November 2000 - openSUSE Security - openSUSE Mailing Lists

somebody post a procmail rule
by alex medvedev 09 Nov '00

09 Nov '00

hallo procmail experts!!! can somebody post a procmail rule to filter that socks5 message out? thanks, -alexm

3 3

Socks5 slow connect
by Peter ten Have 09 Nov '00

09 Nov '00

Hello, Following Marc's advise not to use IP masq but proxy's I've installed Socks5 for serving mIRC and Napster on the clients. So far so good. After updating 6.3 on the gateway from a SuSE ftp mirror and SuSEfirewall from 2.4 to 3.0 (exactly the same config's), mIRC only connect to the IRC server AFTER sending the first ping. Socks5 reports a connection with the IRC server and traffic is accepted by the firewall. Anyone knows what causes this delay? BTW: Napster connects immediately Thank you, Peter

4 3

Socks5 slow connect
by Peter ten Have 09 Nov '00

09 Nov '00

Hello, Following Marc's advise not to use IP masq but proxy's I've installed Socks5 for serving mIRC and Napster on the clients. So far so good. After updating 6.3 on the gateway from a SuSE ftp mirror and SuSEfirewall from 2.4 to 3.0 (exactly the same config's), mIRC only connect to the IRC server AFTER sending the first ping. Socks5 reports a connection with the IRC server and traffic is accepted by the firewall. Anyone knows what causes this delay? BTW: Napster connects immediately Thank you, Peter

1 0

New Member
by Tim Blechmann 09 Nov '00

09 Nov '00

I'm new on this list and first want to ask whether I'm right here or not. I'm a Linux user and might have some questions about firewalling, masquerading or security. But I don't want to annoy you with questions that would just waste your time. PEACE Tim mailto:TimBlechmann@gmx.de

2 1

gs read shared libraries from working directory ??
by Nicolae Mihalache 09 Nov '00

09 Nov '00

Hello! Just tried this on a SuSE 6.4 system: mache@ci:~ > ldd /usr/bin/gs libz.so.1 => /usr/lib/libz.so.1 (0x4001d000) libXt.so.6 => /usr/X11R6/lib/libXt.so.6 (0x4002c000) libSM.so.6 => /usr/X11R6/lib/libSM.so.6 (0x40078000) libICE.so.6 => /usr/X11R6/lib/libICE.so.6 (0x40082000) libXext.so.6 => /usr/X11R6/lib/libXext.so.6 (0x4009a000) libX11.so.6 => /usr/X11R6/lib/libX11.so.6 (0x400a6000) libpthread.so.0 => /lib/libpthread.so.0 (0x40151000) libpng.so.2 => /usr/lib/libpng.so.2 (0x40164000) libm.so.6 => /lib/libm.so.6 (0x40181000) libc.so.6 => /lib/libc.so.6 (0x4019e000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) mache@ci:~ > cp /lib/libc.so.6 . mache@ci:~ > ldd /usr/bin/gs libz.so.1 => /usr/lib/libz.so.1 (0x4001d000) libXt.so.6 => /usr/X11R6/lib/libXt.so.6 (0x4002c000) libSM.so.6 => /usr/X11R6/lib/libSM.so.6 (0x40078000) libICE.so.6 => /usr/X11R6/lib/libICE.so.6 (0x40082000) libXext.so.6 => /usr/X11R6/lib/libXext.so.6 (0x4009a000) libX11.so.6 => /usr/X11R6/lib/libX11.so.6 (0x400a6000) libpthread.so.0 => /lib/libpthread.so.0 (0x40151000) libpng.so.2 => /usr/lib/libpng.so.2 (0x40164000) libm.so.6 => /lib/libm.so.6 (0x40181000) libc.so.6 => libc.so.6 (0x4019e000) <-- Look at this line /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Now I empty libc.so.6 file: mache@ci:~ > >libc.so.6 mache@ci:~ > ldd /usr/bin/gs /usr/bin/gs: error in loading shared libraries: libc.so.6: cannot read file data: No such file or directory No, I don't have "." in LD_LIBRARY_PATH (I don't have LD_LIBRARY_PATH at all) because every other command use the good libc.so: mache@ci:~ > ldd /bin/ls libc.so.6 => /lib/libc.so.6 (0x4001d000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) mache@ci:~ > So if I download a archive containing a lot of ps files and a shared library and try to see one postscript with gs(or gv or ghostscript) ...... mache

3 2

Openports
by Russell Evans 08 Nov '00

08 Nov '00

openports is a nice tool, /usr/sbin/openports. When did it start being included in the distribution? I looked at www.suse.de/~marc for information, but there is none. An rpm -q --whatprovides returns no package so where was it installed from? Thank you Russell

3 2

Fwd: BIND 8.2.2-P5 Possible DOS
by vladimir m. bondarev 08 Nov '00

08 Nov '00

This is a forwarded message From: Fabio Pietrosanti (naif) <fabio(a)telemail.it> To: bugtraq(a)securityfocus.com <bugtraq(a)securityfocus.com> Date: Tuesday, November 07, 2000, 3:40:49 PM Subject: BIND 8.2.2-P5 Possible DOS ===8<==============Original message text=============== Hi, playing with bind and ZXFR feature ( zone transfer compressed with a possible insecure execlp("gzip", "gzip", NULL); ), i discovered a Denial Of Service against Bind 8.2.2-P5 . By default Bind 8.2.2-P5 it's not compiled with ZXFR support unless you define it with #define BIND_ZXFR so it will refuse any ZXFR transfer, because it doesn't support it. But now what appens? Look here... ################################ zone to transfer: zone.pippo.com dns server: dns.pippo.com 192.168.1.1 me: naif.gatesux.com 10.10.10.10 I send a Zone Trasnfer request using "-Z" switch with means that i wish to use ZXFR. dns.pippo.com does'nt support ZXFR and have "allow-transfer{}" not configured, so everyone could ask him for *.zone.pippo.com ... <naif@naif> [~/bind/src822p5/bin/named-xfer] $ ./named-xfer -z zone.pippo.com -d 9 -f pics -Z dns.pippo.com named-xfer[29297]: send AXFR query 0 to 192.168.1.1 named-xfer[29297]: premature EOF, fetching "zone.pippo.com" On the server's log: Nov 7 11:19:09 dns.pippo.com: named[188510]: approved ZXFR from [10.10.10.10].2284 for "zone.pippo.com" Nov 7 11:19:09 dns.pippo.com: named[188510]: unsupported XFR (type ZXFR) of "zone.pippo.com" (IN) to [10.10.10.10].2284 Then the server "*** CRASHED ***" . I should assume that bind 8.2.2-P5 it's vulnerable ( Please someone test and confirm this kind of dos) and bind-9.0.0 has no support for ZXFR . <naif@naif> [~/bind] $ find src822p5/ -type f -exec grep -i zxfr \{\} ';' | wc -l 234 <naif@naif> [~/bind] $ find bind-9.0.0/ -type f -exec grep -i zxfr \{\} ';' | wc -l 0 A lot of DNS Server are misconfigured, and allow zone-transfer to any, so they are dossable... naif naif(a)itapac.net ===8<===========End of original message text=========== what about to make named allow transfers only from localhost by default? Wednesday, November 08, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

2 1

[suse-security] sendmail, 8.11.0, mail from, access denied
by Robert Rinnberger 08 Nov '00

08 Nov '00

Hi, I have a problem with SuSe V7.0 Professional and sendmail. My sendmail does not accept any "mail from: ...", it always returns "access denied". I tried this while telneting to port 25. After the EHLO I tried a MAIL FROM: <adresse@domain>. After that, sendmail returns "acces denied". There seems to be a problem with sendmail and I installed the sendmail-patch 8.11.1 from the SuSe ftp-server, but without sucess. The /etc/mail/access is configured properly also the /etc/rc.config.d/sendmail.rc.config. I have another mail server with an older version of sendmail, same configuration, which works without problems. Any ideas? Thanks, Robert

4 4

Fw: [suse-security] Openports
by Gerd Tomschik 08 Nov '00

08 Nov '00

>------------- Forwarded message follows ------------- >openports is a nice tool, /usr/sbin/openports. When did it start >being included in the distribution? I looked at www.suse.de/~marc for >information, but there is none. An rpm -q --whatprovides returns no >package so where was it installed from? maybe you should try "rpm -q -f /usr/sbin/openports" Mfg / kind regards Gerd Tomschik ----------------------------------------------------- Who the hell is General failure, and why is he reading my hard disk? -----------------------------------------------------

1 0

Open SSH to SuSE 7.0
by Richard 07 Nov '00

07 Nov '00

Dear All I'd like to use an SuSE 7.0 machine to connect to an Open BSD box with an encrypted session. I understand that I have to use SSH from the SuSE box to do that. However, the BSD box has Open SSH. I think there is a compatibility issue here ? Can anyone explain how I can connect the SuSE box to the Open BSD box with SSH ? Thank you -- Richard

3 2