November 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] name resolution by ipchains
by Erwin Zierler - Stubainet 18 Nov '00

18 Nov '00

Hi Philipp... At 19:00 18.11.00 +0100, you wrote: >Hi all > >is it possible to have ipchains resolving internet names? >If yes, how? ipchains is - simply spoken - for filtering your traffic. If you want to know how to let DNS traffic pass through your firewall then you should check what ports and protocols DNS traffic uses. Look up this inforamtionin /etc/services and /etc/protocols: domain 53/tcp # Domain Name Server domain 53/udp # Domain Name Server tcp 6 TCP # transmission control protocol udp 17 UDP # user datagram protocol The above are only examples, please verify them and never use filter rules without knowing what you are doing. HTH, Erwin >Thank you > >Philipp > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

Addendum -- Security updates have made me too secure?
by Chris Clarke 18 Nov '00

18 Nov '00

I just received my security update message, and the logs on the gateway state: "sshd[xxxx]: Faking authloop for illegal user root" Chris. --- Chris Clarke <stcanard(a)yahoo.com> wrote: > Help! > > I have a x86 SUSE 6.1 system running as a gateway/firewall/DNS. > There > is no keyboard or monitor physically attached to the system, and > logons > are disabled on the machine. I access it remotely via openSSH, using > a > root login. This has worked fine for several months now. > > Today I installed the following security updates: > shlibs-2000.9.5-0.i386.rpm > libc-2000.9.5-0.i386.rpm > libd-2000.9.5-0.i386.rpm > nkitb-2000.7.11-0.i386.rpm > > The system is as stock a SuSE as you can get. The only things > installed on it are official SuSE RPMs, and SuSEConfig is configured > to > run. > > I just tried to log into it using openssh (1.2.3-12, yes I know there > are problems in that version), and when I typed in the root password > got told "Permission denied, please try again"! > > As there is no keyboard / monitor on the machine I don't know if this > is an ssh problem, or a more general problem. Does anyone know what > might have happened to this system, and is there any way I can get > back > into it? > > Some things I can note: 1) Most things appear to be running fine, as > my > other computers have no problems with routing or DNS resolution > through > the gateway, and 2) OpenSSH is definitely starting, because I get > asked > for a password. > > Thanks, > Chris. > > __________________________________________________ > Do You Yahoo!? > Yahoo! Calendar - Get organized for the holidays! > http://calendar.yahoo.com/ > ===== Chris Clarke stcanard(a)yahoo.com "Whenever two or three are gathered together, then they shall perform the parrot sketch" -- The Comic Messiah __________________________________________________ Do You Yahoo!? Yahoo! Calendar - Get organized for the holidays! http://calendar.yahoo.com/

4 3

SuSE Security Announcement: tcpdump (SuSE-SA:2000:46)
by Roman Drahtmueller 18 Nov '00

18 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: tcpdump Announcement-ID: SuSE-SA:2000:46 Date: Friday, November 17th, 2000 16:00 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: remote denial of service Severity (1-10): 6 SuSE default package: yes Other affected systems: systems using the same versions of tcpdump and the necessary libraries Content of this advisory: 1) security vulnerability resolved: tcpdump problem description, discussion, solution and upgrade information 2) clarification, pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information tcpdump is a widespread network/packet analysis tool, also known as a packet sniffer, used in unix/unix-like environment. Several overflowable buffers have been found in SuSE's version of tcpdump that could allow a remote attacker to crash the local tcpdump process. Since tcpdump may be used in combination with intrusion detection systems, a crashed tcpdump process may disable the network monitoring system as a whole. The FreeBSD team who found these vulnerabilities also reported that tcpdump's portion of code that can decode AFS ACL (AFS=Andrew File System, a network filesystem, ACL=Access Control List) packets is vulnerable to a (remotely exploitable) buffer overrun attack that could allow a remote attacker to execute arbitrary commands as root since the tcpdump program usually requires root privileges to gain access to the raw network socket. The versions of tcpdump as shipped with SuSE distributions do not contain the AFS packet decoding capability and are therefore not vulnerable to this second form of attack. A temporary workaround for the tcpdump problems other than not using tcpdump in the first place does not exist. However, we provide update packages for the affected SuSE distributions. We recommend an upgrade using the packages that can be found using the URLs below. Note: Please note that there is only one source rpm package but two binary rpm packages. tcpdump*.rpm is the rpm for the tcpdump program, and libpcapn*.rpm is the packet capture library that is required by tcpdump at compile time. In order to remove the security vulnerability in tcpdump, it is necessary to update the tcpdump rpm package only. The libpcapn package with the static library is provided for consistency and compatibility because it will be generated if the binary packages are rebuilt from the source rpm. To check if your system has the vulnerable package installed, use the command `rpm -q <package name>´. If applicable, please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/d1/libpcapn-0.4a6-279.i386.rpm f4e4a9231b695e1cf5eef0ad09871c34 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/tcpdump-3.4a6-280.i386.rpm ba711cf2fab14218752603fa5a941721 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/tcpdump-3.4a6-280.src.rpm d4c5902c50d6a321e2c4ed665fcd1962 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/d1/libpcapn-0.4a6-279.i386.rpm a1030d64ca4ca86a08b6bee5dc9cff78 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/tcpdump-3.4a6-280.i386.rpm 12335bf0055c6a9b915044a95a544aaa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/tcpdump-3.4a6-280.src.rpm dca26c3e5ef81f449cd43ab4d1f91b63 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/d1/libpcapn-0.4a6-279.i386.rpm 13c90044ed57792090163a33ffb69ecf ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/tcpdump-3.4a6-280.i386.rpm 646de6c14a2d4988d0c684a42b4eef58 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/tcpdump-3.4a6-280.src.rpm 46980acd95607d4a9c61ca0f75c33fc2 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/d1/libpcapn-0.4a6-279.i386.rpm d058e563ad10daf078f5909a6b8ff288 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/tcpdump-3.4a6-280.i386.rpm f5209f1f1433b0a55676f29451a2ef1b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/tcpdump-3.4a6-280.src.rpm cd34cd3feedbe0568d76dd9a406cec79 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/d1/libpcapn-0.4a6-279.i386.rpm ef454e2d23e410be82aa9f0634bcc9dc ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/tcpdump-3.4a6-280.i386.rpm 9f6ebff316039421ee00121a0e8720fa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/tcpdump-3.4a6-280.src.rpm d1148813da9610f940ecdbd462ab2541 SuSE-6.0 Please use the package for the SuSE-6.1 distribution. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/d1/libpcapn-0.4a6-279.sparc.rpm 412a7db34985555705d8d43f2853ae4e ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/tcpdump-3.4a6-280.sparc.rpm a177326150a65d78212cebba90b88201 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/tcpdump-3.4a6-280.src.rpm 49f1f0420dd84070dcd9a67452770e75 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/d1/libpcapn-0.4a6-279.alpha.rpm 096522f46ab70d92dda17b4ca33b4181 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/tcpdump-3.4a6-280.alpha.rpm 84ca9a93a2201f7046446ed07107cbbc source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/tcpdump-3.4a6-280.src.rpm 07ed654ad1693dca5fd433572b3689c9 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/d1/libpcapn-0.4a6-280.alpha.rpm 747c22bb722da5df7fe3cfc252bdc545 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/tcpdump-3.4a6-281.alpha.rpm dbe10ebc95a2371d01df729af265bdf6 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/tcpdump-3.4a6-281.src.rpm 8f6e48e693fc465c1f60b6cee944c27c PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/d1/libpcapn-0.4a6-279.ppc.rpm 140b95ffb3be2c2915327d4798b16dd0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/tcpdump-3.4a6-280.ppc.rpm 7f71b4ac17e3ad2c071e712c137a7c28 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/tcpdump-3.4a6-280.src.rpm d9db0e99e91d8981efebafd6a539566f SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/d1/libpcapn-0.4a6-279.ppc.rpm ed8697842867cbb5457c03015c117131 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/tcpdump-3.4a6-280.ppc.rpm 782dc3faba33cf1b2d9e6ef95caf4107 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/tcpdump-3.4a6-280.src.rpm 318bf758753d9728f101de2101ad3227 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Clarification: In my message (Subject: "SuSE: miscellaneous"), dated Wed, 15 Nov 2000, concerning the paragraph about runtime linking problems in gs (GhostScript) , I have stated that the problem will be fixed in future versions of the SuSE distribution. This does not touch the fact that we will of course provide fixes for the older distributions. - pine We're still working on the packages for the version 4.30 (stability problems). - ppp The ppp "deny_incoming" problem as announced by FreeBSD Security Advisory FreeBSD-SA-00:70.ppp-nat is FreeBSD specific and does not affect the SuSE distribution. - vixie cron Michal Zalewski <lcamtuf(a)TPI.PL> reported security problems in Paul Vixie's cron implementation that is commonly used in Linux distributions. Due to correct permissions on the directory /var/spool/cron, the SuSE cron package is not affected by the problem. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOhVREney5gA9JdPZAQHBPAf/fgUBBQa9WMGBv+IBYcbUjBAVC2Qa/kKI ZOFVgQPUtLrAk9052YBNbmsDaaUnvgVn09YllVig4fBRfTRm/tdfdq+3rYSGUgn2 NqCc/Om79SDM3TH5wF4VnrTT8bBznCr9u7sWEGFGAa83uuw5eMALXtHcwWqoM5E3 llIKx4mikIHKHPJGZY4+va5Bmn4Zjq1eLInVlkOa9LqsI1+YcLa/9GSsyYgZP3Px 4YnG8XdUwgd6/Nlp1cg6Do/icdH/XfPx/RfVRda8S/sI232ClFt9+PtZbJEDqA2p SGj5sm4f4h4e3Sn+tnRwKEexgV/84odnnFPeUzwFHXP8LKinZVakDA== =IV5+ -----END PGP SIGNATURE-----

4 4

Closing Identd service with Ipchains
by RoMaN SoFt / LLFB!! 17 Nov '00

17 Nov '00

Hi. I want my (firewalled)-gw responds to an ident (113 port) request with a RST packet, thus simulating the service is closed. I'm using Ipchains with kernel 2.2.17. Is there any way of doing that? Notes: - DENY simply blocks ident service. Nmap will detect the port as "blocked" (after timeout), since no packet is returned in response to SYN attempt. - REJECT works similarly to Deny, except that it will send an ICMP error message. But no tcp packet is sent in response to SYN query. The port will be detected as "blocked". The behaviour I want is NOT one of the above. What I want is a RST to be sent, so services using ident (like ftp or sendmail) doesn't have to wait for tcp request timeout. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 6

NET
by Dustin Huptas 17 Nov '00

17 Nov '00

Good day! My proxy wrote about 200 of the below messages into /var/log/messages during the last days: Nov 15 09:34:08 proxy kernel: NET: 166 messages suppressed. Nov 15 09:34:08 proxy kernel: neighbour table overflow The number of suppressed messages is changing with every line. I am completely stuck with this. Does this mean, someone is trying to do a buffer overflow? P.S.: I am using SuSE 6.3 on this machine. Thank you very much in advance for your help! Rgds Dustin

3 3

Firewall logs strange attempts....
by Charles Price 17 Nov '00

17 Nov '00

Hi All, Recently, my ipchains script running on SuSE 7.0 has been denying attempts at TCP access to ports: 12345 1243 1099 1099 I checked in /etc/services and found that 1099 is the standard port for RMI Registry. Connections to the above ports were made in rapid succession. Can anyone tell me what port 1099 and the two other unpriveliged ports could mean together? Thanks, Charlie

3 3

Qpopper versions..
by RoMaN SoFt / LLFB!! 17 Nov '00

17 Nov '00

Hi @ll: I'm going to run a POP server in a SuSE 6.4 box. The 2.53 version which ships with original 6.4 is buggy (remote root possible) so I downloaded the SuSE updated packages at */updates/6.4: pop: A few POP Servers ---------------------------------------------------------------------- File: pop-2000.6.7-0.i386.rpm Version: 2000.6.7 Size: 1252 kB Date: Thu 08 Jun 2000 Source: pop-2000.6.7-0.src.rpm Security: Yes ---------------------------------------------------------------------- Description: Security update for qpopper in pop_msg(), also APOP support enabled, POP_TIMEOUT = 600 and NO UPDATE ON ABORT Upon installing, the banner says it's also 2.53 (version). I supposed it will be a *patched* version. There have been various pop3 related bugs, so I'm wondering if this rpm is really secure. I've also downloaded the */updates/7.0 rpm. It says: pop: A few POP Servers ---------------------------------------------------------------------- File: pop-2000.9.29-0.i386.rpm Version: 2000.9.29 Size: 1252 kB Date: Fri 29 Sep 2000 02:33:37 PM CEST Source: pop-2000.9.29-0.src.rpm Security: No ---------------------------------------------------------------------- Description: Fixed program popauth. Only necessary for qpopper with apop authorization. My Q is: Why isn't there a similar patch for 6.4 distro? Finally, what I've done is going to Qualcom web and get 3.1.2 (latest) popper. I think this option is the most secure, isn't it? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

SuSE: miscellaneous
by Roman Drahtmueller 17 Nov '00

17 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- SuSE: miscellaneous 15:30 MET, Wednesday, November 15 2000 This notice addresses the latest security advisories from various Linux vendors as well as private contributors on public security forums. The issues have been collected to keep the noise on the public security forums at a reduced level. The information herein should be considered both background as well as upgrade information (please read carefully). == Topics: 1) SuSE security staff 2) packages: gpg (update information) bind8 (status: update avail, announcement pending) pine (status: testing new version 4.30) dump (status: not vulnerable) phf (status: not vulnerable) gs (status: pending) global (status: building) crontab (status: not vulnerable) vlock (status: not vulnerable) tcpdump (status: update avail, testing) tcsh (status: update+announcement pending) modules (status: more updates for older distributions) == 1) SuSE security staff SuSE welcomes security professional Sebastian Krahmer <krahmer(a)suse.de> aboard the SuSE security team. His name has already been on top of the last SuSE security announcement about the security problems in the modules package. Enlarging the capacity of the security team, Sebastian will be busy fixing security problems, auditing code and maintaining security- related software. More security announcements from him will be seen in the future. 2) packages _________________________________________________________________________ * gpg GnuPG may erroneously recognize a file/mail to be correctly signed, if there are multiple signatures and the file/mail has been modified. This bug affects all GnuPG versions prior to and including 1.0.3. It has been fixed in version 1.0.4. Updated packages are available on our German ftp server (as well as its mirrors) for the SuSE distributions 6.3, 6.4 and 7.0. Please note that the gpg packages for the SuSE-7.0 distribution have an addon, called gpgaddon. It contains implementations of cipher algorythms that require licenses in many countries due to software patents. Those gpgaddon packages are not listed below. There will not be a security announcement for this package - the privacy risk for users of the old package is considerably small. You can update your installed packages using the command rpm -Uhv <URL-to-file> where <URL-to-file> is one of the following FTP URLs to chose from. Please use the SuSE Linux mirrors as listed at http://www.suse.de/de/support/download/ftp/inland.html . The md5sums for the files on the ftp server are: i386 Intel Platform SuSE-7.0 ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/gpg-1.0.4-7.i386.rpm d0b78231c127a6423c7ca46ec9618c00 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/gpg-1.0.4-7.src.rpm a613abc7691b49e0c67e8c7dc924e3b0 SuSE-6.4 ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/gpg-1.0.4-7.i386.rpm c5b9fbe25d8cb5db4f52638c0959294d source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/gpg-1.0.4-7.src.rpm f9d351e1b86fbcfbcf0d23fae5739b20 SuSE-6.3 ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/gpg-1.0.4-7.i386.rpm c5b9fbe25d8cb5db4f52638c0959294d source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/gpg-1.0.4-7.src.rpm f9d351e1b86fbcfbcf0d23fae5739b20 Sparc Platform SuSE-7.0 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/gpg-1.0.4-5.sparc.rpm 335aa6315468d4dae5753a6d14809bdd source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/gpg-1.0.4-5.src.rpm 796b6f901aee33aad5fd01dc874abe3c PPC Power PC platform SuSE-7.0 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/gpg-1.0.4-7.ppc.rpm 302a7899783c9604a4ce962fcc627675 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/gpg-1.0.4-7.src.rpm 415be9ff92bcfd4a8f764207d412906d SuSE-6.4 ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/gpg-1.0.4-5.ppc.rpm 3566276b56ce13d6b977af91b5797ffc source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/gpg-1.0.4-5.src.rpm 49b75a880656a11e99fcbad16673247e AXP Alpha Platform SuSE-7.0 ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/gpg-1.0.4-12.alpha.rpm 8a504ad8957d455ead3ff22d6ba31626 source rpm: ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/gpg-1.0.4-12.src.rpm 986675ccf38f88770c079281a4175618 SuSE-6.4 ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/gpg-1.0.4-5.alpha.rpm 65f6662aea3ff8832ac932ca0a57c10b source rpm: ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/gpg-1.0.4-5.src.rpm 1d3ff30fac336c8e314da9903d1ee1b9 _________________________________________________________________________ * bind8 BIND, the Berkeley Internet Name Daemon, versions before 8.2.2p7, has been found vulnerable to two denial of service attacks: named may crash after a compressed zone transfer request and if an SRV record (defined in RFC2782) is sent to the server. SuSE versions 6.0 through 6.4 are affected by this problem. The bind8 package in SuSE-7.0 is not susceptible to the problems because a different version of bind8 has been used in this distribution. A temporary workaround against the first error is to disable zone transfers if those are not needed (it is recommended for security reasons, and the default configuration in our package has zone transfers disabled.). Since the second bug can't be circumvented so easily, it is recommended to upgrade the bind8 package as soon as possible. Recognizing the urgency of this issue, the updated packages are on their way to the ftp server right now. An announcement covering the issue will follow this notice. _________________________________________________________________________ * pine The popular text-based mail user agent is vulnerable to a buffer overflow in the portion of code that periodically checks for the arrival of new mail. In addition, there is an error in the header parsing code which could lead to a crash of the mail program. The authors of pine (University of Washington, Seattle, see http://www.washington.edu/pine/credits.html) have published a new version of the pine package that should fix the known problems. During testing, several instabilities of the program have been observed so that we have delayed the release of the updated version. Additional patches are being tested right now so that the release of the new version 4.30 can be expected within days. _________________________________________________________________________ * dump The Linux implementation of the ext2fs backup utility "dump" can be tricked into running arbitrary commands as root in case it is installed setuid root. dump is not installed suid root in SuSE Linux releases 6.0 through (the most recent) 7.0 because there is no convincing reason to do so. Therefore, SuSE Linux is not vulnerable to this problem with the dump program. _________________________________________________________________________ * phf cgi program proton <proton(a)ENERGYMECH.NET> has discovered a buffer overflow that can lead the phf cgi program to execute arbitrary code with the privileges of the user that the webserver is running under. SuSE distributions contain a cgi program that is called phf, it is included in the thttpd package. Installed under /usr/local/httpd/htdocs/cgi-bin/phf, this program is a booby trap that logs attackers intending to exploit formerly known bugs of the phf program. By consequence, SuSE distributions are not vulnerable to the buffer overflow in the phf program. _________________________________________________________________________ * gs The Ghostscript program in SuSE distributions runtime-links against shared libraries in the current working directory if a shared library with the adequate name is present. The problem is created by exporting the environment variable LD_RUN_PATH at linking time during the package compile process. Later, at runtime linking, the runtime linker ld-linux.so.2 will try to open ./libc.so.6. If this fails, the linker will continue searching the usual paths to find the library. Basically, this means that users should call gs as well as all programs using gs (such as gv or ghostview) in a directory that is only writeable by the user calling gs. It is expected that more Linux distributions (other than SuSE Linux) and possibly commercial unix vendors as well are affected by this problem. In future versions of the SuSE Linux distribution, this problem will be fixed. _________________________________________________________________________ * global htags, one program within the global package, is a hypertext generator from C, Yacc and Java source code. The "-f" option generates a cgi script as an input form backend that is vulnerable to a simple remote attack if the script is executable by a webserver. Remote attackers can run arbitrary commands under the user privileges of the webserver. The global package is not installed per default, nor is the bug present in the "installed-only" state of the package. However, if you use the program and the "-f" option of htags, it is recommended to upgrade the package as soon as possible. We are working on the update packages. _________________________________________________________________________ * crontab A tmp file vulnerability has been found in various implementations of the crontab(1) command. SuSE Linux is not affected by this problem. _________________________________________________________________________ * vlock vlock is a terminal locking program for the Linux virtual system console. It has been reported by Bartlomiej Grzybicki <bgrzybicki(a)morliny.pl> that it is possible to crash a running vlock and thus giving access to a console without a password. However, the conditions under which the failure happens are not clear. SuSE distributions are not concerned because the vlock program is not included in the distribution. _________________________________________________________________________ * tcpdump Several buffer overflows have been found in the tcpdump program, a network analysis program, according to FreeBSD Security Advisory FreeBSD-SA-00:61.tcpdump. The vulnerability can be used to remotely crash a running tcpdump program. Since the version of tcpdump included in SuSE distributions is not capable of decoding AFS ACL packets, this particular part of the bugs does not concern SuSE Linux. Though, some intrusion detection systems rely on tcpdump's output so that a proper operation of the tcpdump program is crutial. There are updates packages available for download on our ftp server which fix the vulnerability. The security announcement is pending while we're still testing the packages. _________________________________________________________________________ * tcsh proton <proton(a)ENERGYMECH.NET> has found a temporary file vulnerability in the portion of code in the tcsh that handles redirects of the form cat << END_OF_TEXT foo bar END_OF_TEXT With this vulnerability in place, it is possible for an attacker to overwrite arbitrary files with the privileges of the user of tcsh. There is no fix for this problem other than an upgrade to a fixed version which will be available on our ftp server shortly. An advisory covering this matter will follow. _________________________________________________________________________ * modules/modutils Sebastian Krahmer <krahmer(a)suse.de> has issued a SuSE security announcement about the shell meta character expansion vulnerability in the modprobe program that is responsible for the automatic loading of kernel modules upon request. In addition to the update packages for the vulnerable versions of the SuSE distribution, we will provide updates for the older distributions (6.0-6.3) shortly, even though these distributions have not been found vulnerable to the modprobe problem. The rpm packages can be found at the usual location shortly. Regards, Roman Drahtmüller, SuSE Security. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOhKcN3ey5gA9JdPZAQGW4QgAn6EDIQOe94u4xMc6u8z8yKv4eGaCQBk8 kCZ4l5kRizSO4z5NCc/oCChoi5ANuIIqRLG91cKixG0+4E69vgm140sSRicpfUtn oqP2ExAXLf13vgA+XmFCTnFcTG3TY7+XCiwvpdM2aU95iuPcM0TSuVTeLlkFJW6S Xkmt+58/111xFKrQ32UCOqgxsDIOV4b/Y5m+xi3XrubxdkW/eHjopZkutwXnFGVz 3rn1TEDOSRw6D41OdvWLRBQc6YdTYGdsUC4S5kMv3/Ti6/GQbjenxc3FKxWVPQaj nvGMCobk5pbi/AuarEupXsgybDZbMmA6wlr8ppUsrV80uIqLH+zmZg== =BjBa -----END PGP SIGNATURE-----

2 2

[suse-security] SORRY!!! (was: SuSE Security warnings /announcements)
by r.maurizzi＠gvs.it 17 Nov '00

17 Nov '00

> 8 years in the business must have taught you to not make any claims about > things that you don't know very much about, at least not in the public. I > consider your words rude and inadequate. More below. I'm very sorry. I didn't mean to say you don't work well, as I think exactly the contrary is true (I consider SuSE the best distribution security wise). My request was about what we could do to help you out in any manner. And to avoid other misunderstanding, yes, I know there's little we can do to help you directly: I'm firmly convinced that you/your team must continue to work as a whole to be able to work with the quality you showed thus far, that is by any means very high. >> The problem is, these kind of things usually don't get done because >> "there's no time" ;-) > Who are you talking about? Nobody in particular. I was referring to the general situation you can find in a lot of workplaces, and in which I found myself involved many times. Again, I wasn't referring to your situation since as you rightfully state I do not know it for the least. The thing I want to stress here is that the "no time for improvement" problem is a problem I have found many times, and I might add that it's never a fault of the people that works in an organization. It's sometime caused by external factors (I'd say linux popularity in your case) and sometime by problems somewhere in a organization (problems that I *try* to solve with my work). >> If it's a safe and clear thing to reveal, could you (== SuSE) tell us >> how you do your tracking work now? Maybe someone could suggest (or >> write) something useful. > I'm not sure if I get your point here. Just to make sure that there is no > misunderstanding wrt your question: Our work tracking/time management is > not for disposition here. My idea was that if you are using some popular open source packages, then maybe someone here could be able to add features or contribute resources that could help your work. You did similar things for us many times, posting examples or scripts that for you are trivial while for many of us were beyond reach. Maybe someone could have some code half-ready to help you with your work. Maybe not likely, but possibile. Sadly for me for this kind of things I use Lotus Notes, but I'd be really glad to be able to help you in any way, since you and SuSE did help me a lot. > The fact that it does take time does need as much justification as the > fact that we try our best to not publish any information unless we're > absolutely sure that we know what we're talking about: none. And that's exactly what I want you to continue to do. I *really* appreciate when you post a report saying "this problem does not affect SuSE because it uses a more tested/less feature-bloated/more old-and-secure package". I'm of the opinion that if I want to experiment with new and flashy things I must use a test environment, not my users. On production boxes I follow your approach completely: better with an older package with acceptable flaws than with a newer one with unknown problems. >> Avoid working on weekends: the quality of what you "produce" tends to drop >> sharply... :-) > If my ego wasn't so big, I would not have had to answer this mail and > wasted the time that could have been used otherwise. Anyway, I hope that > your last sentence was at least as friendly as your smiley at the end. Sigh! I should have read my message more carefully, re-reading it I must say it's really easy to take it as insults... :-( I wanted to express, with regard to the "please understand this. Its weekend. We do our best." of Sebastian, that I completely second his point: working overtime and on weekend can do bad things for *everyone*. Speaking of which I'd better go home since it's really late, so maybe tomorrow I won't write other stupid messages on this list... ;-) Ciao, Roberto.

3 2

SuSE Security Announcement: bind8 (SuSE-SA:2000:45)
by Roman Drahtmueller 17 Nov '00

17 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind8 Announcement-ID: SuSE-SA:2000:45 Date: Thursday, November 16th, 2000 16:00 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4 Vulnerability Type: remote denial of service Severity (1-10): 7 SuSE default package: no Other affected systems: all systems using bind, version 8.2.2 before patchlevel 7 Content of this advisory: 1) security vulnerability resolved: bind8 problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information BIND, the Berkeley Internet Name Daemon, versions before 8.2.2p7, has been found vulnerable to two denial of service attacks: named may crash after a compressed zone transfer request (ZXFR) and if an SRV record (defined in RFC2782) is sent to the server. Administrators testing the ZXFR bug should be aware that it can take several seconds after the triggering the bug until the nameserver daemon crashes. SuSE versions 6.0 through 6.4 are affected by these two problems. The bind8 package in SuSE-7.0 is not affected because a different version of bind8 (8.2.3) was used in this distribution. By the release time of the SuSE-7.0 distribution our engineers have determined that the problems we had with stalling zone transfers under some obscure conditions were not present with the 8.2.3 release of the package. Administrators are strongly recommended to upgrade their bind8 package using the provided packages from the sources below. There is a temporary fix for the ZXFR problem (disable zone transfers) but none for the SRV record problem. For the latest information about security vulnerabilities in the bind name server consider the Internet Software Consortium bind security webpage at http://www.isc.org/products/BIND/bind-security.html . To check if your system has the vulnerable package installed, use the command `rpm -q <package name>´. If applicable, please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. i386 Intel Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.2-139.i386.rpm c6f2242efe722aaa4320010e00ddc080 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.2-139.src.rpm ecd26bdf60d7950585649bc638a1d812 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.2-139.i386.rpm d3f51528ad2120cd3dc6517c2bc26c0a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.2-139.src.rpm 6f1b8c1227d4876389a28d416a952713 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.2-139.i386.rpm 4d8a9f4c6e041326929bbdae97c10105 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.2-139.src.rpm 83807820676d98687797ffff6f5b425c SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.2-139.i386.rpm 1694cf40b5fa41361749297c9cddbca4 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.2-139.src.rpm 8c5f727554e12a5aedb96de3db663518 SuSE-6.0 Please use the package from the 6.1 distribution. AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.2-139.alpha.rpm 51f61faaad78160fb3dcc68a8588c209 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.2-139.src.rpm f42c51962852f8ff14e2d6423de62aec SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.2-139.alpha.rpm 4d16cecb0da4f8ed6bff9c92655b9036 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.2-139.src.rpm d8c4d1d9f0a14249151aa9d9e25f1db8 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.2-139.alpha.rpm 6a4f5b18072cca93f9064fdc802e50fb source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.2-139.src.rpm a3eec237cc642739b5b6c6eea6d197c0 PPC Power PC Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.2-139.ppc.rpm 65e82b875e7f8ff7409062d502d56115 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.2-139.src.rpm fd2a6e2a29a80b997758d4245913ff51 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: A new security announcement follows this advisory. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOhP863ey5gA9JdPZAQGVSggAjgh+Kdg2Xc6xLGVRrI4DrNOJLKLf/Hvc /1+WxxMMGW8Pzhk46tk6lXnY8oHwM+/Y5bqrVCRZbO3kcxisfnDf/DoOK6G9aoSH pVazqG5TqGHxbya+rKR72x/u/yTgA3EuGvb3zNL2uudDSRY2lj6h9k0xXP3k+Hv2 hfyKCloWHvrKcJnphTsBu4oShr/j9yT8bAyDrW7MnS7u5th092b/3vXz/KJ6joZy HOsln5N8Ul1lHnFeVk+xhRkQbyV8SUUgXTASxM/iYVx2RnDyA0IXcnc3F+D3lSjD Iy+J6QOWmzhD46kGdov4RCqZihKiQ6LmwcZaaXVk+iMHxXAGtS4DWA== =AAo1 -----END PGP SIGNATURE-----

5 6

Re: [suse-security] FW: FTP and harden_suse
by sandan＠globetrotter.net 17 Nov '00

17 Nov '00

Did you try the "passive" option? From guido(a)r217b.meteo.uni-bonn.de Fri Nov 17 13:59:29 2000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes list-help: <mailto:suse-security-help@lists.suse.com> list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> list-post: <mailto:suse-security@suse.com> X-Mailinglist: suse-security Delivered-To: mailing list suse-security(a)lists.suse.com Resent-From: gtschakert(a)gmx.de X-Mailer: XFMail 1.3 [p0] on Linux X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 Resent-Date: Fri, 17 Nov 2000 14:17:55 +0100 (MET) Resent-To: suse-security(a)suse.com Date: Fri, 17 Nov 2000 14:34:29 +0100 (MET) Sender: guido(a)r217b.meteo.uni-bonn.de From: gtschakert(a)gmx.de To: suse-security(a)suse.com Subject: [suse-security] FW: FTP and harden_suse X-UIDL: 5a6cf3ff5a1a9d9c188caefaf7b254b7 X-Fetchmail-Warning: ; SMTP listener rejected local recipient addresses: sandan Hi @ll, I'm trying to install a new box for FTP. I did the harden_suse-script and installed a ftpd ( I tried wu.ftpd, proftpd and in.ftpd) and have the following problem: I can connect via ftp from antother box and execute commands like pwd,cd... but commands like ls, get, put yields to 500 Illegal PORT command ftp: bind: Address already in use If I connect from the box itself to the box via ftp everything works fine. Does harden_suse change some settings "deeper" in the system to prevent ftp connections. regards Guido --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

FW: FTP and harden_suse
by gtschakert＠gmx.de 17 Nov '00

17 Nov '00

Hi @ll, I'm trying to install a new box for FTP. I did the harden_suse-script and installed a ftpd ( I tried wu.ftpd, proftpd and in.ftpd) and have the following problem: I can connect via ftp from antother box and execute commands like pwd,cd... but commands like ls, get, put yields to 500 Illegal PORT command ftp: bind: Address already in use If I connect from the box itself to the box via ftp everything works fine. Does harden_suse change some settings "deeper" in the system to prevent ftp connections. regards Guido

1 0

RE: [suse-security] Firewall logs strange attempts....
by ralf.vroomen＠itplus.nl 17 Nov '00

17 Nov '00

Sebastian wrote: >> Hi All, >> >> Recently, my ipchains script running on SuSE 7.0 has been denying attempts at TCP access to ports: >> >> 12345 >> 1243 >> 1099 >> 1099 >Probably a backdoor test. Don't have BO ports handy ... > >Sebastian 12345 = NetBus 1099 = rmiregistry -- Regards, Ralf Vroomen Engineer I.T. Plus Holland

1 0

FTP-Server on SuSe firewals: passive FTP
by J. Weinberg 16 Nov '00

16 Nov '00

Hi, I have the following issue: We are running an FTP-Server (ProFTPd) on a Suse 6.3 Linux-Server which serves also as a firewall (incl. NAT/maquerade). (I know that's not the best idea, but it is not misson critical) The firewall is configuered with SuSe firewals 2.1. Everything works fine exept passive FTP. From the internal Network no problem, but from the external side the firewall blocks the data-connection from the client. Does somebody has an idea how to set up firewall.conf without opening all high ports? Rgds Jakob ---------------------------------------------------------- Prof. Dr. Jakob Weinberg eBusiness FH Wiesbaden University of Applied Sciences Phone: +49 (0)611 9002-122 (office) Phone: +49 (0)6257 69436 (home) mailto:j.weinberg@bwl.fh-wiesbaden.de

2 1

yppasswd, secure passwords and OSF1/Alphas
by Tobias Burnus 16 Nov '00

16 Nov '00

Hi, this regards a local network with OSF1/Alpha (soon Tru64unix) and Linux. We presently use basically an old patched/rewritten yppasswd on Alpha which ensures that the passwords are of high security. But this home-made old yppasswd don't run under Linux. Therefore we look for a better solution to have a unified yppasswd on both systems. Using PAM under OSF1 is -- as far as I know -- not possible. And a skript on Alpha pointing to Linux (PAM) is not the solution I hope for (we do so presently the otherway round). Tobias

1 0

DMZ setup question..?
by jan.meyer 16 Nov '00

16 Nov '00

Hi list, I'm working on a Bastion Host/DMZ config. I have the following setup: Internet-> Router-> BastionHost-> Switch-> Firewall-> LAN ----------------------------- \DMZ/ (Webserver) In the DMZ are placed some Webservers with public IP's. The Bastion Host machine has two network interfaces, both with public IP's in the same subnet(!?). The first network-interface (eth0) is connected to the router, the second one (eth1) connected to the switch as the default gateway for the webservers (and Proxy for the LAN). # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 131.131.111.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 131.131.111.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 0.0.0.0 131.131.111.1 0.0.0.0 UG 0 0 0 eth0 The problem for me is, to access both network devices seperately. (Only eth0 is working because of the default route) I guess this is a error in reasoning. Can somebody give me a hint on how to solve this problem ? Maybe it's the wrong topology ? Thanks ;) jan.

2 1

Security updates have made me too secure?
by Chris Clarke 16 Nov '00

16 Nov '00

Help! I have a x86 SUSE 6.1 system running as a gateway/firewall/DNS. There is no keyboard or monitor physically attached to the system, and logons are disabled on the machine. I access it remotely via openSSH, using a root login. This has worked fine for several months now. Today I installed the following security updates: shlibs-2000.9.5-0.i386.rpm libc-2000.9.5-0.i386.rpm libd-2000.9.5-0.i386.rpm nkitb-2000.7.11-0.i386.rpm The system is as stock a SuSE as you can get. The only things installed on it are official SuSE RPMs, and SuSEConfig is configured to run. I just tried to log into it using openssh (1.2.3-12, yes I know there are problems in that version), and when I typed in the root password got told "Permission denied, please try again"! As there is no keyboard / monitor on the machine I don't know if this is an ssh problem, or a more general problem. Does anyone know what might have happened to this system, and is there any way I can get back into it? Some things I can note: 1) Most things appear to be running fine, as my other computers have no problems with routing or DNS resolution through the gateway, and 2) OpenSSH is definitely starting, because I get asked for a password. Thanks, Chris. __________________________________________________ Do You Yahoo!? Yahoo! Calendar - Get organized for the holidays! http://calendar.yahoo.com/

2 1

Re :Security updates ahve made me too secure?
by Chris Clarke 16 Nov '00

16 Nov '00

Thanks everyone for the quick responses. It appears that the problem was poor configuration management on my end. At some time in the past I had updated shlibs to the 6.3 version to install openssh with pam support. When I updated with the 6.1 version, it broke openssh. Thanks again for the help, and sorry for disturbing people about something that turned out to be my fault after all. Cheers, Chris. __________________________________________________ Do You Yahoo!? Yahoo! Calendar - Get organized for the holidays! http://calendar.yahoo.com/

1 0

Port´s for DNS-Server
by hf＠wenglor.de 15 Nov '00

15 Nov '00

Hello, i have a question about DNS-Server connections. We have an prim. DNS-Server behind a Firewall with packetfiltering. In my rules i allow all hosts to connect from an port over 1023 to the DNS-Server port 53, the porblem where i have is than many Hosts (WAN) try to connect our DNS-Server vom port 53 to our port 53. Is it nessesary to open also lower port 53 from the source-adr. to the DNS-Server port 53, or shoud i reject connections where use a port-adr. lower then 1023 as source-port. Thank´s for your help. Harald

3 2

weekend issue
by Sebastian Krahmer 15 Nov '00

15 Nov '00

hi, I think you didn't really want us to start writing advisory on monday. At least not in the modules case. We were aware on some exploits, and it was likely that they would be posted monday. So we cleared thing until monday. This way you got advisory almost at the same time as an exploit was posted, which is probably what you want if an exploit is out. The other 'solution' was to wait until monday and begin to patch things, then there is at least one week where kids have exploit but you no updates. Sebastian

1 0

suse-security=5D_Port=3Fs_for_DNS-Server
by Nix 15 Nov '00

15 Nov '00

It all depends on how big you network is, and what design you have currently. If you are running a bastion host style network, with a firewall running proxies for everything (which is what you have by the sounds of it) You can tell BIND to only attach to one IP address (ie. your internal interface on your firewall) and it will still be able to do lookups externally, jut not answer requests from external clients. (this is what you want) Squid can also be bound only to the internal interface, as can SMTPD (http://www.obtuse.com/smtpd.html) and/or sendmail. Also take a look at xinetd for an interface capable inetd replacement. End result is that you can have a box offering a hell of alot of services internally but having all ports closed on the external interface. This negates the need to have ipchains rules etc.. (You should use them anyway, as a 3rd layer of security) (The second layer being tcp wrappers. Even ssh and sendmail are compiled with libwrap support on suse) HTH Nix At 01:22 PM 15/11/2000 +0100, you wrote: >Hi Nix > >Just read your reply to the DNS matter. >I've got this problem: >Some services (pop smtp in my case) go through my ipchains filter because I >don't see a way to let them go over a proxy. All these services need dns. Is >there a way to have dns run over a proxy while pop, smtp is still going >through a paketfilter? > >And, is there a way to control port 25 and 110 on a ipchains filter? Some >IDS software maybe? > >Thanx >Philipp > > > At 11:47 AM 15/11/2000 +0100, you wrote: > > >Hello, > > > > > >i have a question about DNS-Server connections. > > > > > >We have an prim. DNS-Server behind a Firewall with packetfiltering. > > >In my rules i allow all hosts to connect from an port over > > 1023 to the > > >DNS-Server port 53, > > >the porblem where i have is than many Hosts (WAN) try to connect our > > >DNS-Server > > >vom port 53 > > >to our port 53. > > > > > >Is it nessesary to open also lower port 53 from the > > source-adr. to the > > >DNS-Server port 53, > > >or shoud i reject connections where use a port-adr. lower > > then 1023 as > > >source-port. > > NO NO NO.. Don't ever filter based on source port as that can be set > > arbitrarily!!! > > > > You should run separate dns caches on each segment of your > > network as it is > > only > > server -> client replies that use weird ports. server -> > > server stuff is > > all port 53. > > That means that you can happily filter based on destination > > port on all > > your differerent > > firewalls, and just leave the last jump to your client > > machines "unfirewalled" > > > > Email me back if you want further specifics, as secure > > network design is a > > BIIIG issue. > > > > HTH > > > > Cheers > > > > Nix > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

funny messages and mail-log gets nuked
by dan＠younics 14 Nov '00

14 Nov '00

hi all, see log-excerpt below. what the ..... what is it ? at the same time mail-log got nuked. is this the before 2.2 kernel-bug ? any implication I need to watch ? has somebody got root-access now ? heeelp.. or harmless ? any clues appreciated. greetings dan LOG: Nov 14 06:09:43 subzero kernel: general protection: 5554 Nov 14 06:09:43 subzero kernel: CPU: 0 Nov 14 06:09:43 subzero kernel: EIP: 0010:[ret_from_sys_call+124/144] Nov 14 06:09:43 subzero kernel: EFLAGS: 00010206 Nov 14 06:09:43 subzero kernel: eax: 00000000 ebx: bffff3e4 ecx: 000002f7 edx: 0000000b Nov 14 06:09:43 subzero kernel: esi: 55555555 edi: 43464544 ebp: 41505441 esp: 019edfd8 Nov 14 06:09:43 subzero kernel: ds: 0018 es: 0018 fs: 002b gs: 0018 ss: 0018 Nov 14 06:09:43 subzero kernel: Process makewhatis (pid: 3908, process nr: 40, stackpage=019ed000) Nov 14 06:09:43 subzero kernel: Stack: 55555555 00555555 000002f7 00000010 55555555 080c3a8c 080b3f0c 080abb0c Nov 14 06:09:43 subzero kernel: bffff3c8 55555555 Nov 14 06:09:43 subzero kernel: Call Trace: Nov 14 06:09:43 subzero kernel: Code: 1f 07 0f a1 0f a9 83 c4 04 cf 8d 76 00 8d bc 27 00 00 00 00

3 2

Re: [SLE] LILO PROBLEM
by dan＠younics 14 Nov '00

14 Nov '00

hi, you wrote: >The problem is , when reboot the linux system after install it show LI at the prompt >not LILO. I have to use a boot disk to login . few things to check: 1. disks only boot "linear" . try choice in lilo. 2. old boot record unerased: to solve : - boot from dosfloppy - "fdisk /MBR" - reinstall lilo 3. lilo not installed right, reinstall. maybe that helps dan

1 0

secumod and apache on SuSE 7.0
by Christian Lox 14 Nov '00

14 Nov '00

Hi everyone! I am having problems starting apache on SuSE 7.0 with installed secumod. All it does is a segmentation fault and the message 'syntax error in httpd.conf' Anyone who knows about this problem? TIA, Christian

2 1

Re: Re: [suse-security] SuSE Security warnings/announcements
by r.maurizzi＠gvs.it 14 Nov '00

14 Nov '00

>> In the web page there is also the 'modules' update, as several others since >> the last sec-announce. > please understand this. Its weekend. We do our best. > You will be informed about every security releated change. > Hopefully next week. In my experience (that of a Lotus Domino app. planner/developer with 8 years of work in the field) a "real-time" reporting system works only if the "report" is a side-effect of the usual tools you use in everyday work: if it's not, and you have a lot urgent work, like in SuSE case, then the reporting activity tends to be considered burdensome and gets postponed with regard to the "real" work (producing fixed packages, for the situation at hand). I don't know how the SuSE security team keep tracks of their work (bug database, work planner, priority based scheduler, other/mixed solutions) but it would be nice to have/create some kind of integration system that automatically generates reports on the web (and maybe on the list) when someone uploads a packages on the ftp site, using the fix's description you copy & pasted from bugtraq when you decided you needed a new package to close a security breach. The problem is, these kind of things usually don't get done because "there's no time" ;-) If it's a safe and clear thing to reveal, could you (== SuSE) tell us how you do your tracking work now? Maybe someone could suggest (or write) something useful. Ciao, Roberto. P.S. Avoid working on weekends: the quality of what you "produce" tends to drop sharply... :-)

2 1