March 2000 - openSUSE Security - openSUSE Mailing Lists

EICAR2000 - Last chance for online registration.
by Hans v. Sommerfeld 02 Mar '00

02 Mar '00

<http://www.eicar.dk/> >>>>> Information Security for the Next Millenium <<<<< 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 ++ Last chance for online registration at <http://www.eicar.dk/registration> ++ You can still make a last minute registration :). Come around and enjoy. -- 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 --- <http://www.eicar.dk/> eicar-online: <http://www.eicar.org/> --- H. von Sommerfeld <mailto:snoopy@redbaron.bir.uunet.de>

1 0

Re: [suse-security] SuSE Security Announcement - make-3.77
by Peter Folk 02 Mar '00

02 Mar '00

Jussi Laako <jussi(a)jlaako.pp.fi> wrote: >Or are you just pissed off because you couldn't use that bug to exploit few >systems? > >...Just wondering why are you crying about common practice and hiding behind >anonymity. (You aliases writing style just happens to be common to wanna-be >crackers who think they are kEwL...) I just want you to know that I think that is an entirely inappropriate comment. Many people prefer to protect their privacy and in many respects I think the 'net would be a much better place if more people did. Just because he does does not make him a cracker, nor does it invalidate his opinions (which I happen to share despite my not using an alias or being a cracker). If a system is concerned about security, then they should take measures to follow bug lists and disable services as bugs are discovered to maintain it. If not, then they will likely not know about the fix when it is re- leased either, and their system will be open to attack anyway. I see no reason to withhold information from those who will use it for the sake of those who (most likely) will not---at least it puts the security folks and the crackers on (more) even footing. Pete

1 0

T.Rex
by Johann G. Hautzinger 02 Mar '00

02 Mar '00

are there any plans to provide T.Rex (http://www.opensourcefirewall.com/index.html) for SuSE? it sounds all very interesting ... just doesn't currently support my favoured distribution ... *greetz* from Vienna Hannes -- Johann Georg Hautzinger, email: trema(a)eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at

4 3

Re: [suse-security] SuSE Security Announcement - make-3.77
by Peter Folk 02 Mar '00

02 Mar '00

rabbi(a)quickie.net wrote: >Bruce Schneier has a very good piece about this. In it he condems >publishing exploits, and *demands* that those who find exploits give the >vendors ample time (not just a few days) to fix the hole. Fine. Then let's have two announcements: A hole has been discovered in X which allows [basic description of the security violations]. Please disable it until a patch is available. and the standard one, with an in-depth description of the problem and patches (and expoits if you aren't idiologically opposed to them). If all the locks are broken, it would be wise to tell those living in the subdivision to stand guard with a shotgun until the lock can be fixed. Pete

1 0

Re: [suse-security] Network question
by Selcuk Ozturk 01 Mar '00

01 Mar '00

If you are using Suse 6.2 and Intel EtherExpress Pro 100 cards, we had a similar experience and upgrading the drivers to the 'newnet.rpm' (available on Suse updates area) solved it for us. Selcuk > Hi! > > I know, this is a security board, but I have a network question and I > can't resolve the problem. I have tryed all thing I know and I'm a network > engineer. (I know what I'm do..) > > I always get collisions on my eth1, internal nic. Some pc's are connected > over a half duplex hub. The nic's and the cables are ok. My questions is > now.. Sometimes the data stream get frozen for about 3 or 4 sec. > > Can I push up somethink like windows size or something else I can try to > get a better result? What I can adjust for earn a fast constant data > stream without these connection errors?? > > Thanks for you help, > Chris <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> < Selcuk Ozturk <+> Email: > < MIS Deputy Director <+> sozturk(a)eMediaMillWorks.com > <=============================<#>===================================> < <+> eMediaMillWorks > < Fax : (301)883-2482 x121 <+> 1100 Mercantile Lane, Ste 119 > < Fax : (301)883-9754 <+> Largo, MD 20774 > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=>

1 0

Network question
by list 01 Mar '00

01 Mar '00

Hi! I know, this is a security board, but I have a network question and I can't resolve the problem. I have tryed all thing I know and I'm a network engineer. (I know what I'm do..) I always get collisions on my eth1, internal nic. Some pc's are connected over a half duplex hub. The nic's and the cables are ok. My questions is now.. Sometimes the data stream get frozen for about 3 or 4 sec. Can I push up somethink like windows size or something else I can try to get a better result? What I can adjust for earn a fast constant data stream without these connection errors?? Thanks for you help, Chris

2 1

ftp
by Jochen Lillich 01 Mar '00

01 Mar '00

Hi, what are recommended ways of securing ftp access from internal networks to the internet? Regards, Jochen -- ---------------------------------------------------------------------- Jochen Lillich | http://www.teamlinux.de | TeamLinux - J. Lillich und B. Schmidt GbR | Tel. 07255/76784-12 Linux-Loesungen fuer Internet und Intranet | Fax 07255/76784-50 ----------------------------------------------------------------------

3 3

Security Announcement: htdig
by thomas＠suse.de 01 Mar '00

01 Mar '00

Subject: SuSE Security Announcement - htdig -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: htdig < 3.1.5 Date: Sun Feb 27 21:58:59 CET 2000 Affected SuSE versions: 6.1 - 6.3 Vulnerability Type: remote compromise SuSE default package: no Other affected systems: all systems using htdig < 3.1.5 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update it as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description htsearch, a CGI program which is part of htdig, doesn't do proper checking on user input. 2. Impact By exploiting this security hole a remote attacker can view the contents of arbitrary files on the www server system with the privileges of the HTTP server. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) 4c8fe97c7d0804f1209ddae0c4feec7c ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/htdig-3.1.5-0.alpha.rpm bcbb21d0dc86c7b383e2991cfdde997d ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/htdig-3.1.5-0.alpha.rpm 105d8b266bc05a8aa0362b95e516ffe2 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/htdig-3.1.5-0.i386.rpm 9e3a5875f87a1f14d5b6602859208076 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/htdig-3.1.5-0.i386.rpm 0e302f0ebe4772a3f84ad8390f62c4e8 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/htdig-3.1.5-0.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOLz283ey5gA9JdPZAQEW1AgAlEzhOH+SnBNA07OgnQ5TngeMBlgPyMLR bl+aX3Yp39jmeaUM7MA4eAew3CNjzEbs4ZClTsU9Ag6IH2cSd+aq0FaQvBIEY8Pe CjbCck+yL+6UOo/mWX1cnEAFU0Q2gZe165GYcvg3mP9GPuRe3wuUAyMusHTa3/ZO Iax5AySa9uwuZ7i5+ycWh6/v7R3Pip9zkDvZ4dFIsQ3jS2COG8GW9OGLs8jhcJfU RJWTwA0Ky6G+ezbcwrSKeD7xwLddU65uJca4BQ8rx5aGcfwzCxomC78M2etTLWM5 kqznQEtOGu8Ym3ogIRPxHgyIyYzPDbwcrf0BnFsb43zGf1wP5fJtig== =Jl60 -----END PGP SIGNATURE-----

1 0

ht://Dig
by Tobias Burnus 01 Mar '00

01 Mar '00

Hi, will be there an update by SuSE? Or is ~> rpm -q htdig htdig-3.1.2-28 not affected? Tobias http://lwn.net/daily/htdig-hole.html > Date: Fri, 25 Feb 2000 18:52:44 -0600 > To: lwn(a)lwn.net > From: Geoff Hutchison <ghutchis(a)wso.williams.edu> > Subject: [SECURITY] Security hole in ht://Dig's htsearch > > (What follows was sent to the htdig, htdig3-announce and htdig3-dev > mailing lists earlier today.) > > Hi, > > I'm sending this message out essentially twice. The contents are > included in the ht://Dig 3.1.5 release notes at > <http://www.htdig.org/RELEASE.html>;, but I wanted to make sure > everyone got the message. There is a security hole in all versions of > the htsearch CGI prior to version 3.1.5 (just released). > > This hole can allow remote users to read any file on your system that > the UID running your webserver can read. > > It is *strongly* recommended that you upgrade to 3.1.5 ASAP. Anyone > upgrading from a 3.1.x stable release will find the process fairly > painless and to fix the hole, they can simply drop in the new CGI. > The databases themselves are not affected. You may also wish to look > at the new default templates as they make use of new features and > generate cleaner HTML output. > > Anyone using version 3.2.0b1 is suggested to upgrade to the latest > development snapshot. The next beta version, 3.2.0b2, will be > released shortly to address this issue and other bugs. > > More detailed information will be posted to the BugTraq mailing list > in a day or two. > > -Geoff Hutchison > Williams Students Online > http://wso.williams.edu/

2 3

Fw: [suse-security] SuSE Security Announcement - make-3.77
by Magus Ba'al 01 Mar '00

01 Mar '00

Here's the way I see about new bugs, they've been there for who knows how long, maybe since the beginning or since the last update/patch. That means it could have been days, weeks or years that this bug has been there, why does it matter if you don't know for a few more days, it's not like they find it and all the sudden ALL the crackers know about it. So what if you don't know for a few more days, it gives the author time to fix the bug, and then post the new version/patch, so then inform you and all the crackers that the bug exists. What if there is no workaround other than to take down the entire box until the fix is available, then what, you're SOL? I'd rather not know about it for a few days, have an update available, then be informed so I know that it wasn't public knowledge so others could exploit me. "He who fights with monsters should look to it that he himself does not become a monster...when you gaze long into the abyss the abyss also gazes into you." -Friedrich Nietzsche "Push and you will find resistance, lead and you will find followers" - Unknown Author ----- Original Message ----- From: "Petri Sirkkala." <petes(a)noitatieto.fi> To: "SuSE Security" <suse-security(a)suse.com> Sent: Monday, February 28, 2000 6:33 AM Subject: Re: [suse-security] SuSE Security Announcement - make-3.77 > > On Mon, 28 Feb 2000, Fred Mobach wrote: > > > Thomas Michael Wanka wrote: > > > > > On 28 Feb 00, at 9:06, Andre Poenitz wrote: > > > > > > > That's simply not possible. So this approach is not feasible IMHO. > > > > Full disclosure is sometimes problematic but works rather well in > > > > general. I'd never trust anybody who is saying 'well, I know of a > > > > problem of yours, but I won't tell you'. > ... > > This is not the discussion I subscribe to this list for. Stop now or I > ignore you for time being. > -Pete > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0