November 2000 - openSUSE Security - openSUSE Mailing Lists

Firewall Config Problem in SuSE 7?
by jpriddy 14 Nov '00

14 Nov '00

First off, I am pretty new to linux and unix in general and especially firewalls (alas i have lived most my life as a slave to windows). And this may in fact not be a question for you but for my ISP. Anyway..... I have minimal home network and ever since I was rooted after carelessness, I am pretty paranoid about security and reviewing my logs. Ever since I set up my install to do ip masq/routing I keep on seeing these 2 repeating lines from my isp's machines in /var/log/firewall : Nov 14 01:25:51 beast kernel: Packet log: output DENY eth0 PROTO=1 24.92.74.X:3 24.92.68.22:3 L=156 S=0xC0 I=31139 F=0x0000 T=255 (#3) Nov 13 18:15:16 beast kernel: Packet log: input DENY eth0 PROTO=17 24.92.68.23:67 24.92.74.X:68 L=576 S=0x00 I=8539 F=0x4000 T=248 (#52) My question is not exactly why is my firewall denying these packets, but why is "24.92.68.22 / ns2.midsouth.rr.com" and "24.92.68.23 / pc-join.midsouth.rr.com"? And what the hell is "pc-join?" It really isn't critical (I dont think anyway, since everything seems to work just fine), but this seems odd to me. I just went over /etc/rc.config.d/firewall.rc.config again carefully, but I really dont see anything that would have to do with this. I am somwhat new to this, but why would these machines need to hit me? The isp uses DHCP, but the entries are too often for that. I can send in my rc.config.firewall if needed. Thanks, -John ______ -Idiocy "Never underestimate the power of stupid people in large groups" http://www.despair.com ______

5 6

RE: [suse-security] Where are ssh,sshd packages?
by Philipp Snizek 14 Nov '00

14 Nov '00

Hi Brett go to yast, start installation (3rd point from above) and go to section sec(urity) . There you'll find all ssh stuff. cheers, Philipp > > Can anyone tell me where to find the rpms for sshd, ssh? > > I see reference to ssh on the web site. But I cannot find > sshd and ssh on > my six 7.0 professional CDs anywhere, or on a web site. > > The Mandrake openssh-2.1.1 and ssh-1.2.2.7 sshd do not allow logins. > > Thanks. > Brett > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

4 5

kein Betreff
by d.martini.kliniken-lb＠t-online.de 14 Nov '00

14 Nov '00

unsubscribe

1 0

Fw: re newbie question
by RENE 14 Nov '00

14 Nov '00

hello there, i think the copied line is incomplete it´sn line from ipchains normaly Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=328 S=0x00 I=0 F=0x0000 T=128 (#39) the same a second one but now splitted Packet log: only which process is crying input what chain DENY what is happend eth0 which interface PROTO=17 which protocol (you can read it into /etc/protocols ) 0.0.0.0:68 which source ip : port 255.255.255.255:67 which destination : port L=328 S=0x00 I=0 F=0x0000 T=128 (#39) normaly i think not importand ----- Original Message ----- From: "Philipp Snizek" <mailinglists(a)belfin.ch> To: <suse-security(a)suse.com> Sent: Tuesday, November 14, 2000 9:09 AM Subject: [suse-security] newbie question > Hi all > > Please can somebody tell me what exacly this log entry below means? > > proto1 146.188.12.50:11 212.232.xyz.abc:0 L=56 S=0xC0 I=399 F=0x0000 T=232 > > Why does somebody want to systat me? /etc/services doesn't say anything > about icmp and systat. > Is this something to worry about? I have maybe 20 such entries during the > last 20 Minutes. > > Thank you... > Philipp > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

newbie question
by Philipp Snizek 14 Nov '00

14 Nov '00

Hi all Please can somebody tell me what exacly this log entry below means? proto1 146.188.12.50:11 212.232.xyz.abc:0 L=56 S=0xC0 I=399 F=0x0000 T=232 Why does somebody want to systat me? /etc/services doesn't say anything about icmp and systat. Is this something to worry about? I have maybe 20 such entries during the last 20 Minutes. Thank you... Philipp

2 1

Socks5 slow connect
by Peter ten Have 14 Nov '00

14 Nov '00

Hello, Following Marc's advise not to use IP masq but proxy's I've installed Socks5 for serving mIRC and Napster on the clients. So far so good. After updating 6.3 on the gateway from a SuSE ftp mirror and SuSEfirewall from 2.4 to 3.0 (exactly the same config's), mIRC only connect to the IRC server AFTER sending the first ping. Socks5 reports a connection with the IRC server and traffic is accepted by the firewall. Anyone knows what causes this delay? BTW: Napster connects immediately Thank you, Peter

2 1

FAILLOG for ssh
by Volker Weinberg 13 Nov '00

13 Nov '00

Hi all! Is there a possibility to display failed logins during ssh-Login, like "FAILLOG_ENAB yes" in /etc/login.defs does for rlogin/telnet ?? Regards, Volker Weinberg ---------------------------------------------------------------------------- Volker Weinberg email: volker.weinberg(a)physik.uni-muenchen.de Dept.of Physics phone: Univ. of Munich at home: (089) 14 56 09 (Germany) at CIP: (089) 21 80-24 05 address: Andernacher Str. 17 80993 Muenchen ----------------------------------------------------------------------------

4 4

SSH: Selecting a non-priviliged port for scp
by Klug, Boris 13 Nov '00

13 Nov '00

Hi! we have problems here because our firewall blocks connection from priviliged ports from inside the DMZ to the internet. When using ssh I can give the option "-P" so ssh connects from a non-priviliged port. But this option is missing in scp (-P in scp does something else). Any clue how I can change the behaviour of scp? OK: Yes, I know, this email has an HTML attachment. Because we are forced to use Exchange, I can suppress it. Sorry! -- i.A. Dipl.-Inf. Boris Klug, boris.klug(a)ibs-ag.de, http://www.ibs-ag.de/ IBS AG engineering consulting software, The Quality Company Rathausstraße 56, 56203 Höhr-Grenzhausen, Fon: 02624/9180-125, Fax: -200

3 2

SuSE Security Announcement: modules
by Sebastian Krahmer 13 Nov '00

13 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: modules Announcement-ID: SuSE-SA:2000:44 Date: Monday, November 13th, 2000 10:00 MEST Affected SuSE versions: 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 8 SuSE default package: yes Other affected systems: many newer Linux distributions Content of this advisory: 1) security vulnerability resolved: modprobe shell metacharacter expansion problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The modules package is responsible for on-demand loading of kernel modules/drivers. The /sbin/modprobe command, when executed as a new task by the kernel-internal function request_module(), runs with the priviledges of the init process, usually root. Newer versions of the modprobe program contain a bug which allows local users to gain root priviledges. modprobe expands given arguments via /bin/echo and can easily be tricked into executing commands. In order for this bug to be exploitable, a setuid root program must be installed that can trigger the loading of modules (such as ping6). The fix for this bug consists of a change to modprobe which disables the expansion of arguments to modprobe via /bin/echo. A temporary workaround for this bug is to disable the automatic loading of modules in the running kernel by running the command (as root) /sbin/sysctl -w kernel.modprobe=/ or echo "/" > /proc/sys/kernel/modprobe Please note that this temporary workaround will have to be repeated after the next reboot to become effective again. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/modules-2.3.11-73.i386.rpm 9643216a1e0c147635ef62d894a9d7ad source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/modules.spm Due to a packaging error, the modules package source rpm is not available on our ftp servers yet. It will appear at the location above in very few hours. SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/modules-2.3.9-63.i386.rpm d3a95b93e549aae9a462e84d179efe45 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/modules.spm Due to a packaging error, the modules package source rpm is not available on our ftp servers yet. It will appear at the location above in very few hours. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/modules-2.3.11-73.sparc.rpm c0ab9aab7a61cefdb2cade98c663d4e3 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/modules.spm Due to a packaging error, the modules package source rpm is not available on our ftp servers yet. It will appear at the location above in very few hours. AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/modules-2.3.9-63.alpha.rpm a88b84d7f3d79f2a47ff9e78681a0390 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/modules.spm Due to a packaging error, the modules package source rpm is not available on our ftp servers yet. It will appear at the location above in very few hours. PPC Power PC Platform: SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/modules-2.3.11-73.ppc.rpm ef09b5c6438a0de8e18653e0a60d9c4c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/modules.spm Due to a packaging error, the modules package source rpm is not available on our ftp servers yet. It will appear at the location above in very few hours. SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/modules-2.3.9-63.ppc.rpm 27ba13500292c44969dd865f0c543c19 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/modules.spm Due to a packaging error, the modules package source rpm is not available on our ftp servers yet. It will appear at the location above in very few hours. ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: A seperate message is being prepared to address the currently ongoing security vulnerabilites. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOg+vPXey5gA9JdPZAQFwXQf+LqkRkpXmx6QNnM6aihRsnBpElNC/6Ip5 to1SNRdg2GPKDIznbFLCOOhu0v4siIfpJs0nJEK2CNyZvV3iCL8RZlHasfJTD/6/ GTQtXAaxXHeEISfn/3Ouibf1WIjYDGC7mo444412feabOcZWhzG1p/11G1wgmU3T mWUMDWY5IgL/0Qz00ghC6tXnt3YQQtgw5hFzxfxyJ91zh74WbMcyRvU4hyfiBq3w uhGyU5gjkwWoGugWm3RfEByEtflah1yumfeuV6Fh3UF6dBRo878qM239ugxFQFYj vIT5Qp4lvg48Cn1BpxTNQTA74qOwBVzb4QqlSTGh+kwMNwiIjsRpCA== =/v2t -----END PGP SIGNATURE-----

1 0

apache.rpm with open ssl build problem
by Samartha 13 Nov '00

13 Nov '00

Can somebody tell me how to configure openssl-0.9.6 properly ( install-, include path ) so SuSE's 7.0's apache.rpm's SPEC file is happy? openssl installed itself to: /usr/local/ssl and the apache.spec bails out several times due to wrong path references. I had to manually add the following symbolic links to make it happy: /usr/include/openssl -> /usr/local/ssl/include/openssl /usr/local/lib/libssl.a -> /usr/local/ssl/lib/libssl.a /usr/ssl -> /usr/local/ssl /bin/openssl -> /usr/local/ssl/bin/openssl (maybe there is one extra there). there is no reference in SuSE's support database Thanks, Samartha

1 0

Suse 6.3 + php4
by webmaster 12 Nov '00

12 Nov '00

Hi all, although not an explicit sec issue, but let me ask: Is it possible for a SuSe6.3 linux to have Apache 1.3.9-70 together with php4.0.1pl2-7 ? Thanks Antal

1 0

SuSE Security warnings/announcements
by Tobias Burnus 12 Nov '00

12 Nov '00

Hi, I would like to see more security announcements by SuSE. There is usually sooner or later an update on the FTP server and then a couple of days later there is an announcement. There is for instance this file: --------------------------------------------- ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/modules-2.3.11-73.i386_en.in… Description: Security bug fixed Date: Fri 10 Nov 2000 05:36:25 PM CET --------------------------------------------- What I would like to see is a) A quick announcement if a program shipped with SuSE is vulnerable and how this can be fixed as a workaround: remove suid bit, deinstall program etc. I rare see this happen (execept: "Not vulnerable") b) The fix itself. This usually happens -- sometimes very quick, but sometimes it takes rather long. If I compare it with FreeBSD, SuSE releases only very few announcements; I'd really see more announcements since this would save me the time to read Bugtraq ;-) (FreeBSD had e.g. recently "TOP", first announcement: remove suid bit, second announcement: fix is ready for cooking. Depending on the environment one *can* choose whether waiting for a fix or applying the workaround is the better solution.) By the way, what is with: - Bind - Pine (someone at SuSE is testing this infamous WU program, say Roman) - top ? - getnameinfo denial-of-service ? - dump ? - xfce ? - tcpdump I'm sure that there might be some messages which I overlooked (e.g. SuSE not-vulnerable or not listed above). Tobias PS: Compared with the situation a year ago, security issues are now on a higher agenda of SuSE, but you always want to have a little bit more ;-) -- This above all: To thine own self be true / And it must follow as the night the day / Thou canst not then be false to any man

4 3

ftp question
by Gediminas Grigas 11 Nov '00

11 Nov '00

Hello susers (SuSE users:) ), Our providers network is kind of "hackers heaven" - lots of hacked servers. And we making connections only trough ssh and ftp (doh). Shh is ok. ftp is a problem. We can accept fact that somebody sniffs ftp username/pass , because we closed all services from all other nets than ours, except in.ftpd. We can`t use tcpd or ipchains, there because some users are connecting to server from some dial-ups. The question would be: how to restrict in.ftpd access depending on username/remote_host pairs? example scheme: user1:* #all (we conditionaly dont care about users data, we have backups) user2:some.domain.com #only one IP - rest is denied (we have backups but we would like to make one more small securety step) user3:none #deny all (he does not need ftpaccess at all) ok i can include user3 to ftpusers, but how about user1 and user2? Any ideas? which of ftpd`s has such feature? alternate solution? Thanks! -- Best regards, Gediminas Grigas

3 2

Re: Mr .SlowSocks
by Christopher Mahmood 10 Nov '00

10 Nov '00

I spoke with him--it was an honest mistake because of @home's broken mail setup. Please don't flame him. -- Cheers, Christopher Mahmood --------------------------------------------------------------- SuSE Inc., Tel: +1-510-628-3380, x5024 580 Second St., Suite 210 Fax: +1-510-628-3381 Oakland CA 94607 Email: ckm(a)suse.com USA WWW: http://www.suse.com ---------------------------------------------------------------

1 0

"Socks5 slow connect" poster
by Christopher Mahmood 10 Nov '00

10 Nov '00

Hi All, Mr. SlowSocks is off the list now. This sort of subscriber always puts me in BOFH-mode so I'm going to email him and, depending on how reasonable his excuse is, his ISP. Sorry for the inconvienience. As for someone to contact when problems like this arise, all SuSE lists that end in '.com' are my responsibility and you can always reach me at this address, ml-admin(a)suse.com, root(a)suse.com, postmaster(a)suse.com, etc. Of course, I do try to live on PST so I also have a shadow in Germany named Michael Radziej (mir(a)suse.de) who can handle problems as well. -- Cheers, Christopher Mahmood --------------------------------------------------------------- SuSE Inc., Tel: +1-510-628-3380, x5024 580 Second St., Suite 210 Fax: +1-510-628-3381 Oakland CA 94607 Email: ckm(a)suse.com USA WWW: http://www.suse.com ---------------------------------------------------------------

1 0

somebody post a procmail rule
by alex medvedev 09 Nov '00

09 Nov '00

hallo procmail experts!!! can somebody post a procmail rule to filter that socks5 message out? thanks, -alexm

3 3

Socks5 slow connect
by Peter ten Have 09 Nov '00

09 Nov '00

Hello, Following Marc's advise not to use IP masq but proxy's I've installed Socks5 for serving mIRC and Napster on the clients. So far so good. After updating 6.3 on the gateway from a SuSE ftp mirror and SuSEfirewall from 2.4 to 3.0 (exactly the same config's), mIRC only connect to the IRC server AFTER sending the first ping. Socks5 reports a connection with the IRC server and traffic is accepted by the firewall. Anyone knows what causes this delay? BTW: Napster connects immediately Thank you, Peter

4 3

Socks5 slow connect
by Peter ten Have 09 Nov '00

09 Nov '00

Hello, Following Marc's advise not to use IP masq but proxy's I've installed Socks5 for serving mIRC and Napster on the clients. So far so good. After updating 6.3 on the gateway from a SuSE ftp mirror and SuSEfirewall from 2.4 to 3.0 (exactly the same config's), mIRC only connect to the IRC server AFTER sending the first ping. Socks5 reports a connection with the IRC server and traffic is accepted by the firewall. Anyone knows what causes this delay? BTW: Napster connects immediately Thank you, Peter

1 0

New Member
by Tim Blechmann 09 Nov '00

09 Nov '00

I'm new on this list and first want to ask whether I'm right here or not. I'm a Linux user and might have some questions about firewalling, masquerading or security. But I don't want to annoy you with questions that would just waste your time. PEACE Tim mailto:TimBlechmann@gmx.de

2 1

gs read shared libraries from working directory ??
by Nicolae Mihalache 09 Nov '00

09 Nov '00

Hello! Just tried this on a SuSE 6.4 system: mache@ci:~ > ldd /usr/bin/gs libz.so.1 => /usr/lib/libz.so.1 (0x4001d000) libXt.so.6 => /usr/X11R6/lib/libXt.so.6 (0x4002c000) libSM.so.6 => /usr/X11R6/lib/libSM.so.6 (0x40078000) libICE.so.6 => /usr/X11R6/lib/libICE.so.6 (0x40082000) libXext.so.6 => /usr/X11R6/lib/libXext.so.6 (0x4009a000) libX11.so.6 => /usr/X11R6/lib/libX11.so.6 (0x400a6000) libpthread.so.0 => /lib/libpthread.so.0 (0x40151000) libpng.so.2 => /usr/lib/libpng.so.2 (0x40164000) libm.so.6 => /lib/libm.so.6 (0x40181000) libc.so.6 => /lib/libc.so.6 (0x4019e000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) mache@ci:~ > cp /lib/libc.so.6 . mache@ci:~ > ldd /usr/bin/gs libz.so.1 => /usr/lib/libz.so.1 (0x4001d000) libXt.so.6 => /usr/X11R6/lib/libXt.so.6 (0x4002c000) libSM.so.6 => /usr/X11R6/lib/libSM.so.6 (0x40078000) libICE.so.6 => /usr/X11R6/lib/libICE.so.6 (0x40082000) libXext.so.6 => /usr/X11R6/lib/libXext.so.6 (0x4009a000) libX11.so.6 => /usr/X11R6/lib/libX11.so.6 (0x400a6000) libpthread.so.0 => /lib/libpthread.so.0 (0x40151000) libpng.so.2 => /usr/lib/libpng.so.2 (0x40164000) libm.so.6 => /lib/libm.so.6 (0x40181000) libc.so.6 => libc.so.6 (0x4019e000) <-- Look at this line /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Now I empty libc.so.6 file: mache@ci:~ > >libc.so.6 mache@ci:~ > ldd /usr/bin/gs /usr/bin/gs: error in loading shared libraries: libc.so.6: cannot read file data: No such file or directory No, I don't have "." in LD_LIBRARY_PATH (I don't have LD_LIBRARY_PATH at all) because every other command use the good libc.so: mache@ci:~ > ldd /bin/ls libc.so.6 => /lib/libc.so.6 (0x4001d000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) mache@ci:~ > So if I download a archive containing a lot of ps files and a shared library and try to see one postscript with gs(or gv or ghostscript) ...... mache

3 2

Openports
by Russell Evans 08 Nov '00

08 Nov '00

openports is a nice tool, /usr/sbin/openports. When did it start being included in the distribution? I looked at www.suse.de/~marc for information, but there is none. An rpm -q --whatprovides returns no package so where was it installed from? Thank you Russell

3 2

Fwd: BIND 8.2.2-P5 Possible DOS
by vladimir m. bondarev 08 Nov '00

08 Nov '00

This is a forwarded message From: Fabio Pietrosanti (naif) <fabio(a)telemail.it> To: bugtraq(a)securityfocus.com <bugtraq(a)securityfocus.com> Date: Tuesday, November 07, 2000, 3:40:49 PM Subject: BIND 8.2.2-P5 Possible DOS ===8<==============Original message text=============== Hi, playing with bind and ZXFR feature ( zone transfer compressed with a possible insecure execlp("gzip", "gzip", NULL); ), i discovered a Denial Of Service against Bind 8.2.2-P5 . By default Bind 8.2.2-P5 it's not compiled with ZXFR support unless you define it with #define BIND_ZXFR so it will refuse any ZXFR transfer, because it doesn't support it. But now what appens? Look here... ################################ zone to transfer: zone.pippo.com dns server: dns.pippo.com 192.168.1.1 me: naif.gatesux.com 10.10.10.10 I send a Zone Trasnfer request using "-Z" switch with means that i wish to use ZXFR. dns.pippo.com does'nt support ZXFR and have "allow-transfer{}" not configured, so everyone could ask him for *.zone.pippo.com ... <naif@naif> [~/bind/src822p5/bin/named-xfer] $ ./named-xfer -z zone.pippo.com -d 9 -f pics -Z dns.pippo.com named-xfer[29297]: send AXFR query 0 to 192.168.1.1 named-xfer[29297]: premature EOF, fetching "zone.pippo.com" On the server's log: Nov 7 11:19:09 dns.pippo.com: named[188510]: approved ZXFR from [10.10.10.10].2284 for "zone.pippo.com" Nov 7 11:19:09 dns.pippo.com: named[188510]: unsupported XFR (type ZXFR) of "zone.pippo.com" (IN) to [10.10.10.10].2284 Then the server "*** CRASHED ***" . I should assume that bind 8.2.2-P5 it's vulnerable ( Please someone test and confirm this kind of dos) and bind-9.0.0 has no support for ZXFR . <naif@naif> [~/bind] $ find src822p5/ -type f -exec grep -i zxfr \{\} ';' | wc -l 234 <naif@naif> [~/bind] $ find bind-9.0.0/ -type f -exec grep -i zxfr \{\} ';' | wc -l 0 A lot of DNS Server are misconfigured, and allow zone-transfer to any, so they are dossable... naif naif(a)itapac.net ===8<===========End of original message text=========== what about to make named allow transfers only from localhost by default? Wednesday, November 08, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

2 1

[suse-security] sendmail, 8.11.0, mail from, access denied
by Robert Rinnberger 08 Nov '00

08 Nov '00

Hi, I have a problem with SuSe V7.0 Professional and sendmail. My sendmail does not accept any "mail from: ...", it always returns "access denied". I tried this while telneting to port 25. After the EHLO I tried a MAIL FROM: <adresse@domain>. After that, sendmail returns "acces denied". There seems to be a problem with sendmail and I installed the sendmail-patch 8.11.1 from the SuSe ftp-server, but without sucess. The /etc/mail/access is configured properly also the /etc/rc.config.d/sendmail.rc.config. I have another mail server with an older version of sendmail, same configuration, which works without problems. Any ideas? Thanks, Robert

4 4

Fw: [suse-security] Openports
by Gerd Tomschik 08 Nov '00

08 Nov '00

>------------- Forwarded message follows ------------- >openports is a nice tool, /usr/sbin/openports. When did it start >being included in the distribution? I looked at www.suse.de/~marc for >information, but there is none. An rpm -q --whatprovides returns no >package so where was it installed from? maybe you should try "rpm -q -f /usr/sbin/openports" Mfg / kind regards Gerd Tomschik ----------------------------------------------------- Who the hell is General failure, and why is he reading my hard disk? -----------------------------------------------------

1 0

Open SSH to SuSE 7.0
by Richard 07 Nov '00

07 Nov '00

Dear All I'd like to use an SuSE 7.0 machine to connect to an Open BSD box with an encrypted session. I understand that I have to use SSH from the SuSE box to do that. However, the BSD box has Open SSH. I think there is a compatibility issue here ? Can anyone explain how I can connect the SuSE box to the Open BSD box with SSH ? Thank you -- Richard

3 2