April 2001 - openSUSE Security - openSUSE Mailing Lists

Re: AW: AW: [suse-security] Bind again
by Hipolito A. Gonzalez M. 23 Apr '01

23 Apr '01

Frank Lederer wrote: > Why are you sure that you need tcp to 53? For normal requests udp is enough. > Or am I wrong... Can i close the 53 TCP? Are you sure? -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

4 3

iptables ip_conntrack_ftp security weakness and SuSE
by Reckhard, Tobias 23 Apr '01

23 Apr '01

Hi all and Roman specifically. As some of you may have already noticed, the FTP connection tracking in iptables/netfilter, the packet filtering code in the 2.4 kernels, is subject to a nasty bug, that, similarly to the Check Point and PIX issues last year, potentially renders the packet filter completely useless as arbitrary connections from an FTP server can be established. Those interested in the details can check out: http://netfilter.samba.org/security-fix/index.html. The netfilter crew have made a patch available that alleviates the issue, but it is for kernel 2.4.3 and not 2.4.2, which is the latest available from and officially supported by SuSE. In the light of this IMHO significant security issue, are SuSE planning on releasing a patched version of a 2.4 kernel anytime soon? I know that you don't recommend 2.4 for production machines yet, but that should not IMHO lead to delays in the distribution of fixes for important security issues such as this. Regards, Tobias Reckhard -- Tobias Reckhard secunet Security Networks AG Tel : +49(6196)95888-42 Mergenthalerallee 77 Fax : +49(6196)95888-88 D-65760 Eschborn E-Mail: reckhard(a)secunet.de

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 22 Apr '01

22 Apr '01

Hello, again... I think that it all has to do with the Linux kerne's policy of "overcommitment" of VM. There have been *many* long discussions of this on the linux kernel mailing list -- if you want to get *all* of the gory details plus *a lot* more, go do a search for "linux overcommit". The short answer is that the kernel *intentionally* will give applications more virtual memory than really exists. The argument goes that in a great many cases, the application never uses most a lot of that memory. Doesn't make sense? Try this example: "BigApplication" (i.e. emacs or netscape) has allocated 100M of RAM. User does something that causes it to run a sub-process "/bin/ls". BigApplication calls "fork()" and then the child process calls "exec()". If you the kernel *didn't* overcommit, and your didn't have another 100M of VM, the "fork()" would fail, even though several lines of code later the child process exec's "ls" which needs *much less* VM than BigApplication. There are other scenerios, as well, where overcommitment is a *good thing*, but it does have it's downsides, too... The 2.4 kernel has a built-in "out of memory" killer which attempts to kill the process(s) that are sucking the life out of the system. I think that in 2.4.3 it's getting pretty good. I think that the behaviour of Solaris and other kernels is somewhat different -- they don't overcommit, but handle VM in a very different way, but I don't remember the details. Many on the l-k list contend that the Linux way provides better performance, etc., BTW. Later -Nick > On Sun, 22 Apr 2001, Ashley wrote: > > > I would like to see your script. It sounds useful. Perhaps even > > more than $0.02 worth. > > > > On Fri, Apr 20, 2001 at 07:42:32PM +0600, Nick LeRoy wrote: > > > Hello... > > > > > > Just thought I'd add my $0.02 worth in... > > > > > > I *always* run netscape from a script which uses ulimit to set the amount of memory it can get. If I don't, it sometimes sucks the life out of the machine in similar ways by using all memory. With it ulimitted, it dies after a while (when it can't get any more memory), but my system still lives on. I've been doing this for serveral years. > > Hello, > I would like to know, if this is Linux specific, or am I able to crash (or > freeze) any Unix (Solaris for example) just by eating a lot of memory? > Where does this problem come from? When a programm calls a malloc (or > something like that), I think the system should return an error, if there > is not enough memory. It seems that Linux does *not* return an error (or > only too late). > Am I right or wrong? > Regards, Peter > > -- > Peter Münster > <A HREF="http://notrix.net/pm-vcard" TARGET="_new"><FONT COLOR="BLUE">http://notrix.net/pm-vcard</FONT></A> > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

AW: [suse-security] hex IP Addresses - reading direction [was: fi rewall.log - martian source]
by Thomas Lamy 22 Apr '01

22 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Steffen Dettmer [mailto:steffen@dett.de] wrote: > * Hella.Breitkopf(a)varetis.de wrote on Fri, Apr 20, 2001 at > 20:16 +0200: > > mash(a)myfuckingnet.com on Thu, Apr 19, 2001 at 10:41 +0200 > > had found the martians in his log files: > > >> Apr 18 12:04:38 server kernel: martian source > > >> c799fea9 for c799fea9, dev eth0 > > > > Steffen Dettmer <steffen(a)dett.de> > > had some perl code to decode this: > > * Hella.Breitkopf(a)varetis.de wrote on Fri, Apr 20, 2001 at 20:16 > +0200 had thesis about that: > > > [THESIS 1] > > So are there two possibilities to write hex IP addresses > and the found > > "martians" > > in the log files are written backwards (right to left) > > I think that's it, and that's why the scripts is like is it. I > wrote it when I got a martian from 192.168.1.255. But maybe this > came from 255.1.168.192 - but this looks not familar... But I > have never confirmed hat or whatever. The script may be wrong. > Look at the kernel sources if unsure. > > > I haven't found any prove for one of these thesises - but would > > be very interested in resources proving one of the two. > *** > *Steffen Dettmer* proved that the address logs are done in network > byte order > > But back to security. You told: > > > ff ff fe a9 is in my universe (if read from left to right) = > > 255.255.254.169 > > which makes me assume that 169.254.255.255 is not. A whois shows > quickly: > > Netname: LINKLOCAL > > hum! Such a funny thing. But who should recognize LINKLOCAL in > hex and network byte order! :) funny :) :) > > So maybe there's some Win host getting bored and sending junk... > To learn more about link local, use your favorite search engine. > I've forgotten the story. > > As I told, check for move laptops and such things. > I did not find the right RFC, but at least Microsoft and Apple dynamically assign 169.254/16 IP addresses to DHCP clients when their DHCP-requests time out (they call it "Plug-And-Play Networking"). Just my $0.02 Thomas -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBOuHYnUJRmQkE7ThJEQKZoACgweEGeVjJdaDLpmfQrHUasWDCcPsAnRYG JtI4Nzzynh3H9ixHWZmGRXl4 =hkib -----END PGP SIGNATURE-----

2 1

snort doesn't see nmap ack scans?
by Philipp Snizek 21 Apr '01

21 Apr '01

Dear list-users, I suspect Snort 1.7 not to see nmap ack scans. But I'm not sure about that. These are the snort rules I run (pretty much, I know): #include local.rules include /snortrules/exploit.rules include /snortrules/scan.rules include /snortrules/finger.rules include /snortrules/ftp.rules include /snortrules/telnet.rules include /snortrules/smtp.rules include /snortrules/rpc.rules include /snortrules/rservices.rules include /snortrules/backdoor.rules include /snortrules/dos.rules include /snortrules/ddos.rules #include dns.rules #include netbios.rules #include sql.rules include /snortrules/web-cgi.rules include /snortrules/web-coldfusion.rules include /snortrules/web-frontpage.rules include /snortrules/web-misc.rules include /snortrules/web-iis.rules include /snortrules/icmp.rules include /snortrules/misc.rules #include policy.rules #include info.rules #include virus.rules This is the test I've been doing: I'd be interested in identifying nmap os fingerprints with snort. I could find out nmap os fingerprint test 1 - 7 but cannot get further with nmap test 4 and 6: Apr 20 13:21:59 212.232.168.184:53180 -> 212.232.168.180:22 SYN *2****S* RESERVEDBITS nmap test 1 is a tcp syn packet to an open Port. Apr 20 13:21:59 212.232.168.184:53181 -> 212.232.168.180:22 NULL ******** nmap test 2 is a tcp null packet to an open port Apr 20 13:21:59 212.232.168.184:53182 -> 212.232.168.180:22 NMAPID **U*P*SF nmap test 3 sends a combination of urgent, push, syn und fin to an open port where is snort's ack rule for nmap test 4 (tcp ack to an open port)? Apr 20 13:21:59 212.232.168.184:53184 -> 212.232.168.180:1 SYN ******S* This is nmap test 5 sending a syn to a closed port where is snort's ack rule for nmap test 6 (tcp ack to a closed port)? Apr 20 13:21:59 212.232.168.184:53186 -> 212.232.168.180:1 XMAS **U*P**F nmap test 7 sending a tcp combination of urgent, push and fin to a closed port I hope somebody of you has got an answer on how to make Snort see ack scans. Thanx Philipp

2 1

hex IP Addresses - reading direction [was: firewall.log - martian source]
by Hella.Breitkopf＠varetis.de 21 Apr '01

21 Apr '01

mash(a)myfuckingnet.com on Thu, Apr 19, 2001 at 10:41 +0200 had found the martians in his log files: >> Apr 18 12:04:38 server kernel: martian source >> c799fea9 for c799fea9, dev eth0 Steffen Dettmer <steffen(a)dett.de> had some perl code to decode this: >to convert hex to IP you may use the following one-liner: > >perl -e '$a=shift;{printf "%d.%d.%d.%d\n", > ("0x" . substr($a,6,2)), > ("0x" . substr($a,4,2)), > ("0x" . substr($a,2,2)), > ("0x" . substr($a,0,2));}' <string> > >[this works at least on intel archs] [snip] >fffffea9 = 169.254.255.255 Err, and here starts my problem: ff ff fe a9 is in my universe (if read from left to right) = 255.255.254.169 (but a9feffff *is* 169.254.255.255) The script does it backwards ... I know that e.g. AIX is using sometimes hex IP addresses, and all IP addresses I've seen were read from left to right. [THESIS 1] So are there two possibilities to write hex IP addresses and the found "martians" in the log files are written backwards (right to left) OR [THESIS 2] is the script in all cases wrong and should be corrected to: perl -e '$a=shift;{printf "%d.%d.%d.%d\n", ("0x" . substr($a,0,2)), ("0x" . substr($a,2,2)), ("0x" . substr($a,4,2)), ("0x" . substr($a,6,2));}' <string> I haven't found any prove for one of these thesises - but would be very interested in resources proving one of the two. Since this has at least connections with log files one could argue this on topic with security ;-) (otherwise flame me). regards, Hella Breitkopf -- -- -- -- -- hella.breitkopf(a)varetis.de unix administrator technical infrastructure varetis COMMUNICATIONS GmbH

2 1

Mirroring updates directory
by RoMaN SoFt / LLFB!! 20 Apr '01

20 Apr '01

Hello. Let's suppose I want to have a mirror of *all* 6.4 suse updates. I have several SuSE machines and I'm going to set up on each machine an auto-update script which checks for newer packets by ftp'ing to my local mirror. I've created this script: LOCAL=/usr/local/ftp/pub/suse/update wget -m -nH --cut-dirs=4 -P ${LOCAL} ftp://ftp.suse.de/pub/suse/i386/update/6.4 wget -m -nH --cut-dirs=4 -P ${LOCAL} ftp://ftp.suse.com/pub/suse/i386/update/6.4 First I download packets from the German site which if I'm not wrong they are the ones with license/exports problem. Second, I download the rest of the packets from "official" site. Can I trust rpm's not being duplicated on both sites? What's the SuSE's policy about this? I think I'm right but.. Am I missing some important update packets on another directory? I need to be sure I'm not missing rpm's. The script is executed regularly by cron (one time per week is sufficient?). Is there any way of removing old packets from my mirror? This would be avoid a situation like this: -r--r--r-- 1 root root 453985 Aug 29 2000 timezone-2.1.3-150.i386.rpm -r--rw-r-- 1 root root 452109 Jan 25 17:07 timezone-2.1.3-155.i386.rpm Both files are kept in my local mirror. This is unnecessary. Is it safe to delete automatically (I'll write some script lines) the old files? (eg: compare xxx-2.1.3-150.yyy < xxx-2.1.3-155.yyy and remove the first one). Would I break something? TIA =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

8 15

Re: [suse-security] Reasons for a system to freeze?
by Yuri Robbers 20 Apr '01

20 Apr '01

I've had the same problem with several other programs (all non-SuSE; most notably Mathematica), and implemented the same solution... this basically solves the problem, but it's still possible for a malicious user (or a curious user finding the binaries which I renamed DoNotRunThis01 etc.) to run the original program directly (i.e. without the ulimit wrapper script), and crash the machine. Does anyone know whether mozilla has this problem too? It might be a good idea to uninstall netscape and use mozilla instead. That would get rid of the problem for one application at least... Cheers, Yuri. > Hello... > > Just thought I'd add my $0.02 worth in... > > I *always* run netscape from a script which uses ulimit to set the > amount of memory it can get. If I don't, it sometimes sucks the life > out of the machine in similar ways by using all memory. With it > ulimitted, it dies after a while (when it can't get any more memory), > but my system still lives on. I've been doing this for serveral > years. > > -Nick

1 0

Firewall
by Maximiliano A. Benitez 20 Apr '01

20 Apr '01

Howto i config firewall.rc.config in linux suse 7.0 and howto setup ipchains i have two ethernet adapter whit ip public

10 13

Is SuSE offering a RPM for sendmail 8.11.3 ???
by Marko Kaening 20 Apr '01

20 Apr '01

Hi, I would like to use the newest sendmail with authenticated smtp but couldn't find a rpm anywhere on suse. Is somebody planning to create something like that, usable also for a SuSE 6.3??? I tried to compile it myself with BerkeleyDB, sfio + patch, openssl, cyrus-sasl but still don't know whether I might succeed... there are just too many things one needs to know... Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

4 6

Re: [suse-security] Reasons for a system to freeze?
by alter ego 20 Apr '01

20 Apr '01

This sounds like my problem! I don't think it has anything to do with reiserfs (as some people suggested earlier), because I am not using reiserfs. I am however running httpd as well. My Kernel Version is 2.4 Markus Roth wrote: > > hello, > don't flame me if i'm wrong, but probably you got the same problem as i > do. i have the same kernel as you (David). > my mail from yesterday and the response from Markus Gaugusch: > > ------------- > > hello, > does somebody knows what's going on? my problem: > on the average twice per week a process remains suddenly > hang on my laptop (SuSE 7.1 / 2.4.0). As soon as I do a ps > or something similar this process hangs too. I straced the ps > command and got following output: > > [snip] > ipc_subcall(0x6, 0x816a308, 0x400, 0xd) = 480 > stat64("/proc/1234", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 > open("/proc/1234/stat", O_RDONLY) = 7 > read(7, > <unfinished ...> > > It seems that every command hangs (ps, fuser, killall, netstat -ap) > that reads thru the proc file system and tries to open some files > of the process 1234. > > If I try to 'cat' the file /proc/1234/stat the same thing happens. > > I'm am absolutely not sure, but I guess the process > 1234 is httpd (apache 1.3.17 installed). Only if apache is running > this seams to happen. Unfortunately I can't identify the process > because every command I know reads from the proc file system. > > the bad thing is, I can't even reboot my machine because this tries > to terminate the processes and hangs too nor can I unmount my > partitions because they are busy. > > any ideas what this could be or what i should do? > greetings & thanks > markus > > ------------------- > > then Markus Gaugusch wrote: > if you enable "Magic SysRq Key" in kernel and rc.config, you can press > alt+prtscr+s to sync your disks, alt+prtscr+u to remount them readonly > and > alt+prtscr+b to reboot the machine. > > next time this happens to me i will try the hint from Markus Gaugusch > bye markus > > David Henderson wrote: > > > > Roman Drahtmueller wrote: > > > > > Guys, your problem descriptions lack a simple detail: The kernel version. > > > > 2.4.0-64GB-SMP > > > > I cannot use the 2.2.18 kernel since I have multiple PCI buses. I have > > tried using the 2.4.3 kernel from the SuSE source, but I have not had > > the time to fix the other issues (usbmgr, audio, etc...). Thanks and > > sorry!! > > > > Dave H > > > > -- > >

1 0

Dependancies for freeswan rpm?
by Geordon VanTassle 20 Apr '01

20 Apr '01

Anyone know what provides libgmp.so.3? I wanted to install the freeswan RPM, but need libgmp. Also, how can I determine where to get these dependancies in the future? T'anks, Geordon

4 4

snort and ADSL
by Togan Muftuoglu 20 Apr '01

20 Apr '01

Hi everyone, I am using snort that comes with 7.1 and configuring snort to work with pppoe has been a major issue. (OK maybe I am not seeing what I have to do). I have triedwww.vulnerebilites.org to nmap my IP but snort is not capturing anything. Any help is appreciated rp-pppoe is running on my firewall PC and there is masquareding for my home lan I'm starting snort via rcsnort which is /usr/sbin/snort -D -i ppp0 -c /etc/snort/snort-lib and this is my snort-lib # SET THIS VARIABLE TO COVER YOUR OWN NETWORK RANGE!!!! ############################################################################### var HOME_NET 192.168.1.0/24 ############################################################################### # SET THIS VARIABLE TO COVER YOUR OWN EXTERNAL RANGE!!!! ############################################################################### var EXTERNAL_NET [$ppp0_ADDRESS] # set your DNS server IP (or whatever) so you don't show "portscans" from # that address ############################################################################### # SET THIS VARIABLE TO AS IT APPLIES TO YOUR NETWORK!!!! ############################################################################### var DNS_SERVER 192.168.1.2/32 $EXTERNAL_NET/32 -- Togan Muftuoglu

1 0

Re: AW: [suse-security] Bind again
by Hipolito A. Gonzalez M. 20 Apr '01

20 Apr '01

Frank Lederer wrote: > Ok, I had also a bind-problem. I think, it was caused by some missconfigured > win2000-boxes in my lan. I have denied tcp-connections to port 53 from the > lan and now everything seems to work. Maybe this helps. > Regards > Frank > Ok but I'm a ISP, and can't close the 53 port. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

1 0

deny an whole country
by rene marhold 20 Apr '01

20 Apr '01

Hello last night i found an list on ripe where to see all countries and ther ip ranges http://www.ripe.net/ripencc/mem-services/general/allocs4.html with an awk script i cut out everything but ips now ips are looking like 212.30/19 original uk.guernsey-telecoms (Guernsey Telecoms) 19980304 212.30/19 ALLOCATED PA command: ipchains -A input -s 212.30/19 -j DENY but in ipchains -L -n the rule is after this step DENY all ------ 212.0.0.0/19 0.0.0.0/0 n/a why where´s there the error??? ---------------- other question, someone now how to expand 212.30/19 with awk to an complete ip like 212.30.0.0/19 into an whole list?? list is like following "194.112.192/18", "212.126.64/19", "212.52.192/19", "213.153.32/19", "195.70.96/19", "194.118.0/19", "194.118.32/19", "194.118.64/18", "194.118.128/17", "62.140.32/19", "212.119.128/19", "62.178/15", "195.34.128/19", "212.17.64/18", "212.186.0/16", "213.47/16", "62.46/15", "195.3.64/18", "212.183/18", "212.183.64/18", "213.33/17", "194.183.128/19", "194.208.0/19", "194.208.32/19", "194.208.64/18", "194.208.128/17", "213.142.32/19", "62.218/16",

3 2

SuSE Security Announcement: hylafax (SuSE-SA:2001:15)
by Thomas Biege 20 Apr '01

20 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: hylafax Announcement-ID: SuSE-SA:2001:15 Date: Friday, April 20th, 2001 10.26 MEST Affected SuSE versions: [6.1, 6.2,] 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local root compromise Severity (1-10): 7 SuSE default package: no Other affected systems: all systems using hylafax Content of this advisory: 1) security vulnerability resolved: hylafax problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The HylaFax program hfaxd(8c) implements the server part of the HylaFax package. It is started either by inetd(8) or runs in standalone mode. hfaxd(8c) offers three different protocols to process fax jobs. When hfaxd(8c) tries to change to it's queue directory and fails, it prints an error message via syslog by directly passing user supplied data as format string. As long as hfaxd(8c) is installed setuid root, this behavior could be exploited to gain root access locally. As a workaround remove the setuid bit: /bin/chmod u-s /usr/lib/fax/hfaxd or restrict access to trusted users only: /bin/chown root.trusted /usr/lib/fax/hfaxd /bin/chmod 4750 /usr/lib/fax/hfaxd Download the update package from locations described below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n3/hylafax-4.1beta2-251.i386.rpm a3d5d0d5a8977852b02dc9b7352054aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/hylafax-4.1beta2-251.src.rpm b5c8877de53db86eabfae932142221d7 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n2/hylafax-4.1beta2-254.i386.rpm 5be3094195a789d83b02d59ab343d7b5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/hylafax-4.1beta2-254.src.rpm 87ee1d77eea95eac74c6b8355912ad9f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n2/hylafax-4.1beta2-253.i386.rpm 90a894b8d47a94125992f3a64a6ada44 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/hylafax-4.1beta2-253.src.rpm 7b53ca017efdd9371c9a6207095a8c2f SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n2/hylafax-4.1beta2-252.i386.rpm 340e64a902a2e3f73b7d1771739c5b59 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/hylafax-4.1beta2-252.src.rpm edb05a6191ab7d5533d1d9eb9ef0d255 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n3/hylafax-4.1beta2-218.sparc.… 1449e568071f5fb6080efebb8f2a7a2b source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/hylafax-4.1beta2-218.src.r… bf8c780206da51bc548e9fd4264b9bfc SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n2/hylafax-4.1beta2-218.sparc.… bb265465ea8b84ca31b5c954266daf1d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/hylafax-4.1beta2-218.src.r… b5bcae601fe056f399fc8696aa156529 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n2/hylafax-4.1beta2-211.alpha.rpm 2ee3176e2b425c494bd37d22f2ea090c source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/hylafax-4.1beta2-211.src.rpm f89c3771432d84a3e7c3ab2f4331d73c SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n2/hylafax-4.1beta2-211.alpha.rpm 5aecfb997867f8f72164f27dc220f95b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/hylafax-4.1beta2-211.src.rpm 09f1cbb3714dfe75e1aa3ff2a52c13a3 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n2/hylafax-4.1beta2-211.alpha.rpm 39f12bc3f09bab26c60df98a2b52b64e source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/hylafax-4.1beta2-211.src.rpm 6a48eac9982dfca01a1ed904cacfb2c8 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n3/hylafax-4.1beta2-164.ppc.rpm a42c7bc70e25a6725d8e2a76870be1d4 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/hylafax-4.1beta2-164.src.rpm 9c064b869fb7c73f453a254b5f3780be SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n2/hylafax-4.1beta2-165.ppc.rpm 81387d514f089a7060bc6dacb15358a8 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/hylafax-4.1beta2-165.src.rpm 35ec2293fb0390cb827935499506ed89 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n2/hylafax-4.1beta2-165.ppc.rpm be20c8f1ef2488c8db711744eab2233b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/hylafax-4.1beta2-165.src.rpm 4af4d6b8e948b39a1d4040adaad27c0a ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Updated man RPMs will be available in a few days. - In the past weeks, some security related bugs in the Linux kernel 2.2 and 2.4 were found. An announcement, that addresses this will be released asap. - Samba has serveral security problems, which could lead to local root access. Samba 2.0.8 fixes these problems. New RPMs are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOuACUHey5gA9JdPZAQHrdwf/TIjn3G879Q4Vb5im5T7CkHr+YF6pGbp4 NjxEM8j8lSPnXy1iJwYRuSV7UT7Jrcqe2lm008IUMD9xN73ybUjnjiG2dzCYfI52 xYImtlzTiAlaGVHtnPGBBj7K3MOLqCQsgr2FkjJ6/LOsdFrBSa2BNEcl+fy/9n72 2+fZN04hdgpkd9uGrbkZPch0XbYYG5Ij54lM2LKBqZ7RcAgtGToR8nJ/vyMCv9kJ ivPmPX6Jr/CYxw1gKNprpEAV9GiaI70rGDazW7bM9s94LVuEJmOt4bJzVnYzY3wK cz1UAnHZ3MWM8HmYj3Awl4elBmtFpiYJR8tfrc9pyOPSZir78ZvCdA== =KFNn -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

1 0

[suse-security] firewall.log - martian source
by mash＠myfuckingnet.com 20 Apr '01

20 Apr '01

I found these lines on my firewall.log, i would be thanked if somebody can explain me more less what happened here?... its on the internal network... SuSEfirewall 4.3 kernel 2.2.4 ... Apr 18 12:04:38 server kernel: martian source c799fea9 for c799fea9, dev eth0 Apr 18 12:04:38 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 06 Apr 18 12:05:48 server kernel: martian source c799fea9 for c799fea9, dev eth0 Apr 18 12:05:48 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 06 Apr 18 12:05:54 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:54 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:54 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:54 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:54 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:54 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:56 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:56 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 See you on the son... Tomás

3 2

Strange behaviour ssh on 7.1 (RSA) ?
by Maarten van den Berg 20 Apr '01

20 Apr '01

Hi, I've found that I can no longer login using RSA challenge to an openssh server running on SuSE 7.1... Anyone else observed the same ? I've been checking and double-checking everything: filepermissions, server config, upgrading, running sshd in debug mode, but I can't find anything wrong. Of course my ssh-agent etc. is configured correctly. Needless to say, this is the only server I have problems with, out of a couple dozens, and coincidentally it is also the only machine running 7.1 Here are three sessions, the first is the wrong one, the second is for comparison only (and to reach machine #3). The third is from the other machine, back to the one that has the problem. The 'server' is running SuSE 7.1, both clients 7.0. Note that it doesn't matter which 7.0 machine I use to connect from; the sshd on the 7.1 machine invariably rejects it. "apoc": running 7.1, kernel 2.4.3 "morpheus": running 7.0 kernel 2.2.16-SMP "trinity": running 7.0 kernel 2.2.16 maarten@morpheus:~ > ssh -v apoc SSH Version OpenSSH_2.3.0p1, protocol versions 1.5/2.0. Compiled with SSL (0x0090581f). debug: Reading configuration data /etc/ssh/ssh_config debug: Applying options for * debug: Seeding random number generator debug: ssh_connect: getuid 500 geteuid 0 anon 0 debug: Connecting to apoc [x.x.x.x] port 22. debug: Seeding random number generator debug: Allocated local port 796. debug: Connection established. debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1 debug: no match: OpenSSH_2.3.0p1 debug: Local version string SSH-1.5-OpenSSH_2.3.0p1 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'apoc' is known and matches the RSA host key. debug: Seeding random number generator debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying RSA authentication via agent with 'maarten@morpheus' debug: Server refused our key. debug: RSA authentication using agent refused. debug: Trying RSA authentication with key 'maarten@morpheus' debug: Server refused our key. debug: Doing password authentication. maarten@apoc's password: ^C maarten@morpheus:~ > ssh -v trinity SSH Version OpenSSH_2.3.0p1, protocol versions 1.5/2.0. Compiled with SSL (0x0090581f). debug: Reading configuration data /etc/ssh/ssh_config debug: Applying options for * debug: Seeding random number generator debug: ssh_connect: getuid 500 geteuid 0 anon 0 debug: Connecting to trinity [x.x.x.x] port 22. debug: Seeding random number generator debug: Allocated local port 950. debug: Connection established. debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1 debug: no match: OpenSSH_2.3.0p1 debug: Local version string SSH-1.5-OpenSSH_2.3.0p1 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'trinity' is known and matches the RSA host key. debug: Seeding random number generator debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying RSA authentication via agent with 'maarten@morpheus' debug: Received RSA challenge from server. debug: Sending response to RSA challenge. debug: Remote: RSA authentication accepted. debug: RSA authentication accepted by server. debug: Requesting pty. debug: Requesting X11 forwarding with authentication spoofing. debug: Requesting shell. debug: Entering interactive session. Last login: Tue Apr 17 19:51:36 2001 from morpheus Have a lot of fun... maarten@trinity:~ > ssh -v apoc SSH Version OpenSSH_2.3.0p1, protocol versions 1.5/2.0. Compiled with SSL (0x0090581f). debug: Reading configuration data /etc/ssh/ssh_config debug: Seeding random number generator debug: ssh_connect: getuid 500 geteuid 0 anon 0 debug: Connecting to apoc [x.x.x.x] port 22. debug: Seeding random number generator debug: Allocated local port 1012. debug: Connection established. debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1 debug: no match: OpenSSH_2.3.0p1 debug: Local version string SSH-1.5-OpenSSH_2.3.0p1 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'apoc' is known and matches the RSA host key. debug: Seeding random number generator debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying RSA authentication with key 'maarten@trinity' debug: Server refused our key. debug: Doing password authentication. maarten@apoc's password: ^C maarten@trinity:~ > I hope I've somehow overlooked something... If you have any pointers, Thanks in advance... Maarten

3 8

OT: unreadable postings in suse-security]
by Michael Blaesse 20 Apr '01

20 Apr '01

Hallo, Sorry that this posting is not security related. I have sent this message already to Gerd Bitzer, but got no answer. > > Hi, > > I can read only a few of your postings in suse-security with netscape > messenger, e.g. > -Re: [suse-security] ICQ File Transfers > -[suse-security] rc.firewall > > but not the three postings in the FTP daemons thread. They appear as > empty mails. > What is the difference between these mails? > Could you send me the three mails in the FTP daemons thread as privat > mail? One additional unreadable example: Re: [suse-security] Strange portmap package Has anybody else this probleme? Thanks, Michael Blaesse

8 10

IDS article on SuSE's Knowledge Portal
by Thomas Biege 20 Apr '01

20 Apr '01

Hi ppl, an article about Intrusion Detection Systems was released on SuSE's Knowledge Portal (http://portal.suse.de) It's available in englisch and german and is devided in two parts. The second part of the english version should be available in a few days. Thanks to the Portal Team! :-) Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

1 0

FW: [suse-security] Authentication eror
by Joakim Schramm 19 Apr '01

19 Apr '01

-----Original Message----- From: Joakim Schramm [mailto:hostmaster@astrocalc.net] Sent: Thursday, April 19, 2001 11:12 PM To: Alexander Bien Subject: RE: [suse-security] Authentication eror Hi, > > > Is this happening on non-protected pages as well ? Only when trying to access pages though authentication, if switched off pages accesses fine. You can try here http://mb.astro.nu to see the error received. I have tried to put the auth directives both in .htaccess and direct in a <Directory /aaa/bbbb/ccc> inside the VirtualHost configuration, with same result. > Are u sure it isnt a Memory Leak? Well how can I? I know my own memory leak from time to time, but the computers... well I'm just good at other things... > > A small sidenote : > Lets say u install a fres suse7.0 system, with apache 1.3.12, openssl, > php4 and mod_perl.. > Then u update from ftp.suse.com and install the new php4, the new > mod_perl and the new apache 1.3.17 > > U wount be able to start apache again, unless u update openssl from > ftp.suse.de. All this was done, but the segfault was there already in 1.3.12 according to the log. > The child's will either just segfault or it wount start at all.. > well they segfault although done all above... > It took me a while to remind myself to look on ftp.suse.de to get my > machines working again.. So maybe this posting prevents others from same > havok. > Well although not there yet, your post have at least given me some hints of what may could be wrong... I'm just not sure of what a segmentation fault is in this case. Can someone explain it a bit? may furtilize the mind futher... > Alex Thanks, Joakim > > -----Original Message----- > > From: Joakim Schramm [mailto:hostmaster@astrocalc.net] > > Sent: Thursday, April 19, 2001 9:23 PM > > To: suse-security > > Subject: [suse-security] Authentication eror > > > > > > Hi, > > > > not sure if this is the right list or if suse-linux-e is more > > proper, but.. Every time I try to access my password > > protected pages, it errors and write to the httpd error_log: > > [Thu Apr 19 14:51:04 2001] [notice] child pid 27916 exit > > signal Segmentation fault (11). > > > > I traced in the log and found it goes back to the install of > > SuSE 7.0, then with apache 1.3.12 and later updated to > > 1.3.17. Instead of updating my old 6.4 distro, I backed up > > all user and other important files and did a clean install on > > a new disk, which I formated with reiserfs instead of the old > > standard fs (not boot though), and then put back all files as > > web, user dir structure, password files etc etc and have > > thought I got it all right. But as I was about to update my > > website I notced the authification didn't work and probably > > havn't since install. > > > > Can anyone give a hint on this? is it the reiserfs, or the > > AuthUserFile file gone corrupt and can it then be "fixed" ? I > > have searched all over for something on "segmentation fault" > > but havn't come close to my case. Although the release notes > > of apache 1.3.19 talks someting about a bugfix of a possible > > segment error when accessing authentication, I'm not sure this is it. > > > > tanks, > > Joakim > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 1

Re: [suse-security] Bind again
by semat 19 Apr '01

19 Apr '01

Please do strace ip <pid> on your named process until the point when it dies and post your output. On Thu, 19 Apr 2001, Hipolito A. Gonzalez M. wrote: > semat wrote: > > > What bind are you using? > > 8-8.2.3 from Suse > > -- > www.geekcode.com > -----BEGIN GEEK CODE BLOCK----- > Version: 3.1 > GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- > M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ > h! r++ y++ > ------END GEEK CODE BLOCK------ > - A veces creo que hay vida en otros planetas, y a veces creo que > no. En cualquiera de los dos casos, la conclusi�n es asombrosa > (Carl Sagan) > ----------------------------------------------------------------- > > >

2 1

apache 1.3.19
by Hostmaster 19 Apr '01

19 Apr '01

Why isn't there an apache 1.3.19 update for SuSE 7.0? Isn't this "classified" as an security update/fix? at least is this what the apache release note says... as well as the 7.1 update page. I'm aware of the SuSE maintanace policy for older releases, but for gods sake I bougt 7.0 just a few months ago! and this was my 6th set of SuSE dist CD's and belive such important and widely used packet of the distribution should have a somewhat longer lifetime then a couple of months...? Thanks, Joakim Schramm >From 1.3.19 release notes: "Apache 1.3.19 Major changes The primary security fix is: The default installation could lead mod_negotiation and mod_dir or mod_autoindex to display a directory listing instead of the multiview'ed index.html.* files, if a very long path was created artificially by using many slashes. Now 403 FORBIDDEN is returned. The bug fixes are: The ServerRoot directive now removes trailing slashes. Restore functionality broken by the mod_rewrite security fix: The mod_rewrite string arithmetic is corrected for rewrite map. Some possible segfault conditions have been fixed. Under certain circumstances, Apache did not supply the right response headers when requiring authentication."

3 4

Authentication eror
by Joakim Schramm 19 Apr '01

19 Apr '01

Hi, not sure if this is the right list or if suse-linux-e is more proper, but.. Every time I try to access my password protected pages, it errors and write to the httpd error_log: [Thu Apr 19 14:51:04 2001] [notice] child pid 27916 exit signal Segmentation fault (11). I traced in the log and found it goes back to the install of SuSE 7.0, then with apache 1.3.12 and later updated to 1.3.17. Instead of updating my old 6.4 distro, I backed up all user and other important files and did a clean install on a new disk, which I formated with reiserfs instead of the old standard fs (not boot though), and then put back all files as web, user dir structure, password files etc etc and have thought I got it all right. But as I was about to update my website I notced the authification didn't work and probably havn't since install. Can anyone give a hint on this? is it the reiserfs, or the AuthUserFile file gone corrupt and can it then be "fixed" ? I have searched all over for something on "segmentation fault" but havn't come close to my case. Although the release notes of apache 1.3.19 talks someting about a bugfix of a possible segment error when accessing authentication, I'm not sure this is it. tanks, Joakim

2 1

RE: [suse-security] apache 1.3.19
by Joakim Schramm 19 Apr '01

19 Apr '01

Hi > Subject: Re: [suse-security] apache 1.3.19 > > > You can allways download an compile it yourself. > > -miah I can run for president as well, if I have the time and money... but this isn't the point. One of the main reasons I choosed SuSE a few years back when entering into the Linux world, was that it gave me the option of not needing to study to be a Linux guru, before running a smal production system, but could somewhat lean on my computer experience so far from the dos and windows world. The rpm format was perfect for me, as I don't have the time to dig too deep, although I sure have fiddled a lot with it... and learned. I have noticed two things though, the versions or distros replace eachother far quicker in Linux then Windows, for good and worse... and the SuSE distros don't like it too much if you opt in a traditional compile and install here and there... if you want your system somewhat clean, and things easily get broken. I think it's ok with the majority of packages if they not are maintained for features through the distros, but for certain of the more important, and tightly into SuSE integrated packages there ought to be an other policy, like with apache. I have updated my distro with new CD's 6 times and most of this times it been to be upto date with apache or sendmail. I been ok with that, but now I kinda start to hesitate as I havn't more then almost installed the latest and a new one is out and which I have to get fixing some security in one of the two most important packages. I made a choice some years ago based on my current situation and SuSE fitted me then, although it wasn't a system prefarably to run as web- and mail server, but maybe it's time for me to re-evaluate the situation of today and look around... mark, I am not complaining, just releasing my point of view in questioning. thanks, Joakim > > On Thu, Apr 19, 2001 at 06:48:15PM +0200, Hostmaster wrote: > > Why isn't there an apache 1.3.19 update for SuSE 7.0? Isn't this > > "classified" as an security update/fix? at least is this what the apache > > release note says... as well as the 7.1 update page. I'm aware > of the SuSE > > maintanace policy for older releases, but for gods sake I bougt > 7.0 just a > > few months ago! and this was my 6th set of SuSE dist CD's and > belive such > > important and widely used packet of the distribution should have a > > somewhat longer lifetime then a couple of months...? > > Thanks, > > Joakim Schramm > > > > >From 1.3.19 release notes: > > "Apache 1.3.19 Major changes > > The primary security fix is: > > The default installation could lead mod_negotiation and mod_dir or > > mod_autoindex to display a directory listing instead of the multiview'ed > > index.html.* files, if a very long path was created > artificially by using > > many slashes. Now 403 FORBIDDEN is returned. > > > > The bug fixes are: > > > > The ServerRoot directive now removes trailing slashes. > > Restore functionality broken by the mod_rewrite security fix: The > > mod_rewrite string arithmetic is corrected for rewrite map. > > Some possible segfault conditions have been fixed. > > Under certain circumstances, Apache did not supply the right response > > headers when requiring authentication." > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1