May 2000 - openSUSE Security - openSUSE Mailing Lists

SuSE 6.4| test.cgi
by Grant M*** 14 May '00

14 May '00

ok i just got SuSE 6.4 and was looking around when i tried one of those cgi scanners on my box, low and behold it came up with a the test.cgi exploit which allows people to basically see whats running on your computer http://localhost/cgi-bin/test.cgi?*/ now i isntalled everything and have no clue whether it came on default installation, but this exploit could be wrather dangerous so if you could appoint me to a patch to fix this problem, i would be very greatful ----------------------------------------------- FREE! The World's Best Email Address @email.com Reserve your name now at http://www.email.com

3 2

too many mounted file systems
by Security 13 May '00

13 May '00

I´m not sure this is a security issue. I have reached the NFS mount limit of 256 mounts on my machhine. I did not know before there was one... How do I extend that to get 100% connect from my backup machine? The Message while mounting mount 257 was: mount: wrong fs type, bad option, bad superblock on localhost:/usr/home/vserver/lib, or too many mounted file systems Background: I use NFS (localhost -> localhost) to get a lot of users their own virtual server in a chrooted box, but using some of shared directories, so every chrooted box uses multiple mounts. Thx, Bernhard

1 0

Re: [suse-security] manpath: and manpath: quick bugfix
by Volker Kuhlmann 12 May '00

12 May '00

> While executing this, /etc/csh.cshrc is called. In this file you find > setenv MANPATH "(unsetenv $MANPATH;`manpath -q`)" That could be a race problem, although it's hard to believe. > > setenv MANPATH2 "`manpath -q`" > > unsetenv MANPATH > > setenv MANPATH $MANPATH2 Please - tidy this up (load new path into new variable, copy, delete), btw you missed the quotes - bad! setenv MANPATH2 "`manpath -q`" setenv MANPATH "$MANPATH2" unsetenv MANPATH2 > We tried that first, too, and then the problem disappears for calls > from the command line, but not from the crontab... :-( I would suggest SuSE changes this anyway. Recursive dependencies are asking for trouble - unless someone can guarantee this isn't one. My version still gets by with 1 less process thus is more efficient. Btw how about debugging: create a directory, and write the env vars as well as the shell vars(!!) (commands env, set) into a file in this directory each time csh gets started (I suggest $$ in the file name). The next morning will tell how the environments for interactive shell sessions and cron differ. This kind of thing is often a problem for things run from cron. Volker

1 0

manpath: quick bugfix
by Frank Steiner 11 May '00

11 May '00

Hi, for all the people having the manpath problem: What worked for us was checking the $MANPATH variable in a shell (in our case: /usr/local/man:/usr/share/man:/usr/man:/usr/X11R6/man:/usr/openwin/man:/opt/gnome/man) and replacing in /etc/csh.cshrc the "evil line" ;-) setenv MANPATH "`(unsetenv MANPATH;manpath -q)`" by setenv MANPATH usr/local/man:/usr/share/man:/usr/man:/usr/X11R6/man:/usr/openwin/man:/opt/gnome/man Of course not a final solution, because the manpath might change over time, but until SuSE has some real fix, this one avaiods the hanging path without changing the security script which causes it... Best, Frank -- Dipl.-Inform. Frank Steiner mailto:fst@informatik.uni-kiel.de Lehrstuhl f. Programmiersprachen mailto:fsteiner@web.de CAU Kiel, Olshausenstraße 40 Phone: +49 431 880-7265, Fax: -7613 D-24098 Kiel, Germany http://www.informatik.uni-kiel.de/~fst/ *** Windows 2000 - Die drei grossen G - Gesehen. Gelacht! Gelöscht :) ***

1 0

[suse-security] manpath again]] (fwd)
by Fritz Ganter 11 May '00

11 May '00

Ruediger Oertel wrote: > > > Could someone that still has this problem (or can reproduce it > somehow) look in "pstree -ap" to find the parent process of the > cpu-hogging "manpath"-process. Maybe even "strace -p PID" with > the PID of the manpath process would give a hint. Here it is: -sh(6541) -c ... | `-security-contro(6546) /usr/lib/secchk/security-control.sh daily | `-security-contro(6553) /usr/lib/secchk/security-control.sh daily | `-sh(6556) /usr/lib/secchk/security-daily.sh | `-csh(6631) -f -s | `-manpath(6632) -q and strace gives forever: stat("/usr/share/man/allman", 0xbffffbe4) = -1 ENOENT (No such file or directory) stat("/usr/share/man/allman", 0xbffffbe4) = -1 ENOENT (No such file or directory Do you need more information before I do my daily kill? -- Fritz GANTER mailto:Ganter@quant-x.com UNIX and Linux Support mailto:support@quant-x.com Quant-X Service & Consulting Ges.m.b.H. http://www.quant-x.com Phn: +43 4212 90555-0 Fax: +43 4212 90555-20 Free: +800 90555 000 -- Fritz GANTER mailto:Ganter@quant-x.com UNIX and Linux Support mailto:support@quant-x.com Quant-X Service & Consulting Ges.m.b.H. http://www.quant-x.com Phn: +43 4212 90555-0 Fax: +43 4212 90555-20 Free: +800 90555 000

1 0

recovering from a possible hack
by Chrissy LeMaire 11 May '00

11 May '00

hey all, Ive got a friend that possibly has a hacked machine.. and has recently purchased 6.4. Does he have to format the drive and start from almost scratch or will just Updating the system take care of the problem? thanks much, Chrissy

4 5

passwd question
by Jose Luis Araujo 11 May '00

11 May '00

Hy, having installed my first SUSE system [BTW 6.3] (and against my will) finding it much better than i expected of a "user-friendly" instalation. When browsing the new system i found something that i thought i would never found in a modern linux setup, the passwords were using only the first 8 caracters of a password, that is using DES, why doesn't it uses MD5 crypt. I may be wrong, and i hope this isn't the default. It it is, then i consider it a bug. My question then is: how to install a better crypt or how to setup a better crypt. -------------------------------------------------------------------------- See you in the battleground Jose Araujo aka "Forever Young"

3 2

Manpath problem
by Eric Goethals 11 May '00

11 May '00

1 0

syslogd still not logging after rotation
by Michael Hase 10 May '00

10 May '00

Hi, today we realized the problem, that syslog does not work after logfile rotation (Suse 6.3). The aaa_base update does not correct this. Thomas Biege from suse considered a kill -HUP `cat /var/run/syslogd.pid` at the end of the rotating script. This is only a workaround as messages logged in the time between rotation of the specific file and this statement are lost. So the protocol in /var/log/messages may not be complete. The update of the aaa_base package as suggested by suse has a new problem in the script /etc/cron.daily/aaa_base_rotate_logs: the logfiles get copied before the service is restarted. syslog has its files open, so an open file gets copied! The old suse 6.3 script had a mv in it, but did the commands in the wrong order (mv, gzip, then restart service) There is already a mechanism in this rotating script as suggested by Michael Dirska, just add syslog in the last column of /etc/logfiles. Important: do this for every file used by syslog. Imho this should be fixed immediately in another update. Michael -- Michael Hase Six Offene Systeme GmbH michael(a)six.de Sielminger Str. 63 http://www.six.de 70771 Leinfelden-Echterdingen phone +49 711 99091 62 Germany

1 0

Re: [suse-security] automating security updates?
by Volker Kuhlmann 10 May '00

10 May '00

> i'm looking for a way to speedup or automate the installation of security > related updates. i have a local mirror of ftp.suse.com:/.../suse/updates > nfs mounted to my suse systems. is there anyway to use rpm to upgrade all the > rpms in this directory? tnks! How do you first want to make sure that those file are from SuSE? Otherwise your "security"-update can hardly be called such. Once you solved that, rpm -UFvh is a good starting point. Volker

1 0