January 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSE Firewall
by jan.meyer 30 Jan '01

30 Jan '01

> What you need to do is "reverse" Masquerading. This can be accomplished > with the IPMASQADM tool included on your SuSE CD. Two questions: Do I have to patch my 2.2.17 (not SuSE)Kernel to get IPMASQADM to work ? Does it work with the SuSE Kernel ? thanks... jan meyer

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Nix 30 Jan '01

30 Jan '01

No. AFAIK (I'm sure someone will correct me if I'm wrong) djbdns does the same thing as bind in that it will hand you an ip that is on the same subnet as one of it's interfaces if that's the interface the request came in on. Neither djbdns or BIND can possibly do BGP based handout of IP's because it requires special code running on each of your servers in the BGP mesh.. NOT just on the DNS server. That's why I said dents ALONG WITH supersparrow!!!! -Nix At 05:45 AM 31/01/2001, you wrote: >You mean like "pickdns is a load-balancing DNS server." and >"pickdns can return results that depend on the location of the >client." functionality? > > > BIND (or DJBDNS) does not have the flexibility to do this sort > > of thing. > >Sorry, the above citation is from the dnscache doc as of half a >year ago (dnscache is the former name of djbdns) ... --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Stefan Suurmeijer 30 Jan '01

30 Jan '01

Hi all, I haven't seen this on SuSE yet, so I thought I'd forward it. It seems almost every nameserver we have running is vulnerable. See: http://www.cert.org/advisories/CA-2001-02.html have fun upgrading :-( Stefan

11 14

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Kurt Seifried 30 Jan '01

30 Jan '01

>>That's real useful for end users :P. Wietse (postfix guy) was smart, 100% >>compatible sendmail replacement, both in functionality and license. Qmail is >>NOT. Neither is djbdns a drop in replacement for Bind. Hence only a minor >>percentage of people will make the effort to use it. > >Why is "drop-in-replacement"==GOOD and "no drop-in-replacement"==BAD? >I don't agree there. It's not that the programs are hard to install or >something. On the contrary, IMHO. Sendmail, ok, cleaned up a lot in the last two years, BUT if there is a hack it's usually root, for example the kernel capabilities bug. To get users to switch to a more secure mailer you have a few realistic options: make it the default - Mandrake now does this with Postfix. They do not ship Qmail. Vince (mandrake security packager goombah guy who writes their advisories and whatnot, who I drink with sometimes) tried valiantly to legally package qmail and ship it and gave up. Buy him a drink sometime and ask him about it if you want to hear a painful story. if it's hard to do people will not switch to it. Hell people won't even patch software or apply vendor security updates in a lot of cases, so what are the chances of them switching from say sendmail to qmail, if it requires a lot of effort? This is why compatibility (function wise, license wise, etc.) is so important. >Again, I don't agree. There are boatloads of enhancements and >modifications for qmail (and less so for djbdns, but that doesn't >exist as long). If you want a specific feature that isn't in standard >qmail/djbdns, there most probably is a patch that you can apply in >seconds. Again, very easy. Ohh, so if I go out of my way to fix qmail, it can do function X, whereas that is standard in Postfix for example (and then there are things postfix does that qmail can't, even with available patches, like regex filtering). That's like saying "Windows isn't insecure, if you get these security products and apply them it's secure". No, Qmail, as it ships from DJB, is a pain in the ass :P. I've tried to move to it several times (long ago), and tested it more recently, and I've never liked the results (and I get paid to spend my time on things like this). -Kurt

3 2

Firewall + Dial-in
by Mark Robinson 30 Jan '01

30 Jan '01

Hi all, I have a slight problem with the SuSE Firewall package. I have set up a server that has ippp0 as the internet i/f, and eth0 as the lan. Everything works fine with the setup. But (there's always a but) I have now added a modem to the box to allow remote user/admin. I've used mgetty and pppd to successfully set up the dial-in, and everything works ok to get connected. The problems are as follows: Once connected to the dial-in modem I can access mail (smtp and pop3) on the server. Samba lets me log in and maps drives as expected, and I can browse the internet. However I cannot ssh to the server, VNC won't connect and I can't ping any box on eth0. If I stop the firewall everything starts working! I can't work out why the firewall should have this effect. Please help before I lose all my hair :-) Mark

1 0

bind8
by Roman Drahtmueller 30 Jan '01

30 Jan '01

Hi, just a short heads-up: The bind8 packages for the distributions 6.1-7.1 are being built as I write this email. The packages should be available two or three hours. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSE Security Announcement: kdesu
by Sebastian Krahmer 30 Jan '01

30 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: kdesu Announcement-ID: SuSE-SA:2001:02 Date: Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 3 SuSE default package: yes Other affected systems: All KDE 1 & KDE 2 systems Content of this advisory: 1) security vulnerability resolved: kdesu problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information kdesu is a KDE frontend for su(1). When invoked it prompts for the root password and runs su(1). kdesu itself does not run setuid/setgid. However when enabling the 'keep password' option it tries to send the password across process boundaries to kdesud via a UNIX socket. During this it does not verify the identity of the listener on the other end. This allows attackers to obtain the root password. This bug has been fixed in the update packages by checking the ownership of the socket on the listener side. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1: ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu-0.98-187.i386.rpm 3d51f84f2dc87916bc937f3afe507c1a SuSE-6.1: ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu.rpm 3d51f84f2dc87916bc937f3afe507c1a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/kdesu-0.98-187.src.rpm f8764afd475fa7a41c18603d15ce48ab SuSE-6.2: ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu-0.98-187.i386.rpm 027617e19c957b1ed5f42f140b62521b SuSE-6.2: ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu.rpm 027617e19c957b1ed5f42f140b62521b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/kdesu-0.98-187.src.rpm 9cf3d4b0c00db4598968dd5c7e07eef7 SuSE-6.3: ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu-0.98-187.i386.rpm d2b6c6f3330a20c2eb7d5500de2f9df6 SuSE-6.3: ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu.rpm d2b6c6f3330a20c2eb7d5500de2f9df6 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/kdesu-0.98-187.src.rpm a50cc8ba1a793f9151559454fdad0a14 SuSE-6.4: ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu-0.98-187.i386.rpm 8f06dd49bdc00dca25eff33a3754ddee SuSE-6.4: ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu.rpm 8f06dd49bdc00dca25eff33a3754ddee source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/kdesu-0.98-187.src.rpm 0ca2d30cf51d1307f88581d4e240bbf0 SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu-0.98-187.i386.rpm c7238ea5775939239b3857b550ca9f1b SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu.rpm c7238ea5775939239b3857b550ca9f1b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/kdesu-0.98-187.src.rpm bc74c75ba0b514f7df4f0250ccc7454a Sparc Platform: AXP Alpha Platform: SuSE-6.1: ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu-0.98-187.alpha.rpm 8017cd7fed463cae4bef3fa471e7e1d8 SuSE-6.1: ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu.rpm 8017cd7fed463cae4bef3fa471e7e1d8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/kdesu-0.98-187.src.rpm 78846e4ae3f50e9264e8840da1a628a8 SuSE-6.3: ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu-0.98-187.alpha.rpm cf1629ba236c0c84e0f2b33101b5f1aa SuSE-6.3: ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu.rpm cf1629ba236c0c84e0f2b33101b5f1aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/kdesu-0.98-187.src.rpm da851ebaee36cb91cb1e1fca0c8bfda2 SuSE-6.4: ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu-0.98-187.alpha.rpm d1904cc9db320ea2c576b73633ee6bd5 SuSE-6.4: ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu.rpm d1904cc9db320ea2c576b73633ee6bd5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/kdesu-0.98-187.src.rpm 27261cf8ff0ea66a597520260b832f7d SuSE-7.0: ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu-0.98-187.alpha.rpm be3b258eeeb3c56351b93ec8a32826db SuSE-7.0: ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu.rpm be3b258eeeb3c56351b93ec8a32826db source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/kdesu-0.98-187.src.rpm b7e3139377784c5cbbc4f14a5061d124 PPC Power PC Platform: SuSE-6.4: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu-0.98-187.ppc.rpm 705afa4defc64c48f89dd94b2d52c296 SuSE-6.4: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu.rpm 705afa4defc64c48f89dd94b2d52c296 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/kdesu-0.98-187.src.rpm 32e626fa7e8206d6803957c77062185b SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu-0.98-187.ppc.rpm e9b4a8a26844af0bc8cb37c8d2d26530 SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu.rpm e9b4a8a26844af0bc8cb37c8d2d26530 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/kdesu-0.98-187.src.rpm aaa092ffafe149ef8ba3acf570966e09 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Kmail remote code execution. This issue will be adressed in following advisories. - pgp4pine bufferoverflow. Very unlikely to be exploited, but next advisories will contain information on this as well as URL's for patches. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOnLxI3ey5gA9JdPZAQGh/Qf+MoBq8Ys7ANMtnSg9mKVLxA7HXSM5DPVP lM4zFFJwyU8b/DBNfEHYPwDwNeAxeHtjMbpYbWt2zos2dVsz9caFOZznBRjM9hlF AhGMzXjTus+qfVoothlsMfVGvV3xOqbbIjdiUZChiULe8/Bm+YDmD2y9fkquxD+Z dmoY9yOaQ2bSjT8a1Gyin04Jew/uFyAroNmaAn1XDPGqXPq9EIXJz8gWigqDLwe+ Qfcizp9picMLnfEipGtCARP2/my53hp+2JwGy78E+lf7EZrhq0wlJ5nELQUdvYyA Y6aOEVq349q6Q5QeMF9ABfpyKPbmUXwkzzXTtMwdmYKoKtu6cUEThQ== =YAhD -----END PGP SIGNATURE-----

1 0

Fw: [COVERT-2001-01] Multiple Vulnerabilities in BIND
by Kurt Seifried 30 Jan '01

30 Jan '01

Someone mentioned suse shipped 8.2.3-T5 >From the advisory: > o Vulnerable Systems > > BIND 8 versions: 8.2, 8.2.1 > 8.2.2 through to 8.2.2-P7 > 8.2.3-T1A through to 8.2.3-T9B > > BIND 4 versions: buffer overflow - 4.9.5 through to 4.9.7 > format string - 4.9.3 through to 4.9.5-P1 As for suse being a bit slow they aren't as bad as some, not as good as other, but do tend to get it right more often the first time then quite a few. Also I believe they are gearing up for a new release. -Kurt - who spent the morning upgrading servers to 8.2.3. wheeep.

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Kurt Seifried 30 Jan '01

30 Jan '01

>>DNSSEC. > >Vapour. Doesn't exist at this time. (for use on the Internet) >Will be implemented in djbdns when the infrastructure to support it is >set up. That's odd... since .mil is rolling it out, and I know other people using it. >>Plus DJB's license sucks ass, it's almost impossible for vendors to ship his >>software, and for developers to work on it, > >This is something I can understand. For distributors, it *is* nearly >impossible to ship, and modifying and redistributing isn't allowed. >Distributing patches however, is. >This means you'll (as a sysadmin) will have to download and install >djb-ware yourself. I don't have a problem with that, personally. That's real useful for end users :P. Wietse (postfix guy) was smart, 100% compatible sendmail replacement, both in functionality and license. Qmail is NOT. Neither is djbdns a drop in replacement for Bind. Hence only a minor percentage of people will make the effort to use it. >qmail might indeed be getting a bit old, but there are many >improvements available. (but I thought we were discussing BIND here >:-) ) The same thing will happen to djbdns ultimatwly, since the only person that really does any work on DJB's software is DJB. -Kurt

4 3

Ramen Virus
by Paul Carruthers 30 Jan '01

30 Jan '01

has anyone heard anything about this ? What should I watch out for ? Paul Carruthers Systems Administrator Avellino Technologies Voice +44 (0) 118 940 7600 Fax +44 (0) 118 940 7699 Http://www.avellino.com/

3 2