on some distribution it contained a file with serious security problems?!? Volker

2 1

Re: Your suse-security posting
by dproc＠dol.net 18 Sep '99

18 Sep '99

A copy of RSAREF source is in an archive called pgp262s.tar.gz which is available inside the US at some FTP sites - not for export. When I get some time I will probably see if it compiles against the published pgp5.0 sources. It should be no problem technically and will keep me legal for nonn-commercial use. http://www.beyond.com/ sell a wide range of license packs in the US for those using pgp for work. http://www.pgpinternational.com/ seems to be the NAI site selling commercial licences for the rest of the world. Thanks for your interest. dproc

1 0

Re: [suse-security] telnet and su attack on my linux
by earendil7＠juno.com 18 Sep '99

18 Sep '99

On Fri, 17 Sep 1999 13:44:39 -0500 "scott" <sdanahy(a)home.com> writes: >Ah, cable modems. A lot of cable modem users use WinGate to split their >bandwidth without buying additional IP addresses. The problem with that is >WinGate has a telnet proxy with no authentication installed by default >(I'm sure most of you have heard of this) and allows an attacker to "bounce" >around. Also, I think *nix boxes are a lot more common on cable modems >than they are on dial up, so the attacker could have broken into an >innocent users machine and attacked from there. > >The point of all this is, just cause you see and IP address in your logs >does not mean that is the attackers true point of origin. > >scott Yes, but since IP spoofing is somewhat beyond the level of your average script kiddie cracker, there's always a trail left behind, electronically. As long as you alert ISPs, and they take action in tracking down these crackers. Let the darwinian selection begin. dan ___________________________________________________________________ Get the Internet just the way you want it. Free software, free e-mail, and free Internet access for a month! Try Juno Web: http://dl.www.juno.com/dynoget/tagj.

2 1

A Relatively New Newbie looking for advice.
by Brian Galbraith 17 Sep '99

17 Sep '99

I have been using SuSe Linux for a few months now, but only recently joined the Security List. I have been horrified to see the amount of scanning etc which goes on., and confess to have been shown to be totally ignorant as far as system security is concerned. I suspect that I may not be much at risk..but would appreciate comments and guidance where appropriate. I am running a single work station at home. Networking is set up for ppp conection to the internet., only. I have a dynamic IP. Is there much chance of intrusion in my system,? Are most attacks targeted? Is there anything I should be doing to minimise risk. TIA Brian Galbraith -- Brian Galbraith ************************************************************** Powered by SuSE Linux 6.2 Registered Linux User 123411 Encrytped mail preferred I use GnuPG for Linux. Public Keys on request **************************************************************

1 0

Re: [suse-security] telnet and su attack on my linux
by gbruchhaus＠makrolog.de 17 Sep '99

17 Sep '99

> Oh, and I forgot: > notify the Admins (can be found via whois-llokups) of the systems you > suppose were the attackers. If the attacks really originated there, those > systems are most likely cracked and under enemies control, too. > cya, > Stefan Ya, I did it, but rr.com seems to be a big provider in US, so the cracker could hide his attack in the dynamic IP-Adress Gerd

6 7

Re: [suse-security] A Relatively New Newbie looking for advice.
by earendil7＠juno.com 17 Sep '99

17 Sep '99

On Fri, 17 Sep 1999 22:04:15 +0100 Brian Galbraith <brian.galbraith(a)bigfoot.com> writes: > >I have been using SuSe Linux for a few months now, but only recently >joined the Security List. > >I have been horrified to see the amount of scanning etc which goes on., and >confess to have been shown to be totally ignorant as far as system >security is concerned. *shrug* :) as the internet wide audit lamented, this is the case even with many experienced sysadmins and internet sites. > >I suspect that I may not be much at risk..but would appreciate >comments and guidance where appropriate. Read. read. read. Subscribe to every security mailing list you can, if only to keep up on the exploits that wriggle out like earthworms on a rainy day. There are also a few very good security HOWTOs out there -- or if you're really masochistic, buy a book on network security. > >I am running a single work station at home. Networking is set up for >ppp conection to the internet., only. I have a dynamic IP. Limit the services you host; as a general rule, you can only be remotely root exploited with whatever you choose to reveal (local users exploiting your system are an entirely different can of worms). And above all, monitor your logfiles, as most crackers (read: script kiddies) aren't very subtle nor silent while they look for a lever into your box. > >Is there much chance of intrusion in my system,? Depends. But if you're asking whether or not anonymity will protect you, it will not. Crackers employ scanners that will search whole blocks of IP numbers, looking for exploitable services. >Are most attacks targeted? Remote attacks designed to compromise your box are targeted against specific services you run, but chances are your computer/IP is not singled out for attack because the cracker doesn't like you. >Is there anything I should be doing to minimise risk. Well... an unplugged computer is completely secure ;) > >TIA > >Brian Galbraith my bag of change-- hey, i figured if i waste my time reading security type stuff, I might as well try and spread the knowledge. Just don't get it in your head that i'm an expert or anything silly like that :) dan ___________________________________________________________________ Get the Internet just the way you want it. Free software, free e-mail, and free Internet access for a month! Try Juno Web: http://dl.www.juno.com/dynoget/tagj.

1 0

Re: [suse-security] telnet and su attack on my linux
by earendil7＠juno.com 17 Sep '99

17 Sep '99

On Wed, 15 Sep 1999 15:42:05 +0200 gbruchhaus(a)makrolog.de writes: >Hi, > >today in the early morning I had something like an attack on my linux >system there ><SNIP> >My log-files showed me some hints to the attacker (if it is any): > >> Sep 15 00:13:29 d64s_pattr imapd[16408]: connect from >134.102.152.136 >> Sep 15 00:13:29 d64s_pattr imapd[16409]: connect from >134.102.152.136 >> Sep 15 00:13:34 d64s_pattr imapd[16410]: connect from >134.102.152.136 >> Sep 15 00:13:38 d64s_pattr imapd[16411]: connect from >134.102.152.136 >> Sep 15 00:13:39 d64s_pattr imapd[16412]: connect from >134.102.152.136 >> Sep 15 00:14:59 d64s_pattr imapd[16413]: connect from >root(a)155.207.113.137 >> Sep 15 00:17:12 d64s_pattr in.telnetd[16417]: connect from >24.95.241.60 >> Sep 15 00:17:20 d64s_pattr login[16418]: no shadow password for >`shizat' on >`ttyp1' from `wintersprings-ubr-c4-60.cfl.rr.com' >> Sep 15 00:17:23 d64s_pattr su: (to www) shizat on /dev/ttyp1 >How is such an attack possible and more important: how can I prevent >such an intrusion? > >I am using a SuSE Linux 5.2 with a 2.0.33 kernel > >Thanks for your help in advance > >Gerd By all accounts it looks like you got compromised by imapd, which has had some pretty recent (recent enough to give imapd a bad reputation) exploits found against it. The best way to prevent an attack is to simply not run the service, or to make sure that you always update your networking programs. As to the methodology of the attack, it was probably a buffer overrun attack-- with a program tailored to your version of imapd, the cracker can break the security of the daemon and gain the temporary ability to issue root permission commands. Just enough to let him get back in to your box with a root account. There is one good thing, though: he's more than likely a script kiddie, since he seems to have forgotten to edit your logfiles for his breakin. More than likely, he picked your computer simply because it happened to be running a version of imap that a program he got off the net happens to crack. dan ___________________________________________________________________ Get the Internet just the way you want it. Free software, free e-mail, and free Internet access for a month! Try Juno Web: http://dl.www.juno.com/dynoget/tagj.

1 0

Re: [suse-security] telnet and su attack on my linux
by gbruchhaus＠makrolog.de 17 Sep '99

17 Sep '99

> Normally it should be possible for a provider to identify his client by > IP-adress, date and time. > Peter Ya, I wrote it. But I'm sure, that the cracker uses a cracked account or a trial version. He can't be so stupid ...

1 0

SuSE Security Announcement - mars_nwe
by Marc Heuse 17 Sep '99

17 Sep '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: mars_nwe 0.99 and earlier Date: Fri Sep 17 10:53:58 CEST 1999 Affected: all Linux distributions using mars_nwe 0.99 and earlier _____________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The mars_nwe tools are vulnerable to several buffer overflows. 2. Impact An attacker might get root access to the system. 3. Solution Updated the mars_nwe package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: marsnwe-0.99.pl17-29.i386.rpm 5bc19a3237653574f97559434f0cf364 (5.3) marsnwe-0.99.pl17-54.alpha.rpm 19c2c8848ad6f4707048ab2bbf7ab5f0 (AXP) marsnwe-0.99.pl17-54.i386.rpm 9894d90ecbfca1bcc2bd8add99b90a71 (6.1) marsnwe-0.99.pl17-12.i386.rpm c9841dde2cbca88fe53447c3d762f510 (6.2) ______________________________________________________________________________ You will find the update on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/marsnwe-0.99.pl17-54.i386.rpm ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/marsnwe-0.99.pl17-54.alpha.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/marsnwe-0.99.pl17-54.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/marsnwe-0.99.pl17-54.i386.rpm Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, just send an emtpy message to suse-security-subscribe(a)suse.com or suse-security-announce-subscribe(a)suse.com like this: echo | mail suse-security-subscribe(a)suse.com or echo | mail suse-security-announce-subscribe(a)suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security(a)suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBN+IU9Xey5gA9JdPZAQH6kQf+PInny7MT6VRQCs+vSmGqVrv/5M1GjLym anw+KlHj0uHALcecLIVxNKhad07ftOqly9C+OlE197+4wkvNUq54ZAxO0GzIR4HP y3qBDw28jvtegCPbADh9QPweL5J1E1kXEUtM6KvDOCFxT8zIE1ksLcocdCYMpU/m 6OIgwCy7rya4aem4Oo7bSXmiYZCZzRpoiAT4JZ+2iALt01ijFfNTfLeiOxjwJzJz PU8QKFIgYgYFKLvnHlIpB8yUPZ3i0kvsAzPCRgltYTZcLP6ZFYBeZnGb9Fp0T+qg +kbdHsnNqaVz/d/rcw3jvOr3iNGvnL0pqs3+nUE4Wae6ZVGAFkKIgA== =kFtX -----END PGP SIGNATURE-----

1 0

[btellier@WEBLEY.COM: Two SuSE 6.2 local root exploits]
by Thomas 'Balu' Walter 17 Sep '99

17 Sep '99

Forwarded from Bugtraq. Actually I don't know in which package those programs are. I do not have them installed... I don't know, but as long those programs are suid, I think adding them to /etc/permissions.local and removing the sbit should be enough for a quick fix... Balu

1 0