April 2000 - openSUSE Security - openSUSE Mailing Lists

Linux kernel masquerading vulnerability
by marc＠suse.de 29 Apr '00

29 Apr '00

Hi, everyone who does masquerading with a linux kernel: please note that all kernels are known to have the following vulnerability: The ftp and udp masquerading modules can be used by an attacker in some circumstances to access internal machines. These bugs will hopefully be fixed by the linux kernel team in version 2.2.15 We will provide a kernel update once the new kernel version is available. Yours, SuSE Security Team -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

[Fwd: AW: [suse-security] Portscans]
by Joop Boonen 28 Apr '00

28 Apr '00

Thank you very much for sending the message 21 times.

1 0

port 1386
by Prasanna Krishnan 28 Apr '00

28 Apr '00

I am running SuSE 6.4. When I run nmap, port 1386 comes up as open. I am unable to figure out why it is open. I know that the CheckSum License Manager uses it but what/where is this package and how to I close this port? I cannot find anything about this port. Thanks for any help.

2 1

[suse-security] Portscans
by Timo Schulz 27 Apr '00

27 Apr '00

Hi list, I have a few questions about the detection of port scanning. In the IX 5/May 2000 magazin (German), the author writes that he uses nmap to scan a well used web site. First I want to know if the victim can easily detect the scan and how to prevent such scans. Does SuSE 6.x contain any tools to do that ? PS: I ask me, if it is legal to do portscans on any sites ? -- Two-a-Day at joesixpack.net www.freenet.de/joesixpack keyid BF3DF9B4

12 14

firewall logs from a machine with power cut off
by Frank Hart 27 Apr '00

27 Apr '00

Hi, I don't get this at all. My firewall log gives me the following: Apr 27 17:51:34 CC6743-a kernel: Packet log: input DENY eth1 PROTO=17 192.168.0.1:1015 255.255.255.255:1015 L=176 S=0x00 I=44967 F=0x0000 T=128 (#5) Every two seconds I get this message. Thought I maybe misconfigured the firewall, but when I turn this machine off (it's part of my LAN) the logs won't stop. Is this somekind of IP-spoofing that the firewall detects? I haven't changed anything (I think) on the firewall, or the workstation. The other workstations doesn't give me these logs. Anyone has a clue? -- SuSE Linux 6.4 -o) | Re graphics: A picture is worth 10K words -- but Kernel 2.2.14 /\ | only those to describe the picture. Hardly any on a i686 _\_v | sets of 10K words can be adequately described mailto:frhart@home.nl | with pictures.

1 0

Cannot open raw socket as root
by fmmarzoa＠idecnet.com 27 Apr '00

27 Apr '00

darkgate:/usr/local/angel/bin # /usr/local/sbin/queso x.x.x.x opening raw send socket: Operation not permitted Hey, i'm root... so what da h*ll???... Stop your surely bad thoughs dudes, i'm just trying to test if an ISP is really using LiNUX to see if we change our one to that, i believe more in my own commands than in a secretary. I've reached darkgate host from another one through ssh, but i think it has nothing to see. Hmmmmm... perhaps in a kernel recompilation did i forget some option that is needed to use raw_socket even when you're root?. -- Francisco M. Marzoa Alonso Nuevo Mundo - Dpto. Informático ICQ#: 62850923 Henri Dunant, 19 - 28036 Madrid tfno: +34 91 343 18 40 ext. 207 España / Spain fax: +34 91 350 28 45

1 0

Re: [suse-security] Portscans
by Martin P. Peikert 26 Apr '00

26 Apr '00

On Mit, 26 Apr 2000 Timo Schulz wrote about [suse-security] Portscans: > >First I want to know if the victim can easily detect the scan >and how to prevent such scans. Yes. Try scanlogd. > >Does SuSE 6.x contain any tools to do that ? Yes. 6.3: scanlogd is in sec. > >PS: I ask me, if it is legal to do portscans on any sites ? > Some admins consider a portscan as a preparation for an attack and contact the gateway admin of the IP adress the scan was from. If you want to scan a host, ask the admin _before_ your scan, otherwise you might get in trouble. Yours, Martin -- ----------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html -----------------------------------------------------

1 0

local user can delete arbitrary files
by Peter Münster 26 Apr '00

26 Apr '00

Hello, it had been announced to info(a)suse.de about one year ago, but the bug still exists in /etc/cron.daily/aaa_base (or perhaps also /root/bin/cron.daily for older SuSE versions). Tested on SuSE 6.0 and 6.3 but probably existent on earlier versions. If MAX_DAYS_IN_TMP > 0 in /etc/rc.config, a local user can delete arbitrary files on the system by doing some commands like these: mkdir -p "/tmp/hhh /somedirectory" touch -t some-early-date "/tmp/hhh /somedirectory/somefile" sleep 1d Here the patch for suse-package aaa_base-2000.1.3-0: --- aaa_base~ Mon Jan 3 18:16:55 2000 +++ aaa_base Fri Apr 21 08:42:19 2000 @@ -158,20 +158,10 @@ done for TMP_DIR in $TMP_DIRS_TO_CLEAR ; do - for DEL_FILE in `find $TMP_DIR/. $OMIT $ -type f -o -type l $ \ - -atime +$MAX_DAYS_IN_TMP | sort -r` ; do - rm -f $DEL_FILE - DEL_DIR=`dirname $DEL_FILE` - if [ "$DEL_DIR" != "$TMP_DIR/." ] ; then - rmdir $DEL_DIR 2> /dev/null - fi - done - done - for DEL_DIR in `find $TMP_DIR/. $OMIT $ -type d $ \ - -ctime +$MAX_DAYS_IN_TMP | sort -r` ; do - if [ "$DEL_DIR" != "$TMP_DIR/." ] ; then - rmdir $DEL_DIR 2> /dev/null - fi + find $TMP_DIR/. $OMIT ! -type d \ + -atime +$MAX_DAYS_IN_TMP -exec rm -f '{}' ';' + find $TMP_DIR/. $OMIT -depth -type d -empty -mindepth 1 \ + -mtime +$MAX_DAYS_IN_TMP -exec rmdir '{}' ';' done fi Cheers, Peter -- Peter Münster http://gmv.spm.univ-rennes1.fr/~peter/

4 3

RE: [suse-security] Break in or Normal System Message ??
by Wood, Alan 26 Apr '00

26 Apr '00

To add to the statements, texpire is part of Leafnode, and if all has been configured to do so, will expire old news articles out of the store. Alan > ---------- > From: Richard[SMTP:r.ibbotson@zetnet.co.uk] > Reply To: r.ibbotson(a)zetnet.co.uk > Sent: 26 April 2000 07:46 > To: suse-security(a)suse.com > Subject: [suse-security] Break in or Normal System Message ?? > > Hello > > I connected my own PC to the net last night and shortly afterwards I > could see the following message in /var/log/messages.... > > Apr 25 22:05:00 sheflug /USR/SBIN/CRON[2625]: (root) CMD ( test -x > /usr/sbin/texpire && /usr/sbin/texpire) > > Is this a normal system message or is it something else ? Can't find > anyone to explain it to me :-) There's nothing set up in crontab so > I'm not sure what to make of it. > > Thanks > > -- > Richard > Sheffield UK > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

Break in or Normal System Message ??
by Richard 26 Apr '00

26 Apr '00

Hello I connected my own PC to the net last night and shortly afterwards I could see the following message in /var/log/messages.... Apr 25 22:05:00 sheflug /USR/SBIN/CRON[2625]: (root) CMD ( test -x /usr/sbin/texpire && /usr/sbin/texpire) Is this a normal system message or is it something else ? Can't find anyone to explain it to me :-) There's nothing set up in crontab so I'm not sure what to make of it. Thanks -- Richard Sheffield UK

3 3