June 2000 - openSUSE Security - openSUSE Mailing Lists

Auditing software for Squid
by mablanco＠earthling.net 27 Jun '00

27 Jun '00

Dear friends: I'm running a Squid proxy server on a SuSE Linux box (6.3) which authenticates users against a NT primary domain controller. I've been asked to get accurate information on proxy usage based on users' ID. I've been trying "calamaris" for this task, but it seems unable to extract any info based on users (each line in the Squid logs includes the name of the user). Any idea of what's happening? Maybe should I use another software? Thanks in advance. -- | * * * * * * * * Marco Antonio Blanco | See the stars, they're shining bright (mablanco(a)earthling.net) | * Everything's alright tonight * | * * * * - M.L.Gore * *

2 1

Forwarded mail....
by Thomas Biege 27 Jun '00

27 Jun '00

Hi, here are the MD5 hash of the INN RPM for 6.1. AXP: 259a0ad4e170a4e2576b463603549fd5 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/inn-2.2.2-86.alpha.rpm i386: 34e505924919724d736481ec6b1cd017 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/inn-2.2.2-91.i386.rpm Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Re: [suse-security] qpopper and APOP (starting to bore, ah?!)
by rhoerbe＠netpromote.co.at 27 Jun '00

27 Jun '00

I had exactly the same experience with the update package for Suse 6.3. After I upgraded, Windows users where locked out, because their Netscape version support APOP. Mac users did not experience a problem, because the ydid not have APOP. (If this is an advantage, remains to be discussed :->) Rainer Simone Grabstein <gsimon(a)rocketmail.com> Sent by: suse-security-return-2003-rhoerbe=netpromote.co.at(a)suse.com 26.06.00 20:13 To: suse-security(a)suse.com cc: Subject: [suse-security] qpopper and APOP (starting to bore, ah?!) There has been a discussion (quite recently) about QPOP and APOP support, and the whole thing seemed to had been settled with the release of the "pop-2000.6.7-0.i386.rpm" package. Well, I confidently downloaded the above mentioned RPM and upgraded a server of mine. While tryng to create the /etc/pop.auth database, I was STILL getting that boring "unable to open POP authorization DB". After browsing through several newsgroup and mailing-list archives, I reached the conclusion that I *HAD* to upgrade to QPOP 3.02. Thus, I downloaded the sources from Qualcomm's site, compiled and - enough said - popauth worked seamlessly. Did anybody else have analogue experiences? (To Thomas Biege: did you have some positive feedback about SuSE's update?). __________________________________________________ Do You Yahoo!? Get Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Auditing software for Squid
by Bauer, Juergen 27 Jun '00

27 Jun '00

hi, try sqmgrlog, from http://www.ineparnet.com.br/orso/index.html . it generates "Squid utilization reports by userid or ip/name" i have never tested it with uids in the log file but it works perfect just for ip's. bye, jb -----Ursprüngliche Nachricht----- Von: mablanco(a)earthling.net [mailto:mablanco@earthling.net] Gesendet: Montag, 26. Juni 2000 13:47 An: suse-security(a)suse.com Betreff: [suse-security] Auditing software for Squid Dear friends: I'm running a Squid proxy server on a SuSE Linux box (6.3) which authenticates users against a NT primary domain controller. I've been asked to get accurate information on proxy usage based on users' ID. I've been trying "calamaris" for this task, but it seems unable to extract any info based on users (each line in the Squid logs includes the name of the user). Any idea of what's happening? Maybe should I use another software? Thanks in advance. -- | * * * * * * * * Marco Antonio Blanco | See the stars, they're shining bright (mablanco(a)earthling.net) | * Everything's alright tonight * | * * * * - M.L.Gore * * --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

qpopper and APOP (starting to bore, ah?!)
by Simone Grabstein 26 Jun '00

26 Jun '00

There has been a discussion (quite recently) about QPOP and APOP support, and the whole thing seemed to had been settled with the release of the "pop-2000.6.7-0.i386.rpm" package. Well, I confidently downloaded the above mentioned RPM and upgraded a server of mine. While tryng to create the /etc/pop.auth database, I was STILL getting that boring "unable to open POP authorization DB". After browsing through several newsgroup and mailing-list archives, I reached the conclusion that I *HAD* to upgrade to QPOP 3.02. Thus, I downloaded the sources from Qualcomm's site, compiled and - enough said - popauth worked seamlessly. Did anybody else have analogue experiences? (To Thomas Biege: did you have some positive feedback about SuSE's update?). __________________________________________________ Do You Yahoo!? Get Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/

1 0

[suse-security]: scanlogd
by Timo Schulz 26 Jun '00

26 Jun '00

Hi list, a few days ago, I portscan from a windoze client "MY" linux-box. But when I look for a scanlogd message, I can't find someone. So I take a look at the /var/log/messages file. There I found out, that the firewall blocks all unused ports ( of course ). But the scanner try also the open ports, like mail, ssh, ftp or www. Why scanlogd don't remember this and add a portscan to the logfile ? Thanks in advance. -- Two-a-Day at joesixpack.net www.freenet.de/joesixpack keyid BF3DF9B4

2 1

Re: [suse-security] permissions question
by Kurt Seifried 25 Jun '00

25 Jun '00

> There seems to be no way around using the immutable attribute. Yup. Anyways, one simpler method is to just remove r services, they are EVIL. Use the OpenSSH replacements. Also using PAM you could restrict which users have access to R services (gotta love PAM). Read Sysadmin in september to find out all about it =). > Eilert -Kurt

1 0

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 25 Jun '00

25 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

3 4

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 25 Jun '00

25 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

2 2

Firewall 1 version 4.1 on Suse
by Joop Boonen 25 Jun '00

25 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

1 0

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 24 Jun '00

24 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

1 0

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 24 Jun '00

24 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

1 0

gpg says it's a development version in SuSE 6.4
by Jurjen Oskam 24 Jun '00

24 Jun '00

Hi, I'm using SuSE 6.4, all patched up to the latest version. I'd like to use gpg, but it tells me this: joskam@calvin:~ > gpg -kv gpg: NOTE: THIS IS A DEVELOPMENT VERSION! gpg: It is only intended for test purposes and should NOT be gpg: used in a production environment or with production keys! gpg: Warning: using insecure memory! /home/joskam/.gnupg/pubring.gpg ------------------------------- pub 1024D/712ED616 2000-01-30 Jurjen Oskam <jurjen(a)stupendous.org> sub 1024g/245C5E07 2000-01-30 ... a stable version is out for quite some time now. Could that be fixed by somebody please? Thanks. -- Jurjen Oskam * ICQ 11573303 * http://www.stupendous.org/ for PGP key assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill president wall street ruin economy disrupt phonenetwork atomic bomb sarin nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-

1 0

Re: [suse-security] permissions question
by Eilert Brinkmann 23 Jun '00

23 Jun '00

Jens Kuehnel <king(a)kuehnel.org> wrote: > > > > can a root user create a file in a regular user's home > > > > directory so that the regular user can not remove it? > > Have a look at the directory-Mode. > Writing a directory means deleting and creating files. > Normaly the best thing is a t-bit like at /tmp. That won't work in this case. The owner of the directory (i.e., the regular user who should be the owner of his home directory) will still be able to delete files he doesn't own. And because he is able to change his home directory's permissions he even could simply clear the t-bit. Setting the immutable flag with chattr is the only possible solution. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

9 9

SuSE Security Announcement: inn
by thomas＠suse.de 21 Jun '00

21 Jun '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: inn 2.2.2 (and earlier) Date: Wed Jun 7 12:24:25 MEST 2000 Affected SuSE versions: 6.1-6.4 Vulnerability Type: remote news compromise SuSE default package: no Other affected systems: all unix systems using innd 2.x (x < 4) ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update it as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The Usenet News server innd does not check the size of a stack buffer, when verifying 'cancel requests'. This verification is not enabled by default (s. innd.conf, 'verifycancels' is set to 'fasle'). 2. Impact If the 'verifycancels' option in innd.conf is set to 'true', it will enable an attacker to remotely execute arbitrary code with the privileges of user news on the INN server. 3. Solution Update the package from our FTP server if you use 'verifycancels' option. (Pease note, that this option is not recommended by the innd maintainer and will also be removed in innd 2.4). ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: The i386 RPM for 6.1 will be released next week. (For SuSE 6.0, please use the 6.1 updates) AXP: 259a0ad4e170a4e2576b463603549fd5 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/inn-2.2.2-86.alpha.rpm 1a5ce9202c8be84034b1b29231a6def8 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/inn-2.2.2-86.alpha.rpm eb9126f54ce84976b3a70e1ba6d0ec33 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/inn-2.2.2-86.alpha.rpm i386: de109ff3db535715c16bf43554d480ce ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/inn-2.2.2-86.i386.rpm 9a74e82f9e8911372029aec87bde7692 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/inn-2.2.2-86.i386.rpm caac7436f8e4373880d369a640f52e5f ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/inn-2.2.2-86.i386.rpm PPC: a588c1b72a868a28d96f283163511451 ftp://ftp.suse.com/pub/suse/ppc/update/6.3/n1/inn-2.2.2-86.ppc.rpm 4a0e636a05c79e5810d7660af5be41bd ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/inn-2.2.2-86.ppc.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors ftp://ftp.suse.com/pub/suse/ppc/update for PPC processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOVDbBney5gA9JdPZAQGJlAf+KW4mZYRjb2jJq+Qn530tg5hY7qMwRGBK oaD/o/ncJGiDqX4RyYB6V55esUpDs2VCfKMGLCX3NH9s9S0iKknMJpEZZh1PKcv6 DFa+aOSx9KMqMI0xmIbYL+nBHqbeMNE9jPkMSs4ubz0IRwjUm8G8AOe49UI21Aa3 RDfnbsX2GwneGIZ6E9NzN4GoSeemlBRh+7zlHyCOXDqbzJLmpBOMy8RuS9Q3uzsI KrLu1NI6pb/r17CPtU9N2JYzxb7UZdPdq4sz26yOw+WuZ/uLNy5tdQBPbmbPzzpN 4YJS3DHXvPI8+4PHnC0YIMTLo5PZQfbkWyJQNRAeUryv11x1P2yduQ== =rdvQ -----END PGP SIGNATURE-----

1 0

Forwarded mail....
by Thomas Biege 20 Jun '00

20 Jun '00

Hi, the QPop RPMs for 6.1 (6.0) are available.... 0e2d6f49e4b246a2f737020b018de778 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2000.6.18-0.alpha.rpm 69739b549fcc564bf77afb54111d6ee9 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2000.6.18-0.i386.rpm Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Can Linux Protect ECommerce?
by Fred A. Miller 20 Jun '00

20 Jun '00

Can Linux Protect ECommerce? Is your free OS running servers for expensive ecommerce? In this live RoundTable discussion, you can ask the guest expert on SolutionCentral, Randy Thorburn of Knox Software, about robust data protection engines that live up to the Linux hype. http://www.solutioncentral.com/knoxdpe -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

2 1

permissions question
by alex medvedev 18 Jun '00

18 Jun '00

hallo, can a root user create a file in a regular user's home directory so that the regular user can not remove it? it does not seem to work... ----------------- start ------------------------------------ $ pwd /home/alexm $ id uid=1000(alexm) gid=100(users) groups=100(users) $ ls -l file1 -rwx------ 1 root root 0 Jun 17 14:35 file1 $ rm file1 rm: remove write-protected file `file1'? y $ ls -l file1 ls: file1: No such file or directory $ ------------------ end -------------------------------------- thanks, -alexm

5 4

SuSEfirewall for DEV_WORLD=eth1:0
by Winfried Trautsch 16 Jun '00

16 Jun '00

Hi, I'm running SuSEfirewall V2.0. One of my "DEV_WORLD"-devices is eth1:0, which is an alternate IP-Address for eth0. SuSEfirewall complaints about "no such command", obviously when executing FW_DEV_WORLD_eth1:0="62.153.66.51 255.255.255.248". What's wrong there? Regards - Winni -

4 6

[suse-security] Re: Qpop versions pre 2.53
by Carsten Tumma 16 Jun '00

16 Jun '00

--- Ruediger Oertel <ro(a)suse.de> wrote: > AFAIR it says: "user must agree to license prior to > installation", The licence in http://www.eudora.com/qpopper/license.html says "... and distribute unmodified complete copies of Qpopper to any third party provided that such third party must agree to these terms and conditions prior to any use of Qpopper" - In my understanding this applies to unmodified copies of Qpopper and SuSE may use a different licence agreement for a modified version (see section 4e of the licence). - Does the term "prior to any use" include the installation of Qpopper or just the execution of the program? I'm german and not very familiar with U.S. legal affairs. BTW: What are the advantages of Qpopper 3.x excpet for the fixes regarding the vulnerabilities which have already been applied to Qpopper 2.53 by SuSE? Regards, Carsten Tumma __________________________________________________ Do You Yahoo!? Send instant messages with Yahoo! Messenger. http://im.yahoo.com/

2 1

Qpop versions pre 2.53
by bolo＠lupa.de 16 Jun '00

16 Jun '00

Hi, we are concerned about some security issues of the program Qpop which is part of the "pop" package of serial n1. Until SuSE 6.2 Qpop 2.53 has been part of this package which is infamous for some security holes, including the ability for remote users with a valid (mail-) account to gain access to the mail host via shell with GID "mail". This would allow r/w to all mail spools and more nasty things. The authors of Qpop state quite clearly on their website (www.eudora.com/qpopper/) that Qpop versions <= 3.0.x should _not_ be used in productive Linux environments because of the known bux. Will the package "pop" be updated accordingly? Regards, Boris Lorenz <bolo(a)lupa.de> (SysAd) --- Landwehr & Partner ---

5 5

Re: [suse-security] Qpop versions pre 2.53
by rhoerbe＠netpromote.co.at 16 Jun '00

16 Jun '00

1. I downloaded Qpopper 3.02 from www.eudora.com, but was not required to acknowledge any licence. So, there might be a difference between the licence text and actual practice by qualcomm. 2. Thomas, you listed "patch" and "drop" as only options. But wouldn't it be an option to include qpopper 3.02 in series "commercial software". Or anything, which is not installed by default, but a user could install manually. 3. As I understand from Qualcomm's release notes, V 3.02 does not only fix known security deficiencies, but lines up new defenses agains buffer overflow exploits. Hence it should be inherently more secure than Suse's patched 2.53. Although I acknowledge your efforts to fix qpopper 2.53, you should make it clear to users, that this is not the technically best solution. Brgds Rainer Thomas Biege <thomas(a)suse.de> Sent by: suse-security-return-1955-rhoerbe=netpromote.co.at(a)suse.com 15.06.00 18:53 To: bolo(a)lupa.de cc: suse-security(a)suse.com Subject: Re: [suse-security] Qpop versions pre 2.53 Hi, On Thu, 15 Jun 2000 bolo(a)lupa.de wrote: > Hi, > > we are concerned about some security issues of the program Qpop which is part > of the "pop" package of serial n1. Until SuSE 6.2 Qpop 2.53 has been part > of this package which is infamous for some security holes, including the > ability for remote users with a valid (mail-) account to gain access to the mail > host via shell with GID "mail". This would allow r/w to all mail spools and > more nasty things. > > The authors of Qpop state quite clearly on their website > (www.eudora.com/qpopper/) that Qpop versions <= 3.0.x should _not_ be used in > productive Linux environments because of the known bux. > > Will the package "pop" be updated accordingly? AFAIK does the eudora license deny us to ship qpop 3.x. So, we have two options: 1) patch it 2) drop it. We patched 2.53, so all known bugs were fixed. You could use _our_ 2.53 update or install qpop 3.x from eudora. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] SuSEfirewall for DEV_WORLD=eth1:0
by Samartha 15 Jun '00

15 Jun '00

I have not read thru the whole thread - but I just ran the firewall. In my FW_DEV_WORLD, I have "eth0 eth0:1 eth0:2" which works just fine. Maybe it's redundant - but there is the firewall script in /sbin/SuSEfirewall which deals with the FW_DEV_WORLD around line 260. This script parses the variables set from /etc/rc.config.d/firewall.rc.config and executes ipchain commands to set the filter rules. what you can do is to set a "set -x" in that script to get an execution trace or (what I would do) - take the chunk of code, put it in a file, replace, assign values from the firewall.rc.config and run it with dummy commands. As an example, I set up a similar script for the FW_REDIRECT_TCP to figure something out - but I got it to work without it, but you may get the idea: FW_REDIRECT_TCP="4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" for i in $FW_REDIRECT_TCP; do PARAMS=`echo $i | $AWK 'BEGIN {FS=","} \ {printf ( "-s %s -d %s %s -j REDIRECT %s", $1, $2, $3, $4) }'` test -z "$LAC" || $IPCHAINS -A input -p tcp $PARAMS -y $LAC echo IIII -A input -p tcp -b $PARAMS $LAA done the echo IIII replaces the ipchains command and of cause, you would need to set the AWK=awk and IPCHAINS=ipchains to make it run. maybe it helps, Samartha At 12:05 AM 6/16/00 +0200, you wrote: * Gerhard Sittig wrote on Mon, Jun 12, 2000 at 22:11 +0200: > On Mon, Jun 12, 2000 at 20:41 +0200, Winfried Trautsch wrote: > > Escaping the colon is not sufficiant (especially when you don't > know how many times the parameters get passed down the chain from > the rc.config(?) parameter bundle to the shell assigning the > value and evaluating it -- how is the variable's name > generated?).

1 0

re: [suse-security] Re: Kernel 2.2.16 as sprm /rpm
by Bauer, Juergen 14 Jun '00

14 Jun '00

hi, in spite of these 'issues', will suse provide new sources or not ??? bye, jb Hi, On Fri, Jun 09, Thomas Biege wrote: > > I have a question. I would like to know if kernel 2.2.16 will be > > available as rpm package? Can i download new kernels on the suse ftp > > site? It seems that the is a security hole in kernel 2.2.15 <= see: > > http://www.sendmail.net/?feed=000607linuxbug > > I think it'll be available today... stay tuned and watch out for an > advisory or check our ftp servers. 2.2.16 still has issues... > Bye, > Thomas -o) Hubert Mantel Goodbye, dots... /\\ _\_v --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

SuSE 6.4 SSH?
by Phillip Beal 13 Jun '00

13 Jun '00

Hey, I have a question about the SuSE 6.4 ssh rpm. I know from isupport(a)suse.com that it is version 1.2.27. Which if built against rsaref libs can have a major security flaw. So my question is, was the SuSE 6.4 SSH 1.2.27 rpm built against rsaref? Thanks, -- Phillip Beal Evil Genius In Training Electrical and Computer Engineering "God, Root, what is difference?" S+LUG Vice-President -Userfriendly.org GPG Key fingerprint = 3335 BF29 5180 42DF D7BB 484C 78E0 B0F3 6FB9 81D0

2 3