December 2001 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Entriy in apache log
by Bitzer,Gerd 21 Dec '01

21 Dec '01

Hi, the nimda attackers in turn have kind of success in doing a kind of a DoS attack against this boxes. And how should this evergrowing blocking tables ever be cleared ... ? -----Ursprüngliche Nachricht----- Von: Markus Gaugusch [mailto:markus@gaugusch.at] Gesendet am: Freitag, 21. Dezember 2001 12:04 An: Bob B Cc: Rogier Maas; suse-security(a)suse.com Betreff: Re: [suse-security] Entriy in apache log > ok let me ask this first can i just have ipchains on the box without > changing and routig etc that is set now as i wouldnt want to make an > major overhaul! This is no problem, but the whole thing (blocking nimda "attacks" to your linux box) is really useless, as many have non-static ip-adresses and you will soon have a huge blocking table, which results in poor performance. If you have really too much entries in your logs (filling up the disks), clean them with a script that removes all those entries or contact the provider of the infected hosts. Blocking of huge address ranges doesn't solve any problems. Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

rc-pppoed installed - now problems with susefirewall2
by Web Hamster 21 Dec '01

21 Dec '01

hi list, i've just installed pppoed from roaring penguin and it works fine - since the susefirewall2's fw_masq_tcp does not :-( web-requests on port 80 are successfully routed through the box to my internal webserver and back, but other ports dont work (ftp on 21 e.g.) any more. nothing changed in firewall2.config. a clue? thanx in advance.

1 0

what hack is this and what to do against ?
by Walter Raboch 21 Dec '01

21 Dec '01

Hi folks, some of my servers where hacked the day before... i found some strange processes and some binaries changed and would like to know what hack or possible worm this is and what to do against - update which daemon/package ? files changed or created: -rwxr-xr-x 1 root root 60296 Dez 20 20:37 /bin/netstat -r-xr-xr-x 1 root root 32756 Dez 20 20:37 /bin/ps -rw------- 1 root root 512 Dez 20 21:37 /bin/.s -rw------- 1 root root 526 Dez 20 20:37 /bin/hk -rw------- 1 root root 512 Dez 20 20:37 /bin/s -rw-r--r-- 1 root root 673 Dez 20 20:37 /bin/sc -rw-r--r-- 1 root root 880 Dez 20 20:37 /bin/ssc -rwxr-xr-x 1 root root 207272 Dez 20 15:44 /usr/bin/afb -rwxr-xr-x 1 root root 111 Dez 20 20:37 /usr/bin/hdp -rwxr-xr-x 1 root root 5008 Dez 20 20:37 /usr/bin/sn i found some scripts here: ./usr/src/wsx ./usr/src/wsx/flood ./usr/src/wsx/mass-scan ./usr/src/wsx/parser ./usr/src/wsx/cleaner ./usr/src/wsx/sz ./usr/src/wsx/tcp.log i found this process: 30056 ? S 0:01 /usr/bin/./afb -f /bin/sc -q -p 55001 -h /bin/hk my maschine is still running at Suse 6.2 since its a production machine some hundred kilometers away from me, so i cant just drive there making an update before Jannuary... so i apreciate any info to stabilize it until then... hope you can help me... thx in advance Walter Raboch

2 1

rp-pppoed installiert - jetzt problem mit susefirewall2
by Hans Müller-Weidemann 20 Dec '01

20 Dec '01

hi liste, nachdem ich mir den pppoed von roaring penguin installiert habe geht das fw_masq_tcp der susefirewall2 nicht mehr korrekt. webanfragen auf port 80 werden erfolgreich auf einen intern maskierten rechner umgeleitet. das ganze funzt aber nicht mit anderen ports, z.b. ftp 21 etc, was aber vorher ging. habe nichts an der firewall2.config gedreht. eine ahnung? thx!

1 0

Classical DOS attack on Linux
by martin＠as3-1-1.hn.g.bonet.se 20 Dec '01

20 Dec '01

The infamous book "Unix Hater's Handbook"xi gives the following example of a simple DoS attack (using recursion): #!/bin/sh $0 & exec $0 The author continues: "once they (these attacks) are launched, the only way to regain control of your Unix system is by pulling the plug beacuse no one can run the ps command to obtain the process numbers of the offending processes... No one can even run the su command to become Superuser!... And best of all, any Unix user can launcg this attack." I thought that this type of problems were fixed in Linux (by limiting child processes etc) and I think that I tested this variant some years ago and the system refused to "go down". I therefore got an unpleasant surprise When one of my students run the following variant while true ; do sleep 5000 & echo "sleep" done and got the system on it's knees. I tested the "Hater" variant and it "worked" too. The error message given from the system when running the sleep variant was: Too many open files in system cannot redirect standard input from /dev/null: Too many open files in system ./testsleep: /bin/sleep: Too many open files in system The "classical" script gives similiar messages. The kernels tested are 2.2.19 and 2.4.10-25 and both give the same result. Something for the kernel people to consider???!!! Best regards Martin F

8 11

ssh in SuSE 7.2
by Jörg Marten 20 Dec '01

20 Dec '01

Hello, I am using SuSE 7.2 and the ssh-version "ssh-1.2.27-280" that comes along with it. As far as I know, there was no update up to now for it (in SuSE 7.2). My problem/question is, that i have been told, that all versions of ssh lower than 1.2.32 are insecure due to a bug found on 8.2.2001. I am wondering, if the ssh ("ssh-1.2.27-280" e.g. lower than 1.2.32) of SuSE 7.2 might be insecure? I hope, the patches indicated by "-280" fix the problem. Is that the case? For help/explanation thankfull, Jörg Marten

3 2

AW: AW: [suse-security] Linux distributions and /bin/login overfl ow ( fwd)
by Bitzer,Gerd 20 Dec '01

20 Dec '01

Hi Roman, thanks for this clarification :-) -----Ursprüngliche Nachricht----- Von: Roman Drahtmueller [mailto:draht@suse.de] Gesendet am: Donnerstag, 20. Dezember 2001 13:16 An: Bitzer,Gerd Cc: 'Steffen Dettmer'; SuSE-Security Betreff: Re: AW: [suse-security] Linux distributions and /bin/login overflow ( fwd) > > I have issued this question a few days ago, short after this topic was > posted on CERT. The only response from Suse until this moment was, that they > will investigate wether this weakness is relevant for Suse Linux or not (or > did I miss the reply ?) > > So again, is Suse Linux vulnerable for this remotely exploitable buffer > overflow attack ? It's not. I've said that we look into it and as long as you don't hear from us, it's not vulnerable (the probability that the code in question is faulty is/was very small). Here is my reply from very early in the morning / late in the night to bugtraq: From: Roman Drahtmueller <draht(a)suse.de> To: bugtraq(a)securityfocus.com Date: Thu, 20 Dec 2001 06:21:10 +0100 (MET) Subject: Re: Linux distributions and /bin/login overflow > Hello, Hello, too! [...] > It seems that while Redhat Linux and Caldera Linux > distributions are immune to the recent /bin/login > environ overflow, other Linux distributions are not. > Several Linux distributions install /bin/login with > SysV login options enabled. > > Slackware 8.0 and lower [tested with 8.0, 4.0, 3.3] > has SysV options enabled with /bin/login and is > vulnerable. > > SuSE 6.1 has SysV options enabled with /bin/login and > is vulnerable. I don't have a newer SuSE release, so > others will need to verify. It would seem logical that > SuSE 8.3 still includes the SysV login options > enabled, and is probably vulnerable as well. While it still may be a bad idea for a whole variety of reasons, the sole fact that some implementations of /bin/login allow for environment to be passed on to the shell after authentification does not mean that the program is vulnerable to the problems as discovered with the SysV derived implementations. To be more precise (grep the source for the word "disaster" to find the spot): The login programs in SuSE 6.0 and 6.1 gladly pass on environment specified as silence login: draht variable=value Password: up to a maximum number of 32 variables. If the args to the user name do not contain a "=" character, the arguments will show up in the environment as $L1, $L2, ... where arguments are seperated by whitespace and ",". An overflow does not happen, or please prove me wrong. For the login programs in SuSE distributions before and including 6.1 there is no such thing as "SysV login options enabled". Environment passing is a non-configurable feature. The SuSE Linux distributions 6.0 and 6.1 were the last ones without PAM'ified authentification schemes. All newer distributions use PAM authentification modules that do not pass on environment as specified on the user input prompt (user + password prompting happens beyond the scope of the login program). SuSE Linux users who use a distribution before 6.4 are greatly encouraged to upgrade to a new release since distributions before SuSE Linux 6.4 have been discontinued a long while ago. > Other distributions should be checked as well. A > quick way to check for SysV option capabilities is to > type "login", then enter "root testenv1=test" at the > login: prompt. Supply your root passwd, and look for > "testenv1" in the output of set. If it's set, then > your copy of /bin/login supports SysV options.....and > is probably vulnerable. Follow similar procedure to > find overflow possibility/specifics ;) > > > Regards, > > Anton Rager > a_rager(a)yahoo.com Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

1 0

AW: [suse-security] Linux distributions and /bin/login overflow ( fwd)
by Bitzer,Gerd 20 Dec '01

20 Dec '01

Hi, I have issued this question a few days ago, short after this topic was posted on CERT. The only response from Suse until this moment was, that they will investigate wether this weakness is relevant for Suse Linux or not (or did I miss the reply ?) So again, is Suse Linux vulnerable for this remotely exploitable buffer overflow attack ? --------- Hi, This mail was published on Bugtraq. I cannot confirm the issue on SuSE 7.0, but I have some elder versions running but not tested. Is this issue limited to console access? It seems that SSHD does not UseLogin by default. It seems a local privilege problem, is that correct? Do I have to worry? Can the SysV options disabled in some config file? Thank you! oki, Steffen ----- Forwarded message from Anton Rager <a_rager(a)yahoo.com> ----- X-AntiVirus: scanned for viruses by AMaViS 0.2.0-pre6 (http://aachalon.de/AMaViS/) X-Note: Not addressed to me personaly. X-Note: Free (web) email service used. From: Anton Rager <a_rager(a)yahoo.com> To: bugtraq(a)securityfocus.com Subject: Linux distributions and /bin/login overflow Date: Wed, 19 Dec 2001 15:04:59 -0800 (PST) Hello, It seems that while Redhat Linux and Caldera Linux distributions are immune to the recent /bin/login environ overflow, other Linux distributions are not. Several Linux distributions install /bin/login with SysV login options enabled. Slackware 8.0 and lower [tested with 8.0, 4.0, 3.3] has SysV options enabled with /bin/login and is vulnerable. SuSE 6.1 has SysV options enabled with /bin/login and is vulnerable. I don't have a newer SuSE release, so others will need to verify. It would seem logical that SuSE 8.3 still includes the SysV login options enabled, and is probably vulnerable as well. Other distributions should be checked as well. A quick way to check for SysV option capabilities is to type "login", then enter "root testenv1=test" at the login: prompt. Supply your root passwd, and look for "testenv1" in the output of set. If it's set, then your copy of /bin/login supports SysV options.....and is probably vulnerable. Follow similar procedure to find overflow possibility/specifics ;) Regards, Anton Rager a_rager(a)yahoo.com __________________________________________________ Do You Yahoo!? Check out Yahoo! Shopping and Yahoo! Auctions for all of your unique holiday gifts! Buy at http://shopping.yahoo.com or bid at http://auctions.yahoo.com ----- End forwarded message ----- -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Linux distributions and /bin/login overflow (fwd)
by Steffen Dettmer 20 Dec '01

20 Dec '01

Hi, This mail was published on Bugtraq. I cannot confirm the issue on SuSE 7.0, but I have some elder versions running but not tested. Is this issue limited to console access? It seems that SSHD does not UseLogin by default. It seems a local privilege problem, is that correct? Do I have to worry? Can the SysV options disabled in some config file? Thank you! oki, Steffen ----- Forwarded message from Anton Rager <a_rager(a)yahoo.com> ----- X-AntiVirus: scanned for viruses by AMaViS 0.2.0-pre6 (http://aachalon.de/AMaViS/) X-Note: Not addressed to me personaly. X-Note: Free (web) email service used. From: Anton Rager <a_rager(a)yahoo.com> To: bugtraq(a)securityfocus.com Subject: Linux distributions and /bin/login overflow Date: Wed, 19 Dec 2001 15:04:59 -0800 (PST) Hello, It seems that while Redhat Linux and Caldera Linux distributions are immune to the recent /bin/login environ overflow, other Linux distributions are not. Several Linux distributions install /bin/login with SysV login options enabled. Slackware 8.0 and lower [tested with 8.0, 4.0, 3.3] has SysV options enabled with /bin/login and is vulnerable. SuSE 6.1 has SysV options enabled with /bin/login and is vulnerable. I don't have a newer SuSE release, so others will need to verify. It would seem logical that SuSE 8.3 still includes the SysV login options enabled, and is probably vulnerable as well. Other distributions should be checked as well. A quick way to check for SysV option capabilities is to type "login", then enter "root testenv1=test" at the login: prompt. Supply your root passwd, and look for "testenv1" in the output of set. If it's set, then your copy of /bin/login supports SysV options.....and is probably vulnerable. Follow similar procedure to find overflow possibility/specifics ;) Regards, Anton Rager a_rager(a)yahoo.com __________________________________________________ Do You Yahoo!? Check out Yahoo! Shopping and Yahoo! Auctions for all of your unique holiday gifts! Buy at http://shopping.yahoo.com or bid at http://auctions.yahoo.com ----- End forwarded message ----- -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

1 0

iptables + virtuell hosts
by brina30＠gmx.li 20 Dec '01

20 Dec '01

Hi list, does anybody know, if it is possible to make ip-tables rules with virtuell hosts? I'm not sure, but think I have read it ist not possible. Otherwise, is it possible to konfigure eth0 with 3 different IP? My problem is. that I have a firewall with iptables and 2 networkinterface. On is routing intern and the other is the outside interface. For the outside interface I have 3 static IP, because I want to map them to a smtp-server and a webserver. So I would appreciate it very much, if somebody could give me a hint, how to handle, with virtuell hosts or with 3 IP for eth0. Maybe I am on the wrong way. Thank your for answering Bye Brina -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2