March 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Sendmail SMTP AUTH / SSL
by Raffy 02 Apr '01

02 Apr '01

Hey list, On my box I have sendmail running. In order to use SMTP over SSL I run it with stunnel in inetd: smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp Further I configured sendmail to use SMTP AUTH. Everything works perfect. But: smpts is on port 465. I configured my clients such that they use that port. So far so good. But now port 25 can still be used to send email. I could block it at the firewall but then I am not able to receive email any more, because other mailservers are talking with me on that port. (right?) Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients should not be able to connect without SSL or SMPT AUTH! Thanks Raffy

19 31

Bind
by Hipolito A. Gonzalez M. 02 Apr '01

02 Apr '01

I upgrade to the new 8-8.2.3 bind version, but, every morning the daemon "named" is stop. Is any trying to hack me? I have and real ip and I'm making hosting. Thank you. In log nothing appear. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

3 3

iptables
by office＠tride.net 02 Apr '01

02 Apr '01

Hello list, does the SuSEfirewall-script support iptables? cu

3 2

bind-update-attempt
by Daniel Quappe 31 Mar '01

31 Mar '01

hi list, in the last weeks i often got the syslog-message that somebody wanted to update my bind-server for somedomain which was of course denied by my bind-system by default. but: are there any problems in the software i have to think about with regard to a worst case scenario...;-) many thanks in advance, bye daniel

3 3

suse enterprise server
by bacano 30 Mar '01

30 Mar '01

hi2all, Regarding the security applications and features included in suse enterprise edition, what it has more than the professional version? Will be available any upgrade from professional to enterprise edition? [ ]'s bacano

1 0

lockdsvc : invalid argument. when loading nfsserver in 2.4.2
by Avi Schwartz 30 Mar '01

30 Mar '01

When starting up the nfsserver under Kernel 2.4.2 I get the error message lockdsvc : invalid argument. Searching the Internet (thanks Google!), I found some messages in the linux-kernel mailing list that there is no need to start rpc.lockd from the init scripts any more when using rhe 2.4.X kernels as it is loaded automatically on mount. I commented out these line from /etc/rc.d/nfsserver: checkproc -n lockd || \ /usr/sbin/rpc.lockd and restarted the NFS server. The error is gone and so far everything seems to work. Two questions: 1) Am I inviting problems by commenting out these lines? Is there a security issue? 2) If they are no longer needed, could SuSE please fix the scripts. Thanks, Avi -- Avi Schwartz Get a Life, avi(a)CFFtechnologies.com Get Linux!

1 0

many nic's
by office 30 Mar '01

30 Mar '01

Hello, how many network cards can i put into my linux box for firewalling? cu

3 2

Re: [suse-security] Ports
by NightWatcher 29 Mar '01

29 Mar '01

On Thu, 29 Mar 2001, you wrote: > I am administering a system that needs access to certain ports, but I do > not want to restrict access to these ports for these programs. The ports > are 5555 and 7000. How do I do this do that it is still secure and won't > create any security holes. > > > thank you, > michael > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com well who do u want to have access to the host (all? or single ips?) when it are single ips u can use the ipchains -I input -p tcp-s thefromip -d yourinternetip portnumber -j ACCEPT and after that ipchains -A input -p -s 0/0 -d urip port -j REJECT.. then only the accepted ips can enter.. otherwise make sure u cant login to that port using telnet etc (like an ftp server wich u can access with telnet and then turn it off( www.dutchriot.com)) hope that u have something about it greetz remko (NightWatcher IRCop(a)irc.quicknet.nl) Security Admin / advisor -------------------------------------------------------

1 0

DNS and Firewall (again) !
by Diogo Bacelar Quintela 29 Mar '01

29 Mar '01

Hello List I have a small network base on private ips and have one masquerading server. I want to specify in TCP options on the other machines the gate way machine as a dns server also.. Some abstraction.. I used to have named doing name caching for that. However now I am trying to use SuSEFirewall (or even by hand) to do that work. I mean.. All trafic from internal machines to firewall 's dns port (53) be automatically redirected (and masqueraded) to one dns server of the ISP (or both of those..) I have a cable connection and a SuSE 7.1 FTP clean installation. I believe it is SuSEfirewall 4.3 and kernel 2.4.2.. Is it possible ? I've looked and firewall's config and there are two non matching option's : port redirection (No private ips) and local port redirection (doesn't work!) TIA Diogo Quintela /------------------------------------------------------------------ || Diogo Bacelar Quintela ||----------------------------------------------------------------- || diogo.quintela(a)netcabo.pt // dbq(a)rnl.ist.utl.pt ||----------------------------------------------------------------- || PGP Public Key || http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x2099755D \------------------------------------------------------------------

1 0

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 29 Mar '01

29 Mar '01

> AFAIK you should NEVER use a > proxy etc. on any firewall due to the buffer- > overflow-problem. sorry... > Huh? Get real, man, with that attitude you shouldn't connect anything to an untrusted network, as any application could be susceptible to buffer overflows. And check out the literature on firewalls whenever you have a bit of spare time, I recommend the 2nd edition of 'Building Internet Firewalls' by Chapman, Cooper and Zwicky. Most, if not all, of the firewall people prefer application layer gateways, aka application proxies, over packet filters when constructing firewalls. And I'd much rather have only one application, the proxy, to watch for a compromise than the entire number of client applications.. Cheers, Tobias

5 5

Kernel Backdoor (April Fool's joke)
by Roman Drahtmueller 29 Mar '01

29 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- To those involved in Linux security: The latest release of "Linux-Magazin", a monthly German magazine that focuses on Linux, contains an article by Mirko Dölle about security problems in the Linux kernel. In particular, the article argues that IP packets could be forwarded to the address 208.47.125.33 (there is a PTR record at gary7.nsa.gov, which has an A record back to the same address). Many German Linux users have been calling SuSE support to learn details on how to deal with this problem, not willing to believe that the article is an April Fool's joke on security. None of the claims are correct, which makes a kernel update unnecessary for this particular problem. Now, as inclined readers of security mailing lists may have noticed, there are indeed security problems in the Linux kernel. These problems are no backdoors of any kind, and they are not related to the article mentioned above. In addition, the known kernel security issues are not remotely exploitable, which means that local shell access is needed to take advantage of the weaknesses. The weaknesses allow for a local attacker to gain superuser access to the system. SuSE will provide update packages for the supported distributions 6.3, 6.4, 7.0 and 7.1 shortly that eliminate the known problems. The SuSE kernels are standard kernels, equipped with a set of patches that introduce drivers and many other enhancements to the standard Linux kernel. The update packages are currently being tested and will be available and announced as soon as possible. As an information for those who compile and install their own kernels: The freshly released Linux kernel version 2.2.19 fixes the known issues in the kernel. It should run smoothly on all 6.x SuSE Linux distributions, but please note that 2.2.19 requires update packages for the lvm and/or the raidtools (formerly mdutils) package if lvm (logical volume manager) or the software raid facility of the Linux kernel are used. The lvm package is available for download from our ftp server ftp.suse.com, the raidtools package will follow soon. Regards, Roman Drahtmüller, SuSE Security -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsM8uney5gA9JdPZAQGnRggAkh+oXciCyj07rUgi0YJ4DEQVYopJRZQw oYFcktCTC/CYXE42ZEkChlMO9UA2Op6kiFyqDnaIKo12C1555CxAJgjszQfAjPCe 1b2kxLNtY0GvibkFHjgJ5BLeh7rM3d7bMoA14HKSNXcHDQIuJEUD0Hh0ENe4fNng qfZNHsd2EIdkjN3ncuQGjqPvy5N+se145OrEUGsOFY5Xb1KajxJhd8SlJ8+VkjTA 5tRi4NvLUZqdk1eKPvcKSkIuuv/rmSSOBEASUr/dEmy4Z8guVNW3qP6jk4HtPjYp 23yTkhZDHaYpCC7S/gMoU3pSrre0nh51W6yQx1oBOqaWZJtLSUJ+2A== =RpeD -----END PGP SIGNATURE-----

1 0

Lion worm with SuSEfirewall blocked?
by Marko Kaening 29 Mar '01

29 Mar '01

Hi, at http://www.sans.org/y2k/lion_protection.htm one can read how to prevent Lion attack using ipchains. Is this already included in the SuSEfirewall 4.4? Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

2 1

Security updates and You
by Togan Muftuoglu 29 Mar '01

29 Mar '01

Hi, I might be wrong in jumping in making an assumption yet when I clicked the location mentioned in the message with the subject [suse-security] Lion worm with SuSEfirewall blocked? I out of curiosity cliked the link to the suse update site mentioned where I have been informed regarding teh apache update with security fix note. 1) Has there been a security announcement for that which I accidently did not noticed. If there was none the package is dated 21 st March meaning a week over so there is something missing. Or alternativle apache 1.3.17 is not vulnarable. 2) patches directory does not have anything regarding apache so if you do an update with YOU you will not get it. I though YOU was for security fixes Sorry if there had been an announcement an I have missed it -- Togan Muftuoglu

1 0

security checking daemons
by Morsal Roudbay 29 Mar '01

29 Mar '01

I have installed several security checking deamons that come with SuSE 7.0. Daily, weekly and monthly reports are all sent to root... Is it possible to somewhere change this setting so it's sent to an email account of mine? Thanks in advance.

3 2

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 29 Mar '01

29 Mar '01

> > However, of course you'll have programs running on the packet filter > > as well. First, there's the kernel. Then you've probably got syslogd > > and crond running. > > A DHCP client is more likely. I would not have crond, the only thing ... [large snip] Yeah, whatever. Those are good ideas, Mike, but my point was *that* he'll have software running on a packet filter, not *what* software that is exactly. That's an entirely different and rather large can of beans.. Cheers, Tobias

1 0

Re: [suse-security] dns zone x-fers on tcp 53
by Markus Gaugusch 28 Mar '01

28 Mar '01

> What is the reason for installing pri dns server in a self owned DMZ and sec > dns server at the isp? Convenience - you can manipulate the zones easier. > If the firewall ist not stateful this enables inet users to do dns > probes on tcp 53 and other worse things. why? you can block tcp port 53 for everyone except the ip of the secondary NS. bye Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 1

do these log entries document attacks?
by Christian Gorski 28 Mar '01

28 Mar '01

hallo friends of linux does anybody know what i´ve got here, where X.X.X.1 is the box which logs these messages? 1) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4586 X.X.X.1:27374 L=48 S=0x00 I=59472 F=0x4000 T=111 SYN (#42) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=60496 F=0x4000 T=111 SYN (#42) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=337 F=0x4000 T=111 SYN (#42) Mar 27 19:46:39 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=3921 F=0x4000 T=111 SYN (#42) Mar 27 19:46:39 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=6993 F=0x4000 T=111 SYN (#42) Mar 27 19:46:41 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4586 X.X.X.1:27374 L=48 S=0x00 I=18257 F=0x4000 T=111 SYN (#42) 2) Mar 27 20:26:44 linux kernel: Packet log: input DENY eth0 PROTO=17 212.93.208.240:28432 X.X.X.1:28431 L=29 S=0x00 I=44573 F=0x0000 T=119 (#42) Mar 27 20:26:44 linux kernel: Packet log: input DENY eth0 PROTO=17 212.93.208.240:28432 X.X.X.255:28431 L=29 S=0x00 I=45597 F=0x0000 T=119 (#42) 3) Mar 27 21:38:29 linux kernel: Packet log: input DENY eth0 PROTO=6 207.194.143.211:1002 X.X.X.1:111 L=60 S=0x00 I=38602 F=0x4000 T=49 SYN (#42) Mar 27 21:38:29 linux kernel: Packet log: input DENY eth0 PROTO=6 207.194.143.211:1006 X.X.X.255:111 L=60 S=0x00 I=38606 F=0x4000 T=49 SYN (#42) 4) Mar 28 02:17:11 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2712 X.X.X.1:53 L=60 S=0x00 I=34799 F=0x4000 T=46 SYN (#42) Mar 28 02:17:11 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2716 X.X.X.255:53 L=60 S=0x00 I=34843 F=0x4000 T=46 SYN (#42) Mar 28 02:17:17 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2712 X.X.X.1:53 L=60 S=0x00 I=36023 F=0x4000 T=46 SYN (#42) 5) Mar 28 08:36:18 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61465 F=0x0000 T=105 (#42) Mar 28 08:36:20 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61721 F=0x0000 T=105 (#42) Mar 28 08:36:21 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61977 F=0x0000 T=105 (#42) tia cg

4 4

dns zone x-fers on tcp 53
by Philipp Snizek 28 Mar '01

28 Mar '01

Dear list users, What is the reason for installing pri dns server in a self owned DMZ and sec dns server at the isp? If the firewall ist not stateful this enables inet users to do dns probes on tcp 53 and other worse things. Thank you all for a quick answer, Philipp

2 1

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 28 Mar '01

28 Mar '01

Re Daniel. > yes, your are right! getting compromised by a > client applications isn't good indeed...;-) > It sure ain't. :-) > but that wasn't my hint about this topic. > my idea is to separate your system into two > ones: > first you have a hardened firewall-system without > any programm running on it. > second there is a proxy-server behind the wall with > "your" application proxies. > So you mean a pure packet filter when you say 'hardened firewall-system'? I call that a packet filter. :-) Yes, it generally makes sense to have a packet filter as the point of entry to your network. However, there are a couple of possible architectures. Quoting from the book I named: 1. Single-box architectures: screening router, dual-homed host. 2. Screened host architectures 3. Screened subnet architectures 4. Architectures with multiple screened subnets: split-screened subnet, independent screened subnet 5. Variations on firewall architectures If what you're proposing is a packet filter up front and a proxy in the internal network, then you have a screened host architecture. A screened subnet architecture, in which the screened subnet is referred to as a DMZ, is more common in the corporate world. Most Linux home users use a single box, either as a screening router (if they only use ipchains) or, if they're running (some) proxies on the box, as something you could term a hybrid between a screening router and a dual-homed host, or a collapsed DMZ. The latter is the setup described by the initiator of this thread. It is stupid, yes, not to perform packet filtering on a proxy that is part of a firewall system, if you can. However, of course you'll have programs running on the packet filter as well. First, there's the kernel. Then you've probably got syslogd and crond running. Unless you're performing administration from the console only, you'll probably have sshd running. Cheers, Tobias

2 1

SuSE Security Announcement: joe (SuSE-SA:2001:09)
by Thomas Biege 28 Mar '01

28 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: joe Announcement-ID: SuSE-SA:2001:09 Date: Tuesday, March 27th, 2001 17.03 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 3 SuSE default package: yes Other affected systems: all system using joe Content of this advisory: 1) security vulnerability resolved: joe problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information A bug in joe(1), a userfriendly text editor, was found by Christer Öberg of Wkit Security AB a few weeks ago. After starting joe(1) it tries to open its configuration file joerc in the current directory, the users home directory and some other locations. joe(1) doesn't check the ownership of joerc when trying the current directory. An attacker could place a malicious joerc file in a public writeable directory, like /tmp, to execute commands with the privilege of any user (including root), which runs joe while being in this directory. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/joe-2.8-300.i386.rpm 3140f1eb79eb246ad98f7687de517371 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/joe-2.8-300.src.rpm 0c04bb25b8ae452f1fcdfe11af32e1b6 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/joe-2.8-304.i386.rpm 2a406de36322fc7bc28aaeca0bbdf54d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/joe-2.8-304.src.rpm 2aac0d130597d580d96c75d59397958c SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/joe-2.8-303.i386.rpm 348a5e4a981f76943c77431606e5c3b2 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/joe-2.8-303.src.rpm 9f938aa365460257baf56f5f92f565ee SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/joe-2.8-302.i386.rpm 236ec54a0251859e1c2c1fc4018b5dae source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/joe-2.8-302.src.rpm 49b638dd238cacc8e99048ee5a8024ea SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/ap1/joe-2.8-302.i386.rpm 094577b41a2ad5baa0d16f4d53378d0e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/joe-2.8-302.src.rpm 78333a2bac40b08db1e54ccaf1380caf SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/ap1/joe-2.8-305.i386.rpm 72fbb78af21f3878f1ae8b8bc87c96f4 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/joe-2.8-305.src.rpm b4fbe27a24bf66d60db45da3c3d13020 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/ap1/joe-2.8-290.sparc.rpm eeb78e413ee0b48d39ccdab29228ae80 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/joe-2.8-290.src.rpm f29199161ffd38f3f26c82b5d21ba89b SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/joe-2.8-292.sparc.rpm d1d70f58df37de53f05734d90be596fa source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/joe-2.8-292.src.rpm 45091ece9cb66e4f093d07b0386fd2b9 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/ap1/joe-2.8-296.alpha.rpm 85e609519bbfbbc0be5aec7b8de2dffc source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/joe-2.8-296.src.rpm ce623f8a73b1f6395eb9498324cc1e21 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/joe-2.8-293.alpha.rpm d930c6a2f0757f51f04409946f6152f8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/joe-2.8-293.src.rpm 0b20e5bd36f0feeaf78cb4815566e982 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/joe-2.8-293.alpha.rpm 6278e4dd4a42d4e091d1a08e3f617fa2 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/joe-2.8-293.src.rpm 88f428cc9c916b9159dfb54144c7802e SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/ap1/joe-2.8-295.alpha.rpm 3e531066b0495be2261f02ef2d4583f0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/joe-2.8-295.src.rpm 1d7796f1fad01365e40a944f0db84470 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/ap1/joe-2.8-272.ppc.rpm f11094b9f1afeb04786030e3a140ed03 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/joe-2.8-272.src.rpm 4058ea46c9d75976a24a6ac419fc19d5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/joe-2.8-274.ppc.rpm c385a2ca601cf9b01ad2d39433d6a872 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/joe-2.8-274.src.rpm b667ea68d356a9582d3696ad68869c69 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/joe-2.8-273.ppc.rpm 4f6c2c20e961aea4987381d12692af6c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/joe-2.8-273.src.rpm 8c3ebda871c54afc11a24d80d207c34e ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - Two bugs were found in the text editor vim. These bugs are currently being fixed. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsG6aney5gA9JdPZAQEkMAgAiLgKgaIQS9psq0wwl/RJDaXCKwopeKsx meuZexE+iBgCXEeDAYtsbUEgTtHfTZ7XO5VwsIfFD9r8yOoAxWUcCkmIHOTYlRF3 jC4BTN5PkhbY7JymlSaEIreEfgflNWfYY1soaUm0LYy6Q/jDvMYReMh7uiG3wpPw ja8wiLjJ+PZa7OqtCsk9zTLBmFeTHJJ0mYeiy8qD4xASUW+GY6qE9i9naYrZgN9L oEY6DrOy6RERh35+NKMaI21o+yULhxPcV1AUYUndyc4U3OQErNEoLdViU6F39KeB JA9sgxk8iMvtqEyyCWaWJyRahrzo05gBepjUy+DjTovmJGMOhR+VAg== =58ij -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: eperl (SuSE-SA:2001:08)
by Thomas Biege 28 Mar '01

28 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: eperl Announcement-ID: SuSE-SA:2001:08 Date: Tuesday, March 27th, 2001 16.00 MEST Affected SuSE versions: 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local and remote compromise Severity (1-10): 6 SuSE default package: no Other affected systems: all system using eperl package Content of this advisory: 1) security vulnerability resolved: eperl problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The ePerl program is a interpreter for the Embedded Perl 5 Language. It's main purpose is to serve as Webserver scripting language for dynamic HTML page programming. Besides this it could also serve as a standalone Unix filter. Fumitoshi Ukai and Denis Barbier have found several potential buffer overflows, which could lead to local privilege escalation if installed setuid (note: it's not installed setuid per default) or to remote compromise. There is currently no efficient measure against the security problems in the eperl perl interpreter other than not using or updating it. SuSE provides update packages for the defective software. SuSE Linux version before 6.3 don't include the eperl package. Download the update package from locations described below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d2/eperl-2.2.14-206.i386.rpm e613b06d47dcfb7bbcea8c3d0c0e678b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/eperl-2.2.14-206.src.rpm c58a95f3b8ae757ea4d72f3157e2ea62 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/d1/eperl-2.2.14-203.i386.rpm e66520cc0062e25495941542dd5b1f82 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/eperl-2.2.14-203.src.rpm 34d6682524154c9fb7b5fbec4f4ea82e SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/d1/eperl-2.2.14-203.i386.rpm 4b6a5a89899320a8eeb35c149ae111f5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/eperl-2.2.14-203.src.rpm 062b14716e52f2649f4380a6a6e4e7f9 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/d1/eperl-2.2.14-202.i386.rpm ba75d7f4a64329a3b5c324b3f0742575 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/eperl-2.2.14-202.src.rpm c7ae001d4668ba3a0524f94429b1e4e6 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/d2/eperl-2.2.14-193.sparc.rpm 9752f8b9df6ac1ffdc68cb4b552d6491 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/eperl-2.2.14-193.src.rpm f09a1ce9288c201ae63e193914fc84ce SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/d1/eperl-2.2.14-191.sparc.rpm 900eddc134215569fc88d11ce14c11f3 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/eperl-2.2.14-191.src.rpm 76aaa0efa8ae1c84b80201f73462fc26 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/d1/eperl-2.2.14-195.alpha.rpm d7b4be8d988f8cd501a33f9d2fb12a07 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/eperl-2.2.14-195.src.rpm b0379287f9078fcd244cc720fad92c4d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/d1/eperl-2.2.14-195.alpha.rpm 78241206bc1b3927effdb5b1aa4d0ed5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/eperl-2.2.14-195.src.rpm 325a04ec8c5c3da6b9c2fdf4e2c6c901 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/d1/eperl-2.2.14-194.alpha.rpm 88a09004e5c0c2e6174785207e111318 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/eperl-2.2.14-194.src.rpm a04cfa3e64aac49f6c148992e9a50189 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/d2/eperl-2.2.14-178.ppc.rpm 3e05c702aca97db476155054d113ff95 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/eperl-2.2.14-178.src.rpm 67849b0c1c053eca482508fe2eac3042 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/d1/eperl-2.2.14-177.ppc.rpm 35584e2f1bcebced98fad2ae241824da source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/eperl-2.2.14-177.src.rpm 98046dce35c4adfba57cc54c018376d7 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/d1/eperl-2.2.14-176.ppc.rpm 9c36bad7ec2e8f6c31307729c7d21bc8 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/eperl-2.2.14-176.src.rpm eeaf1144dd659fe13b6a943bf40bf65b S/390 Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/s390/update/7.0/d1/eperl-2.2.14-182.s390.rpm 416974a30c9c9e435e028f2807e15a51 source rpm: ftp://ftp.suse.com/pub/suse/s390/update/7.0/zq1/eperl-2.2.14-182.src.rpm b14c7d9cbb969cda54b0d9f599f1b5cc ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - Two bugs were found in the text editor vim. These bugs are currently being fixed. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsG3GXey5gA9JdPZAQGQtQgAmPBgkp8fCIbo0RJ+mJDa0Zx7W0N8S+Ba LP2tH/cXkW9QPUT5vh1mKbB+LsH6wuG/uv7NG0EMrYHcmy3UFBEFKel4XD4G8XNU BhAKegayEvjYH/OK8q8poVHYdvctrZ00LtfrW7IQkNfCXEVx0ByfaX5w/Qe/GQxQ MWlqdw2klUXpnYZnaYj7mMsdTrc6DrIGdL4uCWozdQcyxGLeh/mQArg4TEdpv7KT OW0LgDgZETo5akS/AwtZn3NE7rh+ZIAUAhPw8iUoK0k6RY+Z+RJa+QFQ+XXv7eHm EXUcUd0wY47j5CROk+g7WzYy92Vn6VVOY63pcbhiv4R8BuPM9WVWJw== =QNk3 -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Sytem Attack or ?
by Togan Muftuoglu 28 Mar '01

28 Mar '01

Hi everyone Receiving this from the snort can someone explain what the hell is going on I have and ADSL connection on eth1 with dhcp assigned Ip and the lan is on eth0 I am running the snort with -i eth1 as the Daemon with snort-lin defining the HOME_NET 192.168.1.0/24 and EXTERNAL_NET as 212.xxx.xxx.0/22 as outlined with the ifconfig eberything else is left as is. Help is appreciated Mar 27 18:11:49 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61018 -> 195.44.254.18:80 Mar 27 18:12:00 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:00 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:02 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:02 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:03 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:08 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:08 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:10 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61021 -> 205.188.245.116:80 Mar 27 18:12:10 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61021 -> 205.188.245.116:80 -- Togan Muftuoglu

3 2

Security when compiling App - when do u compile as root or a User
by Steven Thompson 28 Mar '01

28 Mar '01

Hi All When compiling Apps, under which user do you compile the App for security, that does not mess up your system. When do have to compile an App as root? Thanks in advance Steven

3 2

RE: [suse-security] portscannst from many ips to port 16110
by Lewe, Wolfgang 28 Mar '01

28 Mar '01

> Hi there > is there an new trojan whos listening to port 16110??? > > many portscanns at my side in the last two days Hi Rene, It have not to be an new trojan. It can be an older trojan mapped to the port 16110. Regards, Wolfgang

1 0

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 28 Mar '01

28 Mar '01

Hi Mike. > > Huh? Get real, man, with that attitude you shouldn't connect anything > > to an untrusted network > > the point is that even if someone exploits a firewall and got root > permissions this person must be the smallest possible threat to the > protected network. > Agreed. You try to reach that point using the principles of least privilege and defence in depth. > If you are logged in as root on a computer that acts as a firewall, > you must not find any way to exploit the internal network: > Let's say you shouldn't. It is impossible to prevent completely. One, perhaps the main point of defence in depth is to give the defender time to realize he's under (partially successful) attack and react to the threat. Firewalling isn't about complete prevention, that's fiction. It's about protection and buying the time you need to be able to protect the soft and juicy insides. > 1) there must not be a ftp client or other tools to download files to > that computer, > 2) there must not be access to a dns server mapping the protected > network thus one must browse the log files to get an idea of the > members of the internal network and make it as hard as possible to > browse files (no editor), > 3) all files should be read only or append only in multiuser mode so > the boot structure cannot be manipulated > 4) the firewall computer should not do anything but filter and > forward traffic > These points all make sense, but they're neither complete nor justified in all situations. > I do not know about squid, but I would put it on a computer behind > the firewall. Even for a 100Mbit network connection any old pentium > 100 (or mac, or sparc, or whatever) with some ram should be able > to handle maximum possible load without problems. Given the fact, > that such a computer will cost less than USD 100,-- so cost should > not be the reason not to have it! > What does your 'firewall' do? Is it a packet filter, perhaps using ipchains? All that does is look at TCP/IP header information. Any exploit against the squid daemon will work regardless of whether it is running on a separate box or the packet filter, provided they're configured the same way. There's no difference between being root on the packet filter or an internal machine with respect to the danger your internal network is in. The only thing that is more difficult if the squid box is internal is that you need to traverse the packet filter to reach the outside, but that's hardly a problem, since you need to allow that box to access 0.0.0.0/0, TCP ports 1-65535 anyhow, not knowing what ports the world's web servers listen on. It does make sense to place the proxy into a DMZ, either off of a third NIC of the packet filter or by using two packet filters, one in front of the proxy and one behind it, separating the DMZ from the Internet and the internal network respectively. It could also make sense to use a non-caching security proxy, such as http-gw from the TIS FWTK, in the DMZ and employ squid in the internal network only. Cheers, Tobias

1 0

DNS and Firewall
by Diogo Bacelar Quintela 28 Mar '01

28 Mar '01

Hello List I have a small network base on private ips and have one masquerading server. I want to specify in TCP options on the other machines the gate way machine as a dns server also.. Some abstraction.. I used to have named doing name caching for that. However now I am trying to use SuSEFirewall (or even by hand) to do that work. I mean.. All trafic from internal machines to firewall 's dns port (53) be automatically redirected (and masqueraded) to one dns server of the ISP (or both of those..) I have a cable connection and a SuSE 7.1 FTP clean installation. I believe it is SuSEfirewall 4.3 and kernel 2.4.2.. Is it possible ? I've looked and firewall's config and there are two non matching option's : port redirection (No private ips) and local port redirection (doesn't work!) TIA Diogo Quintela /------------------------------------------------------------------ || Diogo Bacelar Quintela ||----------------------------------------------------------------- || diogo.quintela(a)netcabo.pt // dbq(a)rnl.ist.utl.pt ||----------------------------------------------------------------- || PGP Public Key || http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x2099755D \------------------------------------------------------------------

1 0

portscannst from many ips to port 16110
by rene marhold 27 Mar '01

27 Mar '01

Hi there is there an new trojan whos listening to port 16110??? many portscanns at my side in the last two days

1 0

IPX firewalling
by nauber＠heidelberg.cs2-informatik.de 27 Mar '01

27 Mar '01

Hello, is it possible to have a firewall controlling both IP and IPX? IP is no problem (at least I think so :-) ), but can someone point me in the right direction to firewall IPX? I know there is nothing like this in the kernel, but is there some kind of program to controll IPX forwarding? TIA. Greetings, Stefan Nauber Administrator Cs2 Informatik GmbH Kurfürstenanlage 3 69115 Heidelberg Germany Tel.: +49 (6221) 6041-0 Fax : +49 (6221) 6041-50

2 1

IP & MAC Filtering
by Matthias Auchmann 27 Mar '01

27 Mar '01

Hi all ! I'd like to make firewall-filtering rules where only IP Packets pass through which meet the following criterias: 1) the IP Source address is in a certain range 2) the last hop (the hop I got the packet from) has to have a certain IP or MAC-address This way I could tell my Linux Box only to accept packages which come from my Cisco-Router (on the same LAN). Any ideas how to do that ? Any help would be appreciated. Greetz Matthias _____ Sent through Master Auchi Mail Systems <http://www.masterauchi.com> - powered by Linux

2 2

openssh new packages?
by Norbert Preining 27 Mar '01

27 Mar '01

Hi there! Is there already an update for the new openssh (2.5.2p2) version which includes various security fixes? Best wishes Norbert -- ciao norb +-------------------------------------------------------------------+ | Norbert Preining http://www.logic.at/people/preining | | University of Technology Vienna, Austria preining(a)logic.at | | DSA: 0x09C5B094 (RSA: 0xCF1FA165) mail subject: get [DSA|RSA]-key | +-------------------------------------------------------------------+

5 9

SUID/SGID after harden_SuSE
by Corvin Russell 27 Mar '01

27 Mar '01

Hello all, I have run harden_suse on my box, and answered "yes" to all its prompts. The following files are still suid/sgid: do all of them need to be? TIA Corvin + -rwsr-x--- 1 root audio 14880 Mar 22 05:34 /bin/eject + -rwsr-xr-x 1 root root 67236 Mar 22 03:51 /bin/mount + -rwsr-xr-x 1 root root 20908 Mar 22 03:52 /bin/ping + -rwsr-xr-x 1 root root 19636 Mar 22 04:04 /bin/ping6 + -rwsr-xr-x 1 root root 22594 Mar 22 03:51 /bin/su + -rwsr-xr-x 1 root root 34568 Mar 22 03:51 /bin/umount + -rwxr-sr-x 1 root shadow 10967 Mar 23 02:26 /opt/kde2/bin/kcheckpass + -rwxr-sr-x 1 root nogroup 82968 Mar 23 02:26 /opt/kde2/bin/kdesud + -rwxr-sr-x 1 root tty 3772 Mar 23 02:26 /opt/kde2/bin/konsole + -rwsr-xr-x 1 root root 5344 Mar 23 02:26 /opt/kde2/bin/konsole_grantpty + -rwsr-x--- 1 root trusted 15501 Mar 22 05:34 /sbin/cardctl + -rwxr-sr-x 1 root shadow 20261 Mar 22 03:50 /sbin/unix_chkpwd + -rws--x--x 1 root root 1773168 Mar 22 04:08 /usr/X11R6/bin/XFree86 + -rwsr-xr-x 1 root root 7560 Mar 22 04:08 /usr/X11R6/bin/Xwrapper + -rwxr-sr-x 1 root tty 95456 Mar 22 04:10 /usr/X11R6/bin/wterm + -rwxr-sr-x 1 root shadow 1119648 Mar 22 04:10 /usr/X11R6/bin/xlock + -rwxr-sr-x 1 root tty 276828 Mar 23 02:14 /usr/X11R6/bin/xterm + -rwsr-x--- 1 root trusted 35868 Mar 22 05:34 /usr/bin/at + -rwsr-x--- 1 root trusted 27032 Mar 22 05:34 /usr/bin/bing + -rwsr-xr-x 1 root shadow 34460 Mar 22 04:46 /usr/bin/chage + -rwsr-xr-x 1 root shadow 28184 Mar 22 04:46 /usr/bin/chfn + -rwsr-xr-x 1 root shadow 26000 Mar 22 04:46 /usr/bin/chsh + -rwsr-x--- 1 root trusted 22560 Mar 22 05:34 /usr/bin/crontab + -rwsr-xr-x 1 root shadow 18360 Mar 22 04:46 /usr/bin/expiry + -rwsr-x--- 1 root trusted 37076 Mar 22 05:34 /usr/bin/gpasswd + -rwsr-xr-x 1 man root 92512 Mar 22 03:50 /usr/bin/man + -rwsr-xr-x 1 root root 21432 Mar 22 03:51 /usr/bin/newgrp + -rwsr-xr-x 1 root shadow 26780 Mar 22 03:51 /usr/bin/passwd + -rwsr-xr-x 1 root root 15544 Mar 22 03:52 /usr/bin/rcp + -rwsr-xr-x 1 root root 11160 Mar 22 03:52 /usr/bin/rlogin + -rwsr-xr-x 1 root root 8304 Mar 22 03:52 /usr/bin/rsh + -rwsr-xr-x 1 root root 85432 Mar 22 03:53 /usr/bin/sudo + -rwsr-x--- 1 root trusted 8856 Mar 22 05:34 /usr/bin/ziptool + -rwsr-xr-x 1 root root 5856 Mar 22 03:50 /usr/lib/pt_chown + -rwxr-sr-x 1 root maildrop 77277 Mar 24 00:06 /usr/sbin/postdrop + -rwsr-s--- 1 root dialout 176288 Mar 22 05:34 /usr/sbin/pppd + -rwsr-s--- 1 root dialout 5324 Mar 23 02:40 /usr/sbin/pppoedsp + -rwsr-xr-x 1 root root 20408 Mar 22 04:04 /usr/sbin/traceroute -- Corvin Russell <corvinr(a)sympatico.ca>

3 2

RE: [suse-security] AW: Squid on Firewall?
by christian.burri＠synecta.ch 27 Mar '01

27 Mar '01

I must agree ;-) .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ "Reckhard, Tobias" To: SuSE <suse-security(a)suse.de> <Reckhard@sec cc: unet.de> Subject: RE: [suse-security] AW: Squid on Firewall? 27.03.2001 07:44 > AFAIK you should NEVER use a > proxy etc. on any firewall due to the buffer- > overflow-problem. sorry... > Huh? Get real, man, with that attitude you shouldn't connect anything to an untrusted network, as any application could be susceptible to buffer overflows. And check out the literature on firewalls whenever you have a bit of spare time, I recommend the 2nd edition of 'Building Internet Firewalls' by Chapman, Cooper and Zwicky. Most, if not all, of the firewall people prefer application layer gateways, aka application proxies, over packet filters when constructing firewalls. And I'd much rather have only one application, the proxy, to watch for a compromise than the entire number of client applications.. Cheers, Tobias --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

PHP.INI
by ralf.vroomen＠itplus.nl 27 Mar '01

27 Mar '01

Hello people of the list! Just a quick question here: To get BasiliX PHP based webmail (www.basilix.org) running on my SuSE 7 up-to-date box I have to set "safe_mode = Off" in my /etc/httpd/php.ini. Since this sounds like a security risk, is it really? Or doesn't it matter since I'm the only one using php pages and nobody has shell access etc. Thanx in advance and sorry for my poor english. -- Ralf Vroomen.

1 0

Suse SNORT rpm and new rules
by Togan Muftuoglu 26 Mar '01

26 Mar '01

Hi everyone, I have installed the snort.rpm from the 7.1 DVD however on the snort site I have found new rules. After I downloaded the rules file the way they are listed are different than the ones that were provided by the SuSE rpm. Forexample in suse there is a overflow-lib while I could not find the overflow.rules. Where does SuSE get the rules/libs so that When I add rules I will stay compatible in a future update -- Togan Muftuoglu

1 0

AW: Squid on Firewall?
by Philipp Snizek 26 Mar '01

26 Mar '01

> Hi list, and amar, from "Down Under" > > Amarendra GODBOLE wrote: > > > > On Mon, Mar 26, 2001, the greycells of Ron Perry expressed: > > > > > Hi All, > > > > > > Running squid on the firewall. External interface eth0 > > > > > > I've used this redirect before setting up any other chain. > > > This catches all internal traffic to port 80 and redirects to 3128 > > > > > > ipchains -A input -i ! eth0 -p tcp -s 0/0 -d 0/0 80 -j > REDIRECT 3128 > > > > > > It seems I still need to allow connections to port 80 > or/and 3128 from > > > the internal interfaces. > > > > Hi, > > > > AFAIK, the 'REDIRECT' option does not if you are using Squid to > > authenticate. Never checked this out. Raf ? > > > I'm not using squid to authenticate. > > I'm now thinking that I need to ACCEPT port 3128 before I REDIRECT to > port 3128. And the redirect 80 should not be ACCEPTED. > > Any comments? Yes. If you're not sure (as I'm not right now) try to log the packets by denying and logging the rules. messages and firewall logfiles will tell you what you have to do. You can also use tcpdump but better iptraf to analyze your problem. HTH Philipp > TIA > Ron > ronk(a)sunux.com.au >

2 3

SANS Global Incident Analysis Center > Lion Worm
by Joop Boonen 26 Mar '01

26 Mar '01

http://www.sans.org/y2k/lion.htm

2 1

ALERT! A DANGEROUS NEW WORM IS SPREADING ON THE INTERNET
by Fred A. Miller 26 Mar '01

26 Mar '01

ALERT! A DANGEROUS NEW WORM IS SPREADING ON THE INTERNET March 23, 2001 7:00 AM Late last night, the SANS Institute (through its Global Incident Analysis Center) uncovered a dangerous new worm that appears to be spreading rapidly across the Internet. It scans the Internet looking for Linux computers with a known vulnerability. It infects the vulnerable machines, steals the password file (sending it to a China.com site), installs other hacking tools, and forces the newly infected machine to begin scanning the Internet looking for other victims. Several experts from the security community worked through the night to decompose the worm's code and engineer a utility to help you discover if the Lion worm has affected your organization. Updates to this announcement will be posted at the SANS web site, http://www.sans.org -- -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

5 4

Question about SuSEfirewall 4.4
by Marko Kaening 26 Mar '01

26 Mar '01

Hi, the SuSEfirewall 4.4 seems to work fine with my dial-up connection. But there are still 2 things bothering me: 1) If I call openports then I get something like "ipchains returns errors, no default route defined?" or something like that. What did I wrong at that point? 2) On my comp I have only the start script phase 1/3 (close fw) installed and the stop script (stop fw), since the start 2/3 and 3/3 always throw 'failed' during booting. -> I still didn't get this: as long as I am not yet dialed-up to my provider, why should I call "SuSEfirewall start", meaning why to run those init scripts 2/3 and 3/3??? => As far as I can see everything works well just with half of the init scripts, because when I dial-up the ip-up script contains the necessary call of the firewall script, doesn't it!?! Please respond if I am wrong about that! Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

1 0

SNORT help
by jonathan 25 Mar '01

25 Mar '01

I would like to start using a network analyzer and I heard about snort. Could someone give some advise/opinion and maybe point me in the direction of documentation. I am currently only watching /var/log/messages, but would like to get a better handle on the traffic that is coming to/from my cable modem. TIA

3 2

iptables question
by jonathan 24 Mar '01

24 Mar '01

When I start iptables I get 14 lines of the following message. Iptables is working fine on the other machine, but this one is running 7.1. Could someone help me out here. TIA. iptables: No chain/target/match by that name

1 0

AW: [suse-security] ssh clients for not-so-common OS's
by Thomas Lamy 23 Mar '01

23 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Did you have a look at http://www.freessh.org/ ? Thomas > -----Ursprüngliche Nachricht----- > Von: Yuri Robbers [mailto:yuri@rulbii.leidenuniv.nl] > Gesendet: Donnerstag, 22. März 2001 23:30 > An: suse-security(a)suse.com > Betreff: [suse-security] ssh clients for not-so-common OS's > > > > Hi all, > > I hope this is not off-topic, since it despite being a > security question, > it is not directly SuSE-related. Please send your flames to > me and not to > the list if you think I should not have posted this. Anyway, > here goes... > > Sometimes I have to remotely log into a system (SuSE :o) of > mine from a > machine that doesn't come with ssh. That's why I tend to > carry ssh client > binaries for a number of OS's with me most of the time. I'd > like to add > some more of those to my collection. Does anyone know where > to find or how > to compile ssh binaries on any of these OS's: VMS, DOS, AmigaOS, > Acorn RISC-OS and Mac-OS? For VMS I would be interested in having > an ssh server > too... > > Thanks, > Yuri. > > -------------------------------------------------------------- > ------------ > Yuri Robbers phone : +31-71-527-4966 > > Leiden University fax : +31-71-527-4900 > > Institute for Theoretical Biology email : > robbers(a)rulsfb.leidenuniv.nl > Kaiserstraat 63 > > 2311 GP Leiden PGP 5.0 public key > available: > the Netherlands Check your favourite hkp > server. > -------------------------------------------------------------- > ------------ > > > -------------------------------------------------------------------- > - To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBOrrk0EJRmQkE7ThJEQL0bgCg2rfr5O6Wea2Sz2paHnV25nVf1lQAn1Te /7CMXaeAClvYxnlLpGHWgXTY =QZEp -----END PGP SIGNATURE-----

1 0

SuSE 7.0
by Yasholomew Yashinski 23 Mar '01

23 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just playing around with new SuSE 7.0 machine. Check out the default /etc/passwd: root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/bin/bash daemon:x:2:2:daemon:/sbin:/bin/bash lp:x:4:7:lp daemon:/var/spool/lpd:/bin/bash news:x:9:13:News system:/etc/news:/bin/bash uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash games:x:12:100::/var/games:/bin/bash man:x:13:2::/var/cache/man:/bin/bash at:x:25:25::/var/spool/atjobs:/bin/bash postgres:x:26:2:Postgres Database Admin:/var/lib/pgsql:/bin/bash lnx:x:27:27:LNX Database Admin:/usr/lib/lnx:/bin/bash mdom:x:28:28:Mailing list agent:/usr/lib/majordomo:/bin/bash yard:x:29:29:YARD Database Admin:/usr/lib/YARD:/bin/bash wwwrun:x:30:65534:Daemon user for apache:/var/lib/wwwrun:/bin/bash squid:x:31:65534:WWW proxy squid:/var/squid:/bin/bash fax:x:33:14:Facsimile Agent:/var/spool/fax:/bin/bash gnats:x:34:65534:Gnats Gnu Backtracking System:/usr/lib/gnats:/bin/bash adabas:x:36:100:Adabas-D Database Admin:/usr/lib/adabas:/bin/bash amanda:x:37:6:Amanda Admin:/var/lib/amanda:/bin/bash ixess:x:38:29:IXware Admin:/usr/lib/ixware:/bin/bash irc:x:39:65534:IRC Daemon:/usr/lib/ircd:/bin/bash ftp:x:40:2:ftp account:/usr/local/ftp:/bin/bash firewall:x:41:31:firewall account:/var/lib/firewall:/bin/false informix:x:43:34:Informix Database Admin:/usr/lib/informix:/bin/bash named:x:44:44:Nameserver Daemon:/var/named:/bin/bash virtuoso:x:45:100:Virtuoso Admin:/opt/virtuoso-lite:/bin/bash db2fenc1:x:46:46:DB2 Instance UDF user:/usr/lib/db2/db2fenc1:/bin/bash db2inst1:x:47:47:DB2 Instance main user:/usr/lib/db2/db2inst1:/bin/bash db2as:x:48:48:DB2 Administration:/usr/lib/db2/db2as:/bin/bash fnet:x:49:14:FidoNet:/var/spool/fnet:/bin/bash gdm:x:50:15:Gnome Display Manager:/var/lib/gdm:/bin/bash postfix:x:51:51:Postfix:/var/spool/postfix:/bin/false cyrus:x:96:12:User for Imapd:/usr/cyrus:/bin/bash nps:x:53:100:NPS admin:/opt/nps:/bin/bash skyrix:x:54:100:SKYRIX admin:/opt/skyrix/skyrix36:/bin/bash dbmaker:x:55:52:Dbmaker Database Admin:/usr/lib/dbmaker:/bin/bash fixadm:x:56:53:Linux Fincancial Suite Admin:/opt/fsuite/home/fixadm:/bin/ksh fib:x:57:53:Linux Fincancial Suite fib:/opt/fsuite/home/fib:/bin/ksh fixlohn:x:58:53:Linux Fincancial Suite fixlohn:/opt/fsuite/home/fixlohn:/bin/kshoracle:x:59:54:Oracle User:/opt/oracle:/bin/bash mysql:x:60:2:MySQL Database User:/var/mysql:/bin/false dpbox:x:61:56:DpBox User:/var/spool/dpbox:/bin/false ingres:x:62:3:Ingres DataBase administrator:/opt/tngfw/ingres:/bin/bash codadmin:x:63:58:Codine Administrator:/var/lib/codadmin:/bin/bash zope:x:64:2:Zope Server:/var/lib/zope:/bin/false nobody:x:65534:65534:nobody:/var/lib/nobody:/bin/bash Seems to me you'd want as few users as possible, why do they keep adding more? I don't have most of these applications even installed. At least they could create the account only if I installed that package. Cheers, - -- ..Yashy Never attribute to malice what can be adequately explained by Microsoft. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD4DBQE6upr5WUoaUM5QqOURAuseAJjf2OsmBjQLi6mL+Q/clZ1blpPXAKCjOtNS eYRWXOLWkTyD0B/LBwYAqw== =l+c+ -----END PGP SIGNATURE-----

1 0

Re: [suse-security] SuSE Security Announcement: nkitb/nkitserv
by Christopher Mahmood 22 Mar '01

22 Mar '01

>I send the file with a missing signature.. I'm very sorry. :-\ At least this (http://www.microsoft.com/technet/security/bulletin/MS01-017.asp) didn't happen ;) -- -ckm

1 0

7.1-i386-ftp
by Roman Drahtmueller 22 Mar '01

22 Mar '01

Hi together, The 7.1-i386-ftp version is out, finally. We've had problems with some packages before we could release it to the public. The 7.1 ftp version contains some newer packages than the CD version - the security updates have been merged as well as many many bugs have been squished. This time, the ftp version of the distribution is something special: For the first time, there is no seperate German/non-US and a US version any more. The international version contains all crypto packages that usually only the German distribution has. This has been made possible by removing all occurrences of patented cryptographical code and/or substituting it with free code. In the end, it turns out that we can live without commercial code... This particular circumstance leads to an easier update structure of the ftp servers: All 7.1 updates, all distributions, will be available on ftp.suse.com (which is located in Oakland, CA), none on ftp.suse.de (which is in Nürnberg, Germany). Also, not an "official" announcement: Efforts are underway to merge the ftp.suse.de update tree with the ftp.suse.com update tree for the older distributions, too. I'll publically announce it when it is getting time (and this will take some weeks...). Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

10 16

SuSE Security Announcement: pop (SuSE-SA:2001:06)
by Thomas Biege 22 Mar '01

22 Mar '01

Hi, I resend advisory SuSE-SA:2001:06, because of a wrong signature. -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: pop Announcement-ID: SuSE-SA:2001:06 Date: Wednesday, March 21th, 2001 19.19 MEST Affected SuSE versions: 6.1 Vulnerability Type: remote command execution Severity (1-10): 2 SuSE default package: no Other affected systems: all system using the pop package Content of this advisory: 1) security vulnerability resolved: imapd, ipop2d, ipop3d problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The eMail access daemons imapd(8), ipop2d(8) and ipop3d(8) of SuSE 6.1 are vulnerable to several buffer overflows. Due to a misconfiguration these vulnerbilities could be triggered remotely after a user had been authenticated. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2001.3.21-0.i386.rpm 1277deee87f3d1553ee18ae078d646aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/pop-2001.3.21-0.src.rpm ce326335b36e51b6a635b69fc0106911 AXP Alpha Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2001.3.21-0.alpha.rpm 33405d29e279795d99853a1235a821f9 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/pop-2001.3.21-0.src.rpm eecd7c9ac81397f9eb7b2bee01a0154d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e space´, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoom´. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - A new nkitb/nkitserv package will be availabe soon. This update adresses bugs in timed, in.ftpd. - New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOrpWCXey5gA9JdPZAQEyxwf+PEmG3VQd59s4IEkNpStXAH6cRqEIAIkh rKXcrukIiBWdj08uNLoiggEgzq7wyUKBQH3thCD3CkolpPM4ViZmiVLAr8uerTmx fP4Vd+m47VeYzcsdhRPPASpnVzgVHyLVxCiOKOM76QK1sOHZhf2jAzQEZbl9G1Mc Z2Jo+4tAtFUPxsp0IN9NmfDezGOLeuXH5eIyp+Sgpw1fMa6Mkpk+Eib6Dc0qnM4H JBqj1WBw539lD2wU8n4N4mM0YdUhzCx179vVJKf9C9XLPdFHUwuyDRR75M/lOH8U dC5eg3QVdDm4bUDxMyDbvJqfxFpzlRt6dsb/vDk7Q6Hepat3plXhdQ== =klWl -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: nkitb/nkitserv
by Thomas Biege 22 Mar '01

22 Mar '01

Hi, I send the file with a missing signature.. I'm very sorry. :-\ Damn, I need coffee... -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: nkitb/nkitserv Announcement-ID: SuSE-SA:2001:07 Date: Thursday, March 22th, 2001 19.06 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote denial-of-service Severity (1-10): 4 SuSE default package: yes: in.ftpd, no: timed Other affected systems: all system using in.ftpd (OpenBSD port) or timed Content of this advisory: 1) security vulnerability resolved: timed, in.ftpd problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Two parts of the nkitb/nkitserv package are vulnerable to security related bugs. in.ftpd(8): A one-byte bufferoverflow was discovered in the OpenBSD port of the FTP daemon in.ftpd(8) several weeks ago. This bug could just be triggered by authenticated users, which have write access. This bug is believed to not be exploitable under Linux. However, we prefer to provide a fixed update package to make sure that the daemon is on the safe side. in.ftpd(8) will be invoked by inetd(8) and is activated by default. timed(8): The time server daemon timed(8), which is started at boot time, tries to synchronize the local host time with the time of other machines on the local area network. A bug in timed(8) was reported by the FreeBSD Security Officer, that could be triggered remotely to crash the time server daemon. For SuSE 6.1-6.4 in.ftpd and timed were part of nkitb. Users of SuSE 7.0 need to download the nkitserv package for both in.ftpd and timed. The bug in in.ftpd is fixed in SuSE 7.1, so nkitserv for SuSE 7.1 just includes a new version of timed(8). Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.3.16-0.i386.rpm c4313f92a36916f0eba0b8837c9c0c81 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.3.16-1.src.rpm ec452523fa25c8aed962fbd3349d1f3d SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.3.16-0.i386.rpm 02772824805c6c4293bd1750d7bda6d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 5d301edc1b1ec9111572815aace33984 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2001.3.16-1.i386.rpm 842dea179cc449c4af25accf0c3f38ec source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2001.3.16-1.src.rpm c099e7c1194b7706100453a89433b59c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/nkitb-2001.3.16-0.i386.rpm 768a636df4731cd8efd181aa2eaf2e60 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm b705425c4c3cb70ebf9cd1345c92104a SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/nkitb-2001.3.16-0.i386.rpm cbae31148c79c91a1443f79ee1ba34d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkitb-2001.3.16-0.src.rpm d287c01d35d00756ecbf8da04556037c SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/nkitb-2001.3.16-0.i386.rpm 5f45ade69a9e8c2756e671c4a6e3522a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm 62b969c4e666f3ea71b6ce6b31762718 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.3.16-0.sparc.… 142329dcae76a1603c0d84836192e357 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm 5bd9123cecba6ddd42cc965c599f383e SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.3.16-0.sparc.… 07ed33c76c7ae2df5b877003b254944d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm 66ba7b71624f636e24e2d628c8f06e81 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.3.16-0.alpha.rpm 5fcf177588788eb069bdb69332046d23 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm c27ed3bf0c293eaa77fe5a8fa960e95d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2001.3.16-0.alpha.rpm 385fa60c0c216f1d9e61afd52d37df93 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5ba60084740c9be9f89a729e2d21a77c SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/nkitb-2001.3.16-0.alpha.rpm 8a9e207a77e3c7f954e8faa91954f7aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm 53f8a03feacc7fb81b92a726c8e81d21 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/nkitb-2001.3.16-0.alpha.rpm 359a3432f73220cecd42ba0b365d5e06 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm e0ccf6395312f9c33518f5f083c9d51f PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.3.16-0.ppc.rpm 37bf5a963bc93215084b5634e864479c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm c31af637f58d9b43db542657b02bc772 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.3.16-1.ppc.rpm ddc1dcfb94ba90f3cbdf395f89dd3b84 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 2fa9c58b871248172285a64107e3be7c SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2001.3.16-0.ppc.rpm 1dc4c831b5f6bd344ab8f511497b3fa5 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5529e5f63e2391ab1669efa0a8c33b57 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e space´, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoom´. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOrpHQ3ey5gA9JdPZAQEWXwf/TwIX3tVUM4l32z6efEOdiLPNe0FmdImz kgFkyWX+aDSLIVvhoqjpfr7DjD0p2Run9d1BjdLoTGqUgFZf+WR5yZWUbR94+5wN ahaoKWHMGGxHxynrbr+YnlOFyKH1Zv3HqFbsY/KTrVSsWCsbqsqs1wd8ePVG/El9 oODwYHDBlMHGu+tXRqXAMhxGgrlMw5Id2fQEXVXvQu6/OJjqjzeRDHCA05vw/lZK hK0vAPbU3UKHkgbHLmA1kKyqMIYJZcSWDngv6IOWrS/5MyoswL8sWcda+7Z3omyL 885DLHrszKcnH2mYzVeVV/ZYE2u711dhVRn+FEHIxukNty0un6rLaQ== =aQ3n -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: nkitb/nkitserv
by Thomas Biege 22 Mar '01

22 Mar '01

______________________________________________________________________________ SuSE Security Announcement Package: nkitb/nkitserv Announcement-ID: SuSE-SA:2001:07 Date: Thursday, March 22th, 2001 19.06 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote denial-of-service Severity (1-10): 4 SuSE default package: yes: in.ftpd, no: timed Other affected systems: all system using in.ftpd (OpenBSD port) or timed Content of this advisory: 1) security vulnerability resolved: timed, in.ftpd problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Two parts of the nkitb/nkitserv package are vulnerable to security related bugs. in.ftpd(8): A one-byte bufferoverflow was discovered in the OpenBSD port of the FTP daemon in.ftpd(8) several weeks ago. This bug could just be triggered by authenticated users, which have write access. This bug is believed to not be exploitable under Linux. However, we prefer to provide a fixed update package to make sure that the daemon is on the safe side. in.ftpd(8) will be invoked by inetd(8) and is activated by default. timed(8): The time server daemon timed(8), which is started at boot time, tries to synchronize the local host time with the time of other machines on the local area network. A bug in timed(8) was reported by the FreeBSD Security Officer, that could be triggered remotely to crash the time server daemon. For SuSE 6.1-6.4 in.ftpd and timed were part of nkitb. Users of SuSE 7.0 need to download the nkitserv package for both in.ftpd and timed. The bug in in.ftpd is fixed in SuSE 7.1, so nkitserv for SuSE 7.1 just includes a new version of timed(8). Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.3.16-0.i386.rpm c4313f92a36916f0eba0b8837c9c0c81 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.3.16-1.src.rpm ec452523fa25c8aed962fbd3349d1f3d SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.3.16-0.i386.rpm 02772824805c6c4293bd1750d7bda6d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 5d301edc1b1ec9111572815aace33984 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2001.3.16-1.i386.rpm 842dea179cc449c4af25accf0c3f38ec source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2001.3.16-1.src.rpm c099e7c1194b7706100453a89433b59c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/nkitb-2001.3.16-0.i386.rpm 768a636df4731cd8efd181aa2eaf2e60 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm b705425c4c3cb70ebf9cd1345c92104a SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/nkitb-2001.3.16-0.i386.rpm cbae31148c79c91a1443f79ee1ba34d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkitb-2001.3.16-0.src.rpm d287c01d35d00756ecbf8da04556037c SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/nkitb-2001.3.16-0.i386.rpm 5f45ade69a9e8c2756e671c4a6e3522a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm 62b969c4e666f3ea71b6ce6b31762718 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.3.16-0.sparc.… 142329dcae76a1603c0d84836192e357 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm 5bd9123cecba6ddd42cc965c599f383e SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.3.16-0.sparc.… 07ed33c76c7ae2df5b877003b254944d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm 66ba7b71624f636e24e2d628c8f06e81 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.3.16-0.alpha.rpm 5fcf177588788eb069bdb69332046d23 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm c27ed3bf0c293eaa77fe5a8fa960e95d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2001.3.16-0.alpha.rpm 385fa60c0c216f1d9e61afd52d37df93 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5ba60084740c9be9f89a729e2d21a77c SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/nkitb-2001.3.16-0.alpha.rpm 8a9e207a77e3c7f954e8faa91954f7aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm 53f8a03feacc7fb81b92a726c8e81d21 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/nkitb-2001.3.16-0.alpha.rpm 359a3432f73220cecd42ba0b365d5e06 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm e0ccf6395312f9c33518f5f083c9d51f PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.3.16-0.ppc.rpm 37bf5a963bc93215084b5634e864479c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm c31af637f58d9b43db542657b02bc772 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.3.16-1.ppc.rpm ddc1dcfb94ba90f3cbdf395f89dd3b84 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 2fa9c58b871248172285a64107e3be7c SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2001.3.16-0.ppc.rpm 1dc4c831b5f6bd344ab8f511497b3fa5 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5529e5f63e2391ab1669efa0a8c33b57 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e space´, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoom´. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: impad
by Thomas Biege 22 Mar '01

22 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: pop Announcement-ID: SuSE-SA:2001:06 Date: Wednesday, March 21th, 2001 19.19 MEST Affected SuSE versions: 6.1 Vulnerability Type: remote command execution Severity (1-10): 2 SuSE default package: no Other affected systems: all system using the pop package Content of this advisory: 1) security vulnerability resolved: omap, ipop2d, ipop3d problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The eMail access daemons impad(8), ipop2d(8) and ipop3d(8) of SuSE 6.1 are vulnerable to several buffer overflows. Due to a misconfiguration these vulnerbilities could be triggered remotely after a user had been authenticated. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2001.3.21-0.i386.rpm 1277deee87f3d1553ee18ae078d646aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/pop-2001.3.21-0.src.rpm ce326335b36e51b6a635b69fc0106911 AXP Alpha Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2001.3.21-0.alpha.rpm 33405d29e279795d99853a1235a821f9 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/pop-2001.3.21-0.src.rpm eecd7c9ac81397f9eb7b2bee01a0154d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e spaceŽ, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoomŽ. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/manŽ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - A new nkitb/nkitserv package will be availabe soon. This update adresses bugs in timed, in.ftpd (and rwhod). - A vulnerbility, that exists in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOronNHey5gA9JdPZAQHNtwf+JRiIV2do5UeA7+YG3hc0f+RVP3ZAHqM9 u7Pb/2oK9yb6AQrrc2PSJeY1WKMqYGDGAs1RtMuRYykgFux3vFnVsmmZ6/BUKKwz Ziz8uMe6BwUt3BZZiYwQQTLxEPBTJXxQpY6nF4rNhzVsecUCXM6LFBggkyV9Yd05 Vk3D+bvkkLHlJss5CFG3CITxJGi54MfqIyxab0aapu+723sxRu07MLXsmi1p3lL9 HJpVDr7OM07Sc2Sla3jjq+BiZk8R9SoZUzezn8imSmzXtKpCqZdxdv322weju7Gr LXQuC0QfnX/Du0w0Ko3ayZK0VXe+8VDdg3DA2UUZdOmBkBPTeqUDVg== =nRUf -----END PGP SIGNATURE-----

1 0

sleep() weaknesses
by Sebastian Krahmer 22 Mar '01

22 Mar '01

hi, I just uploaded paper about remote password guessing (and why sleep(x) is not enough to protect) with help of threads and other tricks. Its avail at www.cs.uni-potsdam.de/homepages/students/linuxer/tad.tar.gz It includes sample-program for high guessing-rates and a benchmark-server if you don't want (can) to use your ISP's pop3d. :) regards, Sebastian

1 0