January 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] netscape call chown
by Thomas Biege 19 Jan '00

19 Jan '00

Salut, > > Send bug reports concerning non-open-source programs to the authors. > > We can't fix bugs w/o source code. > > Man, that is kind of attitude! To me the message looks like a > *possible* security breach. Possibly caused by one of the > participants (Netscape, KDE, X11 and SuSE). Gentleman, please. There are some facts to notice here. 1.) Netscape Navigator is known to have some nasty bugs and becomes a real waepon against security if Java & Co. is enabled. 2.) As long as the source code isn't open source only Netscape can fix these bugs. 3.) In this special case calling chmod in the startup script isn't a bug nor a security breach BTW, the chmod call in the startup script has nothing to do with netscape to hang. The only not-so-serious bug is the missing path of the chmod command. If PATH points to world-writeable directories the user has _alot_ more and serious problems. ;) Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Re: [suse-security] netscape calls chmod
by Juha Virtanen 19 Jan '00

19 Jan '00

From: Hans v. Sommerfeld <snoopy(a)redbaron.bir.uunet.de> January 19, 2000 04:17: >For security reasons you should block JavaScript, ActiveX and alike on every >internet traffic browsers. If you look around security lists they will tell you >many breaches you are opening with allowing the execution of active contents. I strongly agree on that JavaScript is a Bad Thing(tm), but with Netscape enabling it is a must to get style sheets (CSS) to work! Cheers, Juha

1 0

printenv, info2html - default setup in SuSE allow unwanted disclosure of information.
by back up account 19 Jan '00

19 Jan '00

The tool SAINT found a venerability with a test-cgi file that I had on my site. By executing http://hostname/cgi-bin/test-cgi?/* one could gather that's sites configuration information. I also notice by default SuSE also puts printenv (gives lots, lots info), info2html & some other files in the cgi-bin directory. Any of these files can be executed by type http://hostname/cgi-bin/filename?/* - from any site on the internet. I changed my file permissions on theses files - problem corrected. Is this a SuSE standard configuration - or did I screw my installation some where. Thanks Lee

2 1

[link@foo.fh-furtwangen.de: Re: [suse-security] Correction: was :(re: [suse-security] netscape call chown)]
by brian-suse＠delta.stech.cx 19 Jan '00

19 Jan '00

Pretty much, it looks like it fixes permissions on $HOME/.netscape/... so other users won't be able to get at your "private information" (i.e. cookies) command executed: chmod -f -R go-rxw $HN & $HN is set to $HOME/.netscape -Brian --almost-original-message-- Oliver Leue wrote: > >> today i found that netscape calls "chown". > not chown, but chmod. > > Send bug reports concerning non-open-source programs to the authors. > > We can't fix bugs w/o source code. > that's what i did. send it to netscape. > but that's not only a bug. it's a security-hole too isn't it? Well, we do a simple "grep chmod /usr/X11R6/bin/netscape" and found this command in the SuSE netscape startup-script . So, is it a "bug" in netscape or in the startup script?! -- Rainer Link, eMail: linkra(a)fh-furtwangen.de, WWW: http://rainer.w3.to/ Student of Communication Engineering/Computer Networking, University of Applied Sciences,Furtwangen,Germany,http://www.ce.is.fh-furtwangen.de/

2 1

netscape call chown
by Oliver Leue 18 Jan '00

18 Jan '00

hi... today i found that netscape calls "chown". using netscape 4.7 and suse 6.3 (all updated) i had enabled java and javascript (not for emails..) and disabled cookies including to warn. after i'd calling the website www.einslive.de and wanna go back via click to home to my homesite www.heise.de, netscape hangs. looking in kde-taskmanager i found a zombie "chown" and saw, that this was initialized from netscape. nothing was happend, just netscape hangs. for my underständing it is incredible that netscape can call chown. whyever. there is no one reason therefore. should be checked or? ---------------------------------- E-Mail: Oliver Leue <artus-ol(a)gmx.net> Date: 18-Jan-00 Time: 18:52:03 This message was sent by XFMail ----------------------------------

9 13

AW: [suse-security] DEC 21140-NIC on SuSE 6.3
by Melanchthon, Daniel 18 Jan '00

18 Jan '00

> -----Ursprüngliche Nachricht----- > Von: Chkrimmer(a)aol.com [mailto:Chkrimmer@aol.com] > Gesendet am: Montag, 17. Januar 2000 20:14 > An: suse-security(a)suse.com > Betreff: [suse-security] DEC 21140-NIC on SuSE 6.3 > > I have some problems with SuSE 6.3 and the network. And where is the security problem? Daniel

1 0

DEC 21140-NIC on SuSE 6.3
by Chkrimmer＠aol.com 17 Jan '00

17 Jan '00

I have some problems with SuSE 6.3 and the network. I am running a DEC21140 NIC on a Pentium II 333MHz and a switched (!) 100MBit network. The system is working fine but for one drawback: Accessing the linux box over the network with another fast machine (Pentium II 400 MHz running Win98 and the same type of NIC), the network freezes. It happens only when writing to the linux box, and after it happens, no network traffic is possible. The type of connection (e.g. SMB or FTP) does not matter. Reading can be done without any problems. Running a few ping processes on the linux box helps a little (causing the ping to take upt to 30 seconds to respond but reduces the probability of a complete freeze) but that is certainly no cure. The system can be reenabled by stopping and starting the network (and the needed services, of course). The problem is definitely related to the network speed. Using a slower machine or a not switched network prevents it from happening. There are no messages in the log files that point to any particular problem. I would highly appreciate any suggestions how to get this up and running. Does anyone has or had similar problems? Yours, Christian.

2 1

ftp across firewall (ipchain)
by Thorsten Marquardt 17 Jan '00

17 Jan '00

Hello, my firewall is currently set up to do ip-masquerading only and everthing works fine but ftp. I can conect to an remote host but every ftp-command leeds to an error: illegal protocol What do have to do to get rid of this? Mit freundlichen Grüssen Thom -- Success is like a fart - only your own smells nice. -- James P. Hogan ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://www.pzt.de -------------------------------------------------------------------

3 2

Re: English [was] Re: AW: [suse-security] Probleme mit Postfix bei Update auf SuSE 6.3
by Andrew Hougie 17 Jan '00

17 Jan '00

On Sun, 16 Jan 2000 15:25:52 -0800 (PST), Edward Craig <epcraig(a)efn.org> wrote: > Be nice, it was a lost newbie. We do get German on the security >list occasionally, when it's really useful some helpful type will >eventually translate. After all, sometimes we get notes from German >developers, not all of whom happen to write English comfortably. I'd >rather put up with foreign languages than miss out on useful information >because somebody hasn't the patience to wait for a translation. We >occasionally get a post in another language or two still. Noted > So far yours is the first comment I've seen implying that this is >an English-ONLY list. Not, that it isn't for the most part, I just don't >think it's been defined as such. ---sniped--- See http://www.suse.de/en/support/mailinglists/index.html. Suse-security is defined as an English language list. Actually if you look at the list of mailing lists it's interesting which languages they're in. Some have separare English and German lists. Some are dual language and some are one only. Security and security-announce are English with no German equivalent, while suse-isdn is German only with no English equivalent. I wonder why ... --snipped-- -- Andrew Hougie, Rainbow House, London, England, NW6 1QE Email: andrew(a)hougie.co.uk WWW: http://www.hougie.co.uk

1 0

Re: [suse-security] ftp across firewall (ipchain)
by Thorsten Marquardt 15 Jan '00

15 Jan '00

Hello, the insmode ip_masq_ftp did the job. Thanks to all of you for the hint. Thom -- Some people hope to achieve immortality through their works or their children. I would prefer to achieve it by not dying. -- Woody Allen ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://www.pzt.de -------------------------------------------------------------------

1 0