February 2001 - openSUSE Security - openSUSE Mailing Lists

strange file in /usr/bin
by Jan Räther 02 Feb '01

02 Feb '01

Hi there, i found a strange looking file in my /usr/bin directory... The file is called: 5n0r7. I'm running SuSE Pro 7.0. Maybe this is a trojan/backdoor program? I portscanned my machine with nmap and found Port 20011 open... Does anybody know about such an trojan? thanks, Jan [?][!] newtention technologies gmbh // rathausallee 72-76 // 22846 norderstedt mailto: jan(a)newtention.de // http://www.newtention.de phone: 040-5 54 45 89 - 3 // mobil: 0178-4777948 // fax: 040-5 54 45 89 - 9 ----- party, n.: A gathering where you meet people who drink so much you can't even remember their names.

2 2

hello there i have some very primitive questions
by rene marhold 02 Feb '01

02 Feb '01

Hi there whats the best way to protect an whole net with 10 IP-Adresses, without privace them all?? Especially i want to protect some Webservers, I dont know how to make the routing and firewalling the net with ipchains Is the only way with advanced routig, or is there another way thx DJMAD ---------------------------------------------------------------------------- *hehe* [1]+ Done ls $LS_OPTIONS >/dev/sda [2]+ Done ls $LS_OPTIONS >/dev/sdb [3]+ Done ls $LS_OPTIONS >/dev/hda [4]+ Done ls $LS_OPTIONS >/dev/hdb *all done ready to reboot :-)* ----------------------------------------------------------------------------

3 2

Re: [suse-security] Porn/Xrate-Filter
by Volker Kuhlmann 02 Feb '01

02 Feb '01

Or what to do with a home networking setup and the kids... > >we use "squid" as proxy with stopword list's. Our list is about 350 line > >long. One approach. The bad news is, they all don't work. It is impossible to automatically do a linguistic analysis and decide which sites are junk. People can get very irate when good discussions about sexuality are blocked! This is just one example. You will find more than your software will ever be able to handle. Filtering by URL doesn't work either. For detecting URLs to blacklist see above. There is commercial software about, but it all sucks. See the example of cyberpatrol: it was proven(!) that they generate their blacklists automatically, badly, and black out a large amount of valid sites as well as missing junk ones. Waste of money. Btw filtering by URL is easily circumvented: use a URL-anomymiser/redirector. There goes that idea. > Problem: how to keep that list updated? Precisely. Forget it. > reffering to that, a teacher I know keeps a very pragmatical and > practical method of doing this: With the help of his pupils. > Checking squid's logfiles, new sites are frequently added to the black > list. *laugh* do the pupils know about their help? :-) > Any other ideas around? None which are practical, except for this, but that isn't going to be easy: > But never forget to solve the problem of pornsite surfing in school at > the roots. An the roots are the pupils, and not the net. Can't fix a social problem with blacklists... My EUR0.02 Volker

2 1

Re: Juergen - I'm still stuck Re: [suse-security] (cross-posted) [SLE] my apsfilter environment messed up
by dproc＠dol.net 02 Feb '01

02 Feb '01

On Thu, 01 Feb 2001, juergen.braukmann(a)ruhr-west.de wrote: > dproc(a)dol.net wrote: > > > > Is it ok to copy this mail to the list? > > Yes. I don't mind. ;-) > > > > > On Wed, 31 Jan 2001, juergen.braukmann(a)ruhr-west.de wrote: > > > > > > > > Spontanously, I would have given the same answer than that kind soul. > > > Btw., rc.config uses a variable that tells wether a2ps or -I think > > > enscript- is used. I could print, but nothing in ascii mode. I've been > > > searching a week. (/etc/rc.config is sourced by apsfilter. *CRAP*!) > > > > My rc.config doesn't have such a variable, and is not > > sourced by apsfilter. Maybe you have a different version of > > apsfilter - mine is called S.u.S.E.-1.6 and comes from the > > 6.3 distro. > > yes. I've been a bit quick with that. This "feature" appeared in 7.0 > > > (rc.config is sourced by /sbin/init.d/lpd from plp on my > > system, but as init runs as root that works fine.) > > > > yes. that is OK. > > > > > > To use the debug mode is a good idea. The next thing I'd check are > > > permissions on these commands. I do not think head, tr, tail, grep and > > > cut are harmful, but... > > > Check also the path permissions to these commands. Keep in mind that > > > running SuSEconfig will reset these permissions, you need to set them in > > > /erc/permissions.local. > > > > My permission checks follow: > > > chmod g+ -v / > > mode of / retained as 0755 (rwxr-xr-x) > > > chmod g+ -v /usr > > mode of /usr retained as 0765 (rwxrw-r-x) > > > chmod g+ -v /usr/bin > > mode of /usr/bin retained as 0755 (rwxr-xr-x) > > > chmod + -v /usr/bin/head > > mode of /usr/bin/head retained as 0755 (rwxr-xr-x) > > > > These look ok to me. > > > > I then rewrote apsfilter a little. I substituted the full > > path /usr/bin/head for head. Now the log message changes to > > > > /var/lib/apsfilter/bin/stc600p.upp-letter-auto-color-720: > > /usr/bin/head: Permission denied > > I would have tried that too. > > > > > Finally I looked at > > > chmod + -v apsfilter > > mode of apsfilter retained as 0755 (rwxr-xr-x) > > > > I think the change from 'command not found' to 'Permission > > denied' tells me something, but I am not sure what. > > > > yes. It reminds me of a mounted CD with the -heck- user ? mount option > that includes the "noexec" option. With other words, also you see the > exec flag, excecuting is not permitted. > That would mean you won't be able to execute these commands from the > shell too. Beiing under /usr it would hit the entire partition as well > as the user root. With that my thought is a dead end too. ;-( > > In the end, I believe it's something stupid easy, but I am at my wit's > end. <sorry for the long quote, this thread continued off list for a while> Here are my mounts > less /etc/fstab /dev/hda6 / ext2 defaults 1 1 /dev/hda7 /usr ext2 defaults 1 2 This is what root looks like: drwxr-xr-x 21 root root 1024 Aug 4 2000 . drwxr-xr-x 21 root root 1024 Aug 4 2000 .. drwxr-xr-x 3 root root 1024 Jan 31 1999 .kde -rw-r--r-- 1 root root 135 Mar 27 1999 DIRLIST drwxr-xr-x 2 root root 1024 Jan 31 1999 S.u.S.E. -rw-r--r-- 1 root root 82019 May 16 1999 System.map -rw-r--r-- 1 root root 128530 May 16 1999 System.map.old -rw-r--r-- 1 root root 128530 Jan 30 1999 System.old drwxr-xr-x 2 root root 1024 Aug 5 2000 bin drwxr-xr-x 3 root root 1024 Aug 6 10:47 boot drwxr-xr-x 2 root root 1024 Apr 2 2000 cdrom lrwxrwxrwx 1 root root 8 Apr 30 2000 data -> usr/data drwxr-xr-x 6 root root 30720 Jan 31 17:34 dev drwxr-xr-x 34 root root 8192 Feb 1 00:00 etc drwxr-xr-x 2 root root 1024 Apr 2 2000 floppy lrwxrwxrwx 1 root root 10 Apr 1 2000 home -> /data/home drwxr-xr-x 5 root root 2048 Jan 27 08:43 lib drwxr-xr-x 2 root root 12288 Mar 27 2000 lost+found drwxr-xr-x 12 root root 1024 Jun 24 2000 mnt lrwxrwxrwx 1 root root 7 Apr 30 2000 opt -> usr/opt dr-xr-xr-x 71 root root 0 Jan 28 14:12 proc drwx--x--x 18 root root 2048 Jan 31 22:43 root drwxr-xr-x 5 root root 3072 Jan 22 21:18 sbin lrwxrwxrwx 1 root root 9 Apr 1 2000 src -> /data/src drwxr-xr-x 3 root root 1024 Sep 8 1998 suse drwxrwxrwt 32 root root 27648 Feb 1 21:05 tmp drwxrw-r-x 31 root root 1024 Aug 6 15:44 usr drwxr-xr-x 19 root root 1024 Sep 10 23:07 var -rw-r--r-- 1 root root 386579 May 16 1999 vmlinuz -rw-r--r-- 1 root root 386577 May 16 1999 vmlinuz.old drwxr-xr-x 2 root root 1024 Jan 30 1999 windows just for kicks, > df Filesystem 1k-blocks Used Available Use% Mounted on /dev/hda6 202182 161346 30396 84% / /dev/hda7 4307040 2718844 1365296 67% /usr /dev/hda2 7525 3431 3693 48% /boot /dev/hda4 2007840 16896 1990944 1% /mnt/fat and finally, swanage:~ # rpm --verify gs_both swanage:~ # rpm --verify aps S.5....T /var/lib/apsfilter/apsfilter swanage:~ # rpm --verify plp S.5....T c /etc/printcap swanage:~ # and finally, I gave lp a login bash shell, did # su -l lp and tried, lp@swanage:~ > which head /usr/bin/head lp@swanage:~ > head car car ball cat ball cat lp@swanage:~ > grep tree car fish tree tree ball lp@swanage:~ > /var/lib/apsfilter/apsfilter ... and the script ran without stupid errors interactively. lp@swanage:~ > /usr/lib/apsfilter/bin/apsfilter ... and again ok I know there are subtle differences in the environment+privileges of a script called from a daemon versus one called from a prompt by 'su -l lp' but I haven't found documented what they are or how they are influenced. Pointers ?? I am so embarrassed to be doing this, I am glad I used a pseudonym. Yours, dproc

1 0

Fwd: kyxspam: isc loses mind
by Nix 01 Feb '01

01 Feb '01

Sorry guys, I don't normally re-post/forward things between mailing lists, but I think this is a reasonable rant, that everyone should read. I apologise to those people who have already received this from BugTraq. (Everyone on this list SHOULD be on BugTraq, but I know that is not the case) This is related to the previous thread re DJBDNS and BIND. (I still maintain that people should take a look at http://www.dents.org and help out with the coding if they have the ability. As soon as we see a nice stable, GPL'd alternative to BIND, the better) Cheers Nix >Date: Thu, 1 Feb 2001 05:03:14 -0800 >From: Dragos Ruiu <dr(a)KYX.NET> >Subject: kyxspam: isc loses mind >To: BUGTRAQ(a)SECURITYFOCUS.COM > >The recent vulnerabilities in BIND must have overlooked one >flaw amongst that extensive list that makes every version deployed on >the planet vulnerable, the flaw that makes the ISC bind oversight committee >crash, coredump and lose its mind with this new, for-pay, "leet" bind >vulnerability list. Never mind the politics surrounding the issue that in part >that bind development was paid for with public funds - or that they link to >GPL libraries that might technically GPL it. This bind $cabal$ idea is just >broken as long as none of us have any choice but to run bind if we want >to use the internet. > >Considering that the only other credible alternative to bind that I've found, >djb-dns, has a ridiculously restrictive license that will essentially bar it >from _ever_ being distributed by others, that leaves the entire internet >in the >unenviable position of relying on a dubious piece of software, managed in a >dubious fashion, as a single monoculture point of failure (there is NO >alternative!). This is a critical issue that should be of concern to anyone >that relies on the Internet for _anything_. > >Addressing assignment, the BGP routing table, and DNS are the glue that holds >the Internet together... hell, they ARE the Internet. And to have the entire >Internet running on one (hideously twisted and ugly to boot) piece of code, >waiting to blow up, like the mother of all single points of failure, is >ridiculous. The latest batch of vulnerabilities should be example enough that >it _will_ blow up. I'm morbidly almost wanting someone to write the >killer DNS >worm and take down the _entire_ Internet in one fell swoop just to prove the >point. (Or waiting for the first script kiddy that DoSses 13 servers and locks >up every computer on the planet...) > >The world desperately needs one or more decent alternatives (several would >be better, but at this point I would be happy with even one, credible, >widely deployed, alternative) just to remove this single point of failure. > >As far as for-pay vulnerability lists for that single point of failure.... >Hmmm... do you mean that all it will cost me is a few bucks spent on a cabal >membership and I can have a big head start on exploiting any new DNS bug and >thereby facilitating 0wn1ng every host on internet before anyone has any >chance >to fix things or even know they're vulnerable(so that they can take _some_ >sort >of precaution if possible)? Cool, buy the entire internet all for one >low, low, >price.... where do I sign up? Oh that's right, I can't. I guess I just >have to >be content with "bind-members" owning all my machines... :-( BTW As an aside I >think that if such a group ever actually forms, we'll likely see a backlash >response of one of the most systemic, wide-spread, attacks against the whole >DNS system ever seen, as they elevate themselves to the juiciest single >hacker >target in human history... > >Sorry for the strong words, but the ISC is fucked up, apparently. But I >should >have guessed that when I first (tried to) read the later versions of bind >source >(with apologies to Bill Norton the original project manager for that >development). I just had to be slapped in the face with it again, repeatedly, >to wake up to this harsh reality. Someone, please, tell me there is an another >alternative - because with the direction it's headed now, the Internet >based on >bind isn't looking like it's going to be a very good, reliable, or secure, >network. > >regrets, >--dr > > > To: bind-announce(a)isc.org > > Subject: PRE-ANNOUNCEMENT: BIND-Members Forum > > Date: Wed, 31 Jan 2001 09:36:02 -0800 > > From: Paul A Vixie <Paul_Vixie(a)isc.org> > > X-Approved-By: Ruth.Anne.Ladue(a)nominum.com > > X-original-sender: Paul_Vixie(a)ISC.Org > > X-List-ID: <bind-announce.isc.org> > > X-DCC-MAPS-Metrics: isrv3.isc.org 668; IP=0/633557 env_From=0/3494 > > From=0/3451 Subject=0/3451 Message-ID=0/3453 Received=0/3453 > > Body=0/3451 Fuz1=0/3451 > > > > ISC has historically depended upon the "bind-workers" mailing list, and > > CERT advisories, to notify vendors of potential or actual security flaws > > in its BIND package. Recent events have very clearly shown that there is > > a need for a fee-based membership forum consisting only of: > > > > 1. ISC itself > > 2. Vendors who include BIND in their products > > 3. Root and TLD name server operators > > 4. Other qualified parties (at ISC's discretion) > > > > Requirements of bind-members will be: > > > > 1. Not-for-profit members can have their fees waived > > 2. Use of PGP (or possibly S/MIME) will be mandatory > > 3. Members will receive information security training > > 4. Members will sign strong nondisclosure agreements > > > > Features and benefits of "bind-members" status will include: > > > > 1. Private access to the CVS pool where bind4, bind8 and bind9 live > > 2. Reception of early warnings of security or other important flaws > > 3. Periodic in-person meetings, probably at IETF's conference sites > > 4. Participation on the bind-members mailing list > > > > If you are a BIND vendor, root or TLD server operator, or other interested > > party, I urge you to seek management approval for entry into this > forum, and > > then either contact, or have a responsible party contact, isc-info(a)isc.org. > > > > Paul Vixie > > Chairman > > ISC > >-- >Dragos Ruiu <dr(a)dursec.com> dursec.com ltd. / kyx.net - we're from the >future >gpg/pgp key on file at wwwkeys.pgp.net or at http://dursec.com/drkey.asc > >http://cansecwest.com >CanSecWest/core01: March 28-30, Vancouver B.C. ------------^ >Speakers: Renaud Deraison/Nessus Attack Scanner, Martin >Roesch/Snort/Advanced IDS, > Ron Gula/Enterasys/Strategic IDS, Dug Song/Arbor Networks/Monkey in the > Middle, > RFP/Whisker2.0 and other fun, Mixter/2XS/Distributed Apps, Theo > DeRaadt/OpenBSD, > K2/w00w00/ADMutate, HD Moore/Digital Defense/Making NT Bleed, Frank > Heidt/@Stake, > Matthew Franz/Cisco/Trinux/Security Models, Fyodor/insecure.org/Packet > Reconaissance, > Lance Spitzner/Sun/Honeynet Fun, Robert Graham/NetworkICE/IDS > Technology Demo, > Kurt Seifried/SecurityPortal/Crypto: 2-Edged Sword, Dave > Dittrich/UW/Forensics, > Sebastien Lacoste-Seris & Nicolas Fischbach/COLT > Telecom/Securite.Org/Kerberized > SSH Deployment, Jay Beale/MandrakeSoft/Bastille-Linux/Securing Linux --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

problems updating bind on 6.2
by V. Regina Kappes 01 Feb '01

01 Feb '01

Hi, when I tried to update bind on a SuSE 6.2, using rpm -Uhv bind8-8.2.3-0.i386.rpm I got the message: failed to open //var/lib/rpm/packages.rpm I had a look, there is a file /var/lib/rpm/packages.rpm. Is it a problem of the package that looks for a non-existing Path? Greetings Regina

2 1

AW: [suse-security] MS proxy NTLM
by Stiefenhofer, Marek ECOFIS 01 Feb '01

01 Feb '01

The source of NTLM was never made public - so far no known browser except IE has the capability to authenticate via NTLM. As far as I know, the only chance you have is to ask the proxy-admin, whether he'll change to clear-text authentication. Regards, Marek -----Ursprüngliche Nachricht----- Von: Marten Brinkman [mailto:martenbrinkman@hotmail.com] Gesendet am: Donnerstag, 1. Februar 2001 15:39 An: suse-security(a)suse.com Betreff: [suse-security] MS proxy NTLM Hi there, Can anyone help me ? I am having a problem getting true to the internet with my browser. I am using netscape. I am behind a MS proxy server, wich is set to service only NTLM. Is there a solution to solv this problem. Perhaps there is a browser supporting NTLM besides the microsoft browsers. Thanx ! Marten Brinkman

2 1

Re: AW: [suse-security] MS proxy NTLM
by christian.burri＠synecta.ch 01 Feb '01

01 Feb '01

I can confirm that. NTLM stands for "NT Lan Manager" or something and means that it's some obscure m$ proprietary standard. I never came across any browser besides Internet Explorer to handle this form of authentication (its a challenge/response authentication method IIRC, but dont quote me on this; im not really sure...). Anyways...yeah...ask the admin to switch to basic-auth or, maybe more applicable, set up a SQUID cache that is allowed to bypass the MS Proxy. Instruct your non-NTLM-aware browsers to use the SQUID instead of the MS Proxy. HTH Chris Burri junior Network & Systems Engineer Synecta Informatik AG Zwinglistrasse 3, CH-9000 St. Gallen .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

1 0

updating bind8
by Daniel Quappe 01 Feb '01

01 Feb '01

hey list, maybe offtopic, but bind8-update-relevant for me: during updating my 6.1-system, rpm told me to install bindutil before updating to bind8-8.2.3-0. there is no bindutil on my old rpm-cd's and so i downloaded the bindutil-update from the suse-server. during checking the installation of bindutil with rpm, i was told that there are a lot of conflicts with my old, non-binutil-using bind8.1.x.x. now what is the most elegant way of updating? uninstall the old bind8.1.x.x (saving conf's etc) or forcing the rpm- command? thanks in advance and sorry for wasting security-related-bandwidth...;-) daniel

4 3

MS proxy NTLM
by Marten Brinkman 01 Feb '01

01 Feb '01

Hi there, Can anyone help me ? I am having a problem getting true to the internet with my browser. I am using netscape. I am behind a MS proxy server, wich is set to service only NTLM. Is there a solution to solv this problem. Perhaps there is a browser supporting NTLM besides the microsoft browsers. Thanx ! Marten Brinkman _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

1 0