September 1999 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] proFTP remote exploit?
by Jochen Lillich 12 Sep '99

12 Sep '99

suse-security(a)fortytwo.ch (Adrian von Bidder) writes: > acidrain(a)HACKBOX.COM posted a proftpd exploit (buffer overflow, it > seems) some days ago (27.8.). Does somebody know of the proFTPd > release used in SuSE 6.0/6.1/6.2 are vulnerable to this? Is there a > new rpm that is not vulnerable? There seems to be no rpm yet, but a new version is available. It is not stated on the site yet, but on the ProFTPD mailinglist version 1.2.0pre4 was announced, which fixes the bug that was mailed to Bugtraq this weekend. <snip from "MacGyver" <macgyver(a)tos.net> > Until then, I'm announcing ProFTPD 1.2.0pre4 -- this fixes the bug announced on BUGTRAQ, as well as addresses (hopefully) all the sprintf-style buffer overruns in ProFTPD. Please download, test, and knock it around. I suspect this version will still fail on FreeBSD (anyone care to offer up an account for me on a FreeBSD system to test on?). You may get 1.2.0pre4 at ftp://ftp.tos.net/pub/proftpd/. </snip> The problem is that I get a lot of errors when I try to compile the package under SuSE 6.2. :-( Regards, Jochen -- *** Linux BBS: Die deutsche Website fuer Linux-News und -Infos *** http://www.linuxbbs.org/

5 5

/etc/pam.d/login
by Peter Münster 11 Sep '99

11 Sep '99

Hello, in the mentioned file (SuSE-6.2) is a line session required /lib/security/pam_unix.so none # debug ... causing syslog messages at each login. Only deleting the "none" option leads to a "normal" behaviour. Is this a bug in pam_unix or did I forget something. Cheers, Peter -- ******************************************* URL: http://gmv.spm.univ-rennes1.fr/~peter/ *******************************************

2 1

qmail
by Marc Bollmann 11 Sep '99

11 Sep '99

First I hope I don't upset anybody with this question, but I think changing from sendmail to qmail is a security upgrade. I tried to install it by compiling the source code and when I wrote ./configure it said: Your hostname is earth. soft error Sorry coudn't find your host's canonical name in DNS. You will have to set up control/me yourself. After that I wrote ./config-fast earth.heaven (That's my full hostname) and ./config But I got the same answer. Here is my question: What is my mistake? Regards Marc

4 3

SuSE Security Announcement
by Thomas Biege 09 Sep '99

09 Sep '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ Package: pine-4.x and earlier Date: Wed Sep 9 12:59:28 CEST 1999 ______________________________________________________________________________ On June the 28th SuSE released a new pine package, which fixes a security bug. Unfortunately the patch brokes IMAP support for pine. Now there is a new package available which works correctly. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: 7696893534bb32b15d7d9191ffc1d95a pine-3.96-28.i386.rpm (5.3) d70ef356f093683c85cba53cc573c1b5 pine-4.10-40.i386.rpm (6.1) 1bf7c1be43887933a2076faaf3e30297 pine-4.10-40.i386.rpm (6.2) fdaaf79987d232473316f4cba64c4f91 pine-4.10-40.alpha.rpm (AXP) ______________________________________________________________________________ You will find the update on our ftp-Server: ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pine.rpm ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/pine.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pine.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/pine.rpm Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to majordomo(a)suse.com with the text subscribe suse-security or subscribe suse-security-announce in the body of the message. Or just issue a echo subscribe suse-security | mail majordomo(a)suse.com or echo subscribe suse-security-announce | mail majordomo(a)suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security(a)suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBN9eatXey5gA9JdPZAQHSXAgAij2g89+iifZWf/l9JBkXcHhjsI1uq/6f NrPO8uhg7rYdbafFcRELEgTiuz4nmcmWyiUi4IsazNwHsHL46D20h2w+vdZR3POm u5CfSZVRiTtgRVdcdzZ//Kn0nS/g2ynIWqHSPMOOKwQHr1kFmS31tXRTdA+sRsx3 +CYJLpKurwCWNCC7DDQNVrOwzKyx3ZCuwS6yxAFEsi/X/oNn/MFvbNSzHz77Tbtq y32xkUvL/Gellsb0uo46r3pd6qVqFZhJ0YADPxzC4MH8uFXcI84OIZxhWRjSFgbG WffsphdmPhzafLGu2TSX14CBDFcZiVW2U1e753Brz2glb66SZRG5hA== =Q56g -----END PGP SIGNATURE-----

1 0

Re: [suse-security] Privacy software on SuSE ??
by dproc＠dol.net 09 Sep '99

09 Sep '99

On Tue, 07 Sep 1999, a kind suse-security reader replied off the list: > Many folks still prefer pgp263 because it is considered > less bloated ... and more secure ... > mutt ... I think that it speaks gpg well ... I use pgp2 > and pgp5 and mutt on my SuSE 6.0 / 2.2.10 box ... > surf on over to www.mutt.org ... there are some PGP notes > which you might find helpful. Obligingly mutt and pgp263 gave me this output on his mail: [-- PGP output follows (current time: Tue Sep 7 10:32:55 1999) --] Warning: Unrecognized ASCII armor header label "MessageID:" ignored. ^GUnsupported packet format - you need a newer version of PGP for this file. For a usage summary, type: pgp -h For more detailed help, consult the PGP User's Guide. [-- End of PGP output --] [-- The following data is PGP/MIME signed --] ... presumably he was using one of the new formats in pgp5 :-) I found in my tarball from www.mutt.org "mutt-0.95.6/doc/PGP-Notes.txt" dated Oct 8. There are some very useful hints for getting pgp5 and pgp2 working to satisfaction (I would also recommend Roland Rosenfeld's 'ultimate' .muttrc as a companion to get started on such things.) There is also some explanation of how to cope with the difference between 'old' PGP sigs and PGP/MIME (suse-security-announce and cert-announce both use the old in line sigs - I just saved and successfully pgp'd at the command line - but I guess with the procmail recipe given, such sigs can be verified automatically) What I need to know now is what docs to read to minimize and resolve issues like 'Unsupported packet format' for me and my correspondents. I guess with security work paying so much more than technical writing, it will be a while before someone publishes a thorough article or book explaining the 1999 state of the art for end users. Maybe I am wrong. Anyone guess what privacy software will be standard in SuSE Linux 6.3 ? Thank goodness https isn't so much trouble ! dproc

2 2

Privacy software on SuSE ??
by dproc＠dol.net 08 Sep '99

08 Sep '99

Have you seen a write-up explaining what ciphertexts, keys and sigs work with which file crypto tools (PGP2, 5, 6, GPG) (and which MUAs for that matter - and I suppose I should mention S/MIME in Netscape) ??? (And which algorithms are actually widely trusted.) I guess such a HOW-TO is in one of the new tarballs somewhere - I just don't have 10 hours to hunt for it if someone on the list has already seen it - or written it. ----------------- Why do I ask ? I just got the quarterly bulletin from CERT, and it has thrown me into some confusion about choosing the lowest hassle way to keep mail private. I recently installed mutt, and over the weekend got my SuSE rpm copy of PGP 2.6.3 working - I was very impressed by the slick key management, prz's great documentation, and the integration with mutt. (Er... I redden with shame as I only used Lotus Notes for strong-ish encryption up to now, and reading Phil Z I realize I should have been verifying unsigned keys.) Now CERT are getting rid of their RSA key and going to PGP 6.5 with a new key - to get a *wider* audience. Meanwhile the gossip is about GPG which is apparently nearly ready for 1.0 release, does not fall under the IDEA or RSA patents and is compatible with PGP 5.x (although how it verifies a PGP sig without using RSA and IDEA is a mystery I didn't read deep enough to fathom) but needs a glue script to be command-line-compatible. Messages and sigs from any of these are (I guess) not readable with 2.6.3 Now I haven't seen official SuSE rpm's for any of these, but I guess there wouldn't be much trouble downloading the source for each of these, compiling and playing with it, non-commercially (I don't see a 'stable' 0.8x release of GPG.) I don't imagine there would be any conflict with SuSE tools, though the progs may conflict with each other unless I am careful with the make options. No the real problem for me is making sense of all these new algorithms and file formats. Which type of keys would I make, what software should I encourage less experimental users to learn, what should they agree with their friends about tools and algorithms? If anyone has summarized the issue, we could come up with our own answers to these questions. dproc

2 1

ftp over Firewall
by Dominic Santi 08 Sep '99

08 Sep '99

hallo all Is there a howto or FAQ for ftp over a firewall or a secure ftp over a firewall. thanks for help regards dominic

3 2

suse6.1: termcap update doesn´t install
by Thilo Herrmann 08 Sep '99

08 Sep '99

the security update termcap-2.0.8-80.i386.rpm from ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/ doesn´t install for suse 6.1. It complains about: libNoVersion.so.1, libc.so.6 (GLIBC_2_0) libc.so.6 (GLIBC_2_1) but of course glibc is installed. Eventually suse did put up the wrong version here, or it´s a problem in my installation. Did anyone succeed in installing it (for 6.1)?

1 0

Re: [SLE] SSH for USA (SuSE 6.2)
by Dr. Chuck Hall 07 Sep '99

07 Sep '99

try http://www.cs.hut.fi/ssh chuck

1 0

Re: [suse-security-announce] SuSE Security Announcement
by F. Steiner 07 Sep '99

07 Sep '99

Hi, Thomas Biege wrote: > Package: cron-3.0.1-75 (Vixie Cron) and previous versions > Here are the md5 checksums of the upgrade packages, please verify these > before installing the new packages: > > bfc9ab01fdfd36eebb3cc398bbb34c37 cron-3.0.1-84.i386.rpm (6.2) > 8998dbecf020d8a6f7ba1a2885f986da cron-3.0.1-82.i386.rpm (6.1) > > ______________________________________________________________________________ > > You will find the update on our ftp-Server: > ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/cron-3.0.1-84.i386.rpm > ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/cron-3.0.1-82.i386.rpm on the ftp-server in ../6.1/a1/ there is only a packet cron-3.0.1-84.i386.rpm and not -82.. And the checksum is c69d27fdeba1e3213cbfa93e486596f6. What's wrong there? Which packet must I install and where do I find it? Thx :-) Best regards, Frank -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Dipl.-Inform. Frank Steiner Lehrstuhl fuer Informatik II RWTH Aachen, D-52056 Aachen ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Phone: +49 241 80-21241 Fax: +49 241 8888-217 mailto:steiner@informatik.rwth-aachen.de http://www-i2.informatik.rwth-aachen.de/steiner/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0