April 2000 - openSUSE Security - openSUSE Mailing Lists

IP Spoofing / SYN Flooding
by Harald Scharf 05 Apr '00

05 Apr '00

hey, to all, is there a linux tool, that can capture a tcp connection (like tcpdump) and unfold the real ip from the attacking host, when the ip adress is forged (ip spoofing)?? Harald Scharf Softpoint electronic Netzwerksysteme / Firewalls Windows NT/Windows 2000/Linux/Netware/Unix mailto:h.scharf@softpoint.at www.softpoint.at www.simplex.at

2 1

AW: [suse-security] Web server security holes ?
by Harald Scharf 05 Apr '00

05 Apr '00

Sombody tried to use web server cgi scripts to hack your server. the line POST /cgi-bin/phf?Qname=x%oa means : call the script phf in cgi-bin %0a = carrige return /bin/sh tried to call an external program !! DELETE ALL YOUR TEST-CGIs and PHPs delivered with the WEB Server in Standard configuration !! Best way to secure (but maybe not possible) : Do not allow POST on CGI bye Harald Scharf softpoint electronic h.scharf(a)softpoint.at -----Ursprüngliche Nachricht----- Von: Marc Baaden [mailto:marc@causul.u-strasbg.fr] Gesendet: Mittwoch, 5. April 2000 09:34 An: suse-security(a)suse.com Betreff: [suse-security] Web server security holes ? Dear All, I am quite concerned about security, and I think my machine is doing well with respect to all usual services as telnet, FTP, etc... Unfortunately I am not very experienced with web servers, and have the standard features of SuSE 6.3 installed (Apache, I think). On two of my machines I got the following log entries in http.acces_log/ error_log - What does it mean ? - Is it dangerous for the machine ? - Can I further secure my machine ? PS: I do NOT need the machine beeing accessible by external machines in HTTP Thank you for explaining these things to me ... 131.155.14.130 - - [19/Mar/2000:07:09:12 +0100] "POST /cgi-bin/perl HTTP/1.0" 404 281 131.155.14.130 - - [19/Mar/2000:07:09:12 +0100] "POST /cgi-bin/phf?Qname=x%0a/bin/sh+-s%0a HTTP/1.0" 404 280 128.175.13.74 - - [19/Mar/2000:17:43:12 +0100] "GET /cgi-bin/counterfiglet/nc/f=;echo;echo%20{_begin-counterfiglet_};uname%2 0-a;id;w;echo%20{_end-counterfiglet_};echo HTTP/1.0" 404 376 128.175.13.74 - - [20/Mar/2000:03:46:42 +0100] "POST /cgi-bin/test-cgi HTTP/1.0" 200 482 128.175.13.74 - - [20/Mar/2000:06:07:22 +0100] "POST /cgi-bin/phf?Qname=x%0a/bin/sh+-s%0a HTTP/1.0" 404 280 128.175.13.74 - - [20/Mar/2000:07:02:50 +0100] "GET /cgi-bin/aglimpse/80|IFS=_;CMD=_echo\;echo_id-aglimpse\;uname_-a\;id;eva l$CMD; HTTP/1.0" 404 346 128.175.13.74 - - [21/Mar/2000:00:50:01 +0100] "POST /cgi-bin/perl HTTP/1.0" 404 281 128.175.13.74 - - [21/Mar/2000:06:33:15 +0100] "POST /cgi-bin/sh HTTP/1.0" 404 279 128.175.13.74 - - [21/Mar/2000:07:17:24 +0100] "GET /cgi-bin/query?x=%3C%21%2D%2D%23%65%78%65%63%20%63%6D%64%3D%22%2F%75%73% 72%2F%62%69%6E%2F%69%64%22%2D%2D%3E HTTP/1.0" 404 282 128.175.13.74 - - [21/Mar/2000:08:32:59 +0100] "GET /%3C%21%2D%2D%23%65%78%65%63%20%63%6D%64%3D%22%2F%75%73%72%2F%62%69%6E%2 F%69%64%22%2D%2D%3E/index.html HTTP/1.0" 404 316 [Sun Mar 19 17:43:12 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/counterfiglet [Mon Mar 20 06:07:22 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/phf [Mon Mar 20 07:02:50 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/aglimpse [Tue Mar 21 00:50:01 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/perl [Tue Mar 21 06:33:15 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/sh [Tue Mar 21 07:17:24 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/query [Thu Mar 30 22:34:16 2000] [notice] Apache/1.3.9 (Unix) (SuSE/Linux) mod_perl/1.21 PHP/3.0.12 configured -- resuming normal operations [Thu Mar 30 22:34:16 2000] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [ Marc Baaden -- Marc Baaden - Labo MSM (UMR 7551) - http://crypt.u-strasbg.fr/marc mailto:baaden@chimie.u-strasbg.fr - FAX (+49) 89 24 43 1 68 68 ICQ# 11466242 - Tel: (+33) 3 88 41 60 86 or (+33) 6 09 84 32 17 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] DNS spoofing
by john scroggins 05 Apr '00

05 Apr '00

Thanks for the response Frank, I might want to clarify, I do not run DNS as a service. I do not have bind installed. I was speaking of allowing my ISP's nameserver access to my internal network. All my machines use the ISP's NS for IP addy resolution. I had snort reportting .. "Source Port Attack --- From ns1.<ISPname>.net to 192.168.1.4 (one of my internal network boxes) My question is, can someone spoof my ISP's namserver addy to gain access to my network? If so, how can I filter the packet or verify the contents and deny access. John @ DataEFX -----Original Message----- From: Frank Derichsweiler <fd-l-s-s(a)daidalos.informatik.unibw-muenchen.de> To: dataefx(a)earthlink.net <dataefx(a)earthlink.net> Date: Tuesday, April 04, 2000 11:20 PM Subject: Re: [suse-security] DNS spoofing >On Tue, Apr 04, 2000 at 07:04:10PM -0400, john scroggins wrote: >> [Long description] >> >> Bottom line is how can some one access my firewall/masq machine when there >> are no open ports, the only traffic allow back into the network is the >> masq'd packets and DNS? >> > >Hi John, > >Maybe this is a stupid question, but .... >Have you installed the security patches for 6.3? AFAIK there were some >security-related fixed, e.g. bind and utils. > >HTH >Frank >

1 0

DNS spoofing
by john scroggins 04 Apr '00

04 Apr '00

Good day all, I apologize in advance for the length of this post. I am at my wits end, as I am using a web mail client, rather than my Linux machines. If you do have a bit of time to read this and have some input, it would be greatly appreciated. Question, I am experiencing a continued compromise problem, every attempt that I have made seems to be for naught. I am running a 200Mhz Pentium with SuSE 6.3 firewal program version 1.4.8, as a masq/router box, and a couple of oher Linux machines as a small home network. I have taken the time to upgrade the kernel to the latest version, applied the kernel security patch by Solar Designer, turn of all unnecessary services. I this point I do not run X on the box or have make or gcc installed for obvious reasons. I run my system wide permissions as 'paranoid'. I also perform a nmap scan and a SAINT audit to make sure that no holes exist. I run rpm -Va to verify all the packages. ** This is all performed without the box hooked to the external wire.** The only incoming traffic I allow is the return packets from the internal network machines and name server (DNS) from my local ISP, all other ports are closed, so I think :/ A few days after each 'clean reinstall' I start to notice a fair amount of outbound traffic. The first incident, I found that port 6000 (X) was open.. I was sure that nmap and SAINT had given me a clean bill of health. Sure enough a dbl-chk with SAINT showed X Windows as a vulnerability, also netbois was insecure. No signs of file modifications or additional files on the system. Second incident was the same type of scenario, except I upgraded SAINT to the 2.0 version and ran an audit, It indicated "evidence of penetration" and stated that three trojan problems where found, a trinoo master and two clients 'stacheldraht' were installed. I found an empty file in the rot directory labeled '.fishingboat'. The third incident is with the stripped down box, (no X, make binutils and such. (not like that will stop someone using a precompiled program, I just don't want to help them while they are at it) I installed portsentry and logwatch, I also have installed seccheck for daily reports. Again checking the external integrity, making sure that _no_ ports were open, hooking the machine up, 1 day later I see abnormal ICMP (ping traffic) from my masq box. I have no logwatch reports, it looks as though portsenrty entries have been wiped, no sign of portsentry initialization in /var/log/messages. I did run ps aux | less and found portsenrty running, hmm no initialization reports. I have a Debian box monitoring network with 'snort' and several times it reported a "Source Port Attack" which I ignore as a possible anomoly. The source was my primary name servers addy. I also found in one syslog a report of a neighor table overflow and then saw a few minute later, one of the internal machines e.g. 192.168.1.x attempting a connection to the internal loopback (which I always disable) 127.0.0.1 :512. Bottom line is how can some one access my firewall/masq machine when there are no open ports, the only traffic allow back into the network is the masq'd packets and DNS? Is this some type of spoofing , can I eliminate this problem, is there a way that IP Chains can filter the packet and identify a spoofed adress. Any help would be appreciated, again thanks Cheers, John @ DataEFX

1 0

login & password aging
by Schoeberle Daniel 04 Apr '00

04 Apr '00

Hi! I have a problem concerning password aging on SuSE 6.3. If a password expires the user is prompted for the new password at the login time. The problem is that he/she can enter an empty one just by hitting Enter twice. No checks for minimum password lenght, no cracklib checks - and these are enabled in etc/login.defs. Changing the password from the prompt works normally with all the checks in effect. So, is there a way to enable atleast the minimum password lenght check? Any comments and/or suggestions would be appreciated. Regards, Daniel.

2 1

script kiddie kit
by Chrissy 03 Apr '00

03 Apr '00

Here yall go...lots o things to learn from. http://linux.netnerds.net/skk.tar.gz I will be deleting it soon.. please retrieve it within 48 hours. Good luck, Chrissy

1 0

yep..twas a kiddie
by Chrissy LeMaire 03 Apr '00

03 Apr '00

Sure nuff.. some script kiddie sniffed a user's password and attempted to run a few exploits on the machine. Thankfully, I think I was patched for all/most of them. The person wasn't too smart -- they left their bash history and other evidence. They had a few exploit tarballs for different distros.. SuSE had 5.1 to 6.3. Unfort. that box is in another town.. is there a simple way to update to 6.3 w/o having to physically attend to the machine? I'm won' t be able to make it down there until next Sunday. I've still got the exploits tarballed away if anyone wants to a take alook.. its just run-of-the-mill exploits like the cron exploit, and the x /tmp file exploit. among others.... thanks for all the help, yall. Chrissy

2 1

Real bad log entry
by Chrissy 01 Apr '00

01 Apr '00

This looks terrible.. anyone have any ideas? Mar 30 20:45:00 rox /USR/SBIN/CRON[16114]: (root) CMD ( test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons ) Mar 30 20:46:14 rox ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P Mar 30 20:46:55 rox named[380]: Cleaned cache of 57 RRsets I've got sendmail, web, named, and identd open to the world.. and pop3, ftp, ssh open to accepted ip ranges (via IPCHAINS) Please help..this sucks. Chrissy

4 5

Re: [suse-security] Real bad log entry
by Eilert Brinkmann 01 Apr '00

01 Apr '00

Chrissy <chrissy(a)netnerds.net> wrote: > While doing a portscan..i noticed a weird port.. 687 ..any clues? You can use `fuser -v -n tcp 687' (or with -n udp if it's an UDP port) to check out which process owns this port. And a `netstat -atup' should show you all open TCP and UDP ports and the corresponding processes. (As others pointed you can't rely on this programs *if* your box was cracked.) Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

Problem with apache+mod_ssl and logrotation
by Normando Marcolongo 01 Apr '00

01 Apr '00

I've noticed that at every log rotation, and accordingly to /etc/logfiles, apache is reloaded (in the aaa_base cron i've found a line close to /sbin/init.d/'process' reload). After that the https connections (the encrypted ones) does not properly work! In the error log i see a line with a notice of Segmentation Fault. Is this normal, how can I fix this? Thanks a lot! P.S. Restarting (not reloading) apache all behaviours normally. Normando. -- Normando [enemy] Marcolongo (iW6OWQ) [] normando(a)studenti.ing.uniroma1.it LUGRoma - IEEE S.B. Roma - ALU - ??? [] (AX.25) IW6OWQ(a)IW7BNO.IPUG.ITA.EU

1 0