April 2001 - openSUSE Security - openSUSE Mailing Lists

FW: [suse-security] Authentication eror
by Joakim Schramm 19 Apr '01

19 Apr '01

-----Original Message----- From: Joakim Schramm [mailto:hostmaster@astrocalc.net] Sent: Thursday, April 19, 2001 11:12 PM To: Alexander Bien Subject: RE: [suse-security] Authentication eror Hi, > > > Is this happening on non-protected pages as well ? Only when trying to access pages though authentication, if switched off pages accesses fine. You can try here http://mb.astro.nu to see the error received. I have tried to put the auth directives both in .htaccess and direct in a <Directory /aaa/bbbb/ccc> inside the VirtualHost configuration, with same result. > Are u sure it isnt a Memory Leak? Well how can I? I know my own memory leak from time to time, but the computers... well I'm just good at other things... > > A small sidenote : > Lets say u install a fres suse7.0 system, with apache 1.3.12, openssl, > php4 and mod_perl.. > Then u update from ftp.suse.com and install the new php4, the new > mod_perl and the new apache 1.3.17 > > U wount be able to start apache again, unless u update openssl from > ftp.suse.de. All this was done, but the segfault was there already in 1.3.12 according to the log. > The child's will either just segfault or it wount start at all.. > well they segfault although done all above... > It took me a while to remind myself to look on ftp.suse.de to get my > machines working again.. So maybe this posting prevents others from same > havok. > Well although not there yet, your post have at least given me some hints of what may could be wrong... I'm just not sure of what a segmentation fault is in this case. Can someone explain it a bit? may furtilize the mind futher... > Alex Thanks, Joakim > > -----Original Message----- > > From: Joakim Schramm [mailto:hostmaster@astrocalc.net] > > Sent: Thursday, April 19, 2001 9:23 PM > > To: suse-security > > Subject: [suse-security] Authentication eror > > > > > > Hi, > > > > not sure if this is the right list or if suse-linux-e is more > > proper, but.. Every time I try to access my password > > protected pages, it errors and write to the httpd error_log: > > [Thu Apr 19 14:51:04 2001] [notice] child pid 27916 exit > > signal Segmentation fault (11). > > > > I traced in the log and found it goes back to the install of > > SuSE 7.0, then with apache 1.3.12 and later updated to > > 1.3.17. Instead of updating my old 6.4 distro, I backed up > > all user and other important files and did a clean install on > > a new disk, which I formated with reiserfs instead of the old > > standard fs (not boot though), and then put back all files as > > web, user dir structure, password files etc etc and have > > thought I got it all right. But as I was about to update my > > website I notced the authification didn't work and probably > > havn't since install. > > > > Can anyone give a hint on this? is it the reiserfs, or the > > AuthUserFile file gone corrupt and can it then be "fixed" ? I > > have searched all over for something on "segmentation fault" > > but havn't come close to my case. Although the release notes > > of apache 1.3.19 talks someting about a bugfix of a possible > > segment error when accessing authentication, I'm not sure this is it. > > > > tanks, > > Joakim > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 1

Re: [suse-security] Bind again
by semat 19 Apr '01

19 Apr '01

Please do strace ip <pid> on your named process until the point when it dies and post your output. On Thu, 19 Apr 2001, Hipolito A. Gonzalez M. wrote: > semat wrote: > > > What bind are you using? > > 8-8.2.3 from Suse > > -- > www.geekcode.com > -----BEGIN GEEK CODE BLOCK----- > Version: 3.1 > GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- > M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ > h! r++ y++ > ------END GEEK CODE BLOCK------ > - A veces creo que hay vida en otros planetas, y a veces creo que > no. En cualquiera de los dos casos, la conclusi�n es asombrosa > (Carl Sagan) > ----------------------------------------------------------------- > > >

2 1

apache 1.3.19
by Hostmaster 19 Apr '01

19 Apr '01

Why isn't there an apache 1.3.19 update for SuSE 7.0? Isn't this "classified" as an security update/fix? at least is this what the apache release note says... as well as the 7.1 update page. I'm aware of the SuSE maintanace policy for older releases, but for gods sake I bougt 7.0 just a few months ago! and this was my 6th set of SuSE dist CD's and belive such important and widely used packet of the distribution should have a somewhat longer lifetime then a couple of months...? Thanks, Joakim Schramm >From 1.3.19 release notes: "Apache 1.3.19 Major changes The primary security fix is: The default installation could lead mod_negotiation and mod_dir or mod_autoindex to display a directory listing instead of the multiview'ed index.html.* files, if a very long path was created artificially by using many slashes. Now 403 FORBIDDEN is returned. The bug fixes are: The ServerRoot directive now removes trailing slashes. Restore functionality broken by the mod_rewrite security fix: The mod_rewrite string arithmetic is corrected for rewrite map. Some possible segfault conditions have been fixed. Under certain circumstances, Apache did not supply the right response headers when requiring authentication."

3 4

Authentication eror
by Joakim Schramm 19 Apr '01

19 Apr '01

Hi, not sure if this is the right list or if suse-linux-e is more proper, but.. Every time I try to access my password protected pages, it errors and write to the httpd error_log: [Thu Apr 19 14:51:04 2001] [notice] child pid 27916 exit signal Segmentation fault (11). I traced in the log and found it goes back to the install of SuSE 7.0, then with apache 1.3.12 and later updated to 1.3.17. Instead of updating my old 6.4 distro, I backed up all user and other important files and did a clean install on a new disk, which I formated with reiserfs instead of the old standard fs (not boot though), and then put back all files as web, user dir structure, password files etc etc and have thought I got it all right. But as I was about to update my website I notced the authification didn't work and probably havn't since install. Can anyone give a hint on this? is it the reiserfs, or the AuthUserFile file gone corrupt and can it then be "fixed" ? I have searched all over for something on "segmentation fault" but havn't come close to my case. Although the release notes of apache 1.3.19 talks someting about a bugfix of a possible segment error when accessing authentication, I'm not sure this is it. tanks, Joakim

2 1

RE: [suse-security] apache 1.3.19
by Joakim Schramm 19 Apr '01

19 Apr '01

Hi > Subject: Re: [suse-security] apache 1.3.19 > > > You can allways download an compile it yourself. > > -miah I can run for president as well, if I have the time and money... but this isn't the point. One of the main reasons I choosed SuSE a few years back when entering into the Linux world, was that it gave me the option of not needing to study to be a Linux guru, before running a smal production system, but could somewhat lean on my computer experience so far from the dos and windows world. The rpm format was perfect for me, as I don't have the time to dig too deep, although I sure have fiddled a lot with it... and learned. I have noticed two things though, the versions or distros replace eachother far quicker in Linux then Windows, for good and worse... and the SuSE distros don't like it too much if you opt in a traditional compile and install here and there... if you want your system somewhat clean, and things easily get broken. I think it's ok with the majority of packages if they not are maintained for features through the distros, but for certain of the more important, and tightly into SuSE integrated packages there ought to be an other policy, like with apache. I have updated my distro with new CD's 6 times and most of this times it been to be upto date with apache or sendmail. I been ok with that, but now I kinda start to hesitate as I havn't more then almost installed the latest and a new one is out and which I have to get fixing some security in one of the two most important packages. I made a choice some years ago based on my current situation and SuSE fitted me then, although it wasn't a system prefarably to run as web- and mail server, but maybe it's time for me to re-evaluate the situation of today and look around... mark, I am not complaining, just releasing my point of view in questioning. thanks, Joakim > > On Thu, Apr 19, 2001 at 06:48:15PM +0200, Hostmaster wrote: > > Why isn't there an apache 1.3.19 update for SuSE 7.0? Isn't this > > "classified" as an security update/fix? at least is this what the apache > > release note says... as well as the 7.1 update page. I'm aware > of the SuSE > > maintanace policy for older releases, but for gods sake I bougt > 7.0 just a > > few months ago! and this was my 6th set of SuSE dist CD's and > belive such > > important and widely used packet of the distribution should have a > > somewhat longer lifetime then a couple of months...? > > Thanks, > > Joakim Schramm > > > > >From 1.3.19 release notes: > > "Apache 1.3.19 Major changes > > The primary security fix is: > > The default installation could lead mod_negotiation and mod_dir or > > mod_autoindex to display a directory listing instead of the multiview'ed > > index.html.* files, if a very long path was created > artificially by using > > many slashes. Now 403 FORBIDDEN is returned. > > > > The bug fixes are: > > > > The ServerRoot directive now removes trailing slashes. > > Restore functionality broken by the mod_rewrite security fix: The > > mod_rewrite string arithmetic is corrected for rewrite map. > > Some possible segfault conditions have been fixed. > > Under certain circumstances, Apache did not supply the right response > > headers when requiring authentication." > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

[suse-security] su - problem
by Markus Kohli 19 Apr '01

19 Apr '01

I'll try to describe my prob in details: I log in as normal user xyz. I want to do somehting, I can only do as root, so I type "su". Prompt: Password: I enter my password. Answer: login incorrect. This happens always, everywhere. Who can help me. I've checked all the files that harden_suse changes (according to log-file)... Couldn't find anything. Any help? thx

3 2

Re: [suse-security] xntpd
by Roman Drahtmueller 19 Apr '01

19 Apr '01

Just in case you've received mails like the one in the attachment: I'm nuking such people from the list without any warning. This just happened with suchmaschinenmails(a)gmx.de a few seconds ago. *angry* Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

3 5

strange process
by Markus Roth 19 Apr '01

19 Apr '01

hello, does somebody knows what's going on? my problem: on the average twice per week a process remains suddenly hang on my laptop (SuSE 7.1 / 2.4.0). As soon as I do a ps or something similar this process hangs too. I straced the ps command and got following output: [snip] ipc_subcall(0x6, 0x816a308, 0x400, 0xd) = 480 stat64("/proc/1234", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 open("/proc/1234/stat", O_RDONLY) = 7 read(7, <unfinished ...> It seems that every command hangs (ps, fuser, killall, netstat -ap) that reads thru the proc file system and tries to open some files of the process 1234. If I try to 'cat' the file /proc/1234/stat the same thing happens. I'm am absolutely not sure, but I guess the process 1234 is httpd (apache 1.3.17 installed). Only if apache is running this seams to happen. Unfortunately I can't identify the process because every command I know reads from the proc file system. the bad thing is, I can't even reboot my machine because this tries to terminate the processes and hangs too nor can I unmount my partitions because they are busy. any ideas what this could be or what i should do? greetings & thanks markus

3 2

Problem with SuSEfirewall.
by Benjamin Grogg 19 Apr '01

19 Apr '01

G'day folks: Following problem : I want connect my Intranet to the Internet. All services must be available form the Intranet (Local network) to the Internet (all ports),but from the Internet to the Intranet all port must be blocked. If I stop the firewall I can connect and use (Samba, Apache...) my Linux server (192.168.1.1) form my Windows workstation (192.168.1.50) If I start the firewall I can't connect the server (Deny in the log file). But why? Here is the firewall.rc.config FW_DEV_WORLD="ppp0" FW_DEV_INT="eth0" FW_DEV_INT_eth0="192.168.1.0/24" # e.g. for internal interface eth0 FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" FW_KERNEL_SECURITY="yes" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" FW_PROTECT_FORM_INTERNAL="no" FW_TRUSTED_HOSTS="" FW_IP_SERVICES_TRUSTED="" FW_UDP_SERVICES_TRUSTED="" FW_SERVICES_INTERNAL_TCP="" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="" # Common: domain syslog FW_SERVICE_SAMBA="yes" # set to "yes" if this server uses samba as client FW_STOP_KEEP_ROUTING_STATE="yes" FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="yes" # Default FW_LOG_ACCEPT_ALL="no" FW_LOG_ACCEPT_ALL="no" FW_ALLOW_PING="no" FW_ALLOW_FW_TRACEROUTE="no" # Default no FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw user" Thx a lot! Benny

3 2

SuSE Security Announcement: sudo (SuSE-SA:2001:13)
by Thomas Biege 19 Apr '01

19 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: sudo Announcement-ID: SuSE-SA:2001:13 Date: Wednesday, April 18th, 2001 12.26 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: possible local root compromise Severity (1-10): 6 SuSE default package: no Other affected systems: all systems using sudo Content of this advisory: 1) security vulnerability resolved: sudo problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The setuid application sudo(8) allows a user to execute commands under the privileges of another user (including root). sudo(8) previous to version 1.6.3p6 is vulnerable by a buffer overflow in it's logging code, which could lead to local root compromise. There is no exploit known to be public. A useful workaround isn't possible, the only fix is to install the new sudo packages. Download the update package from locations described below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/sudo-1.6.3p6-3.i386.rpm b0d658c98effd4e11bed6d8c1f5f80f9 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/sudo-1.6.3p6-3.src.rpm a4b44f0998a165b3a69c598075420b7f SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/sudo-1.6.3p6-21.i386.rpm a002d657c7faf24b9fb5b430061e6c19 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/sudo-1.6.3p6-21.src.rpm d9ebc68015886fb642a1795e21bde788 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/sudo-1.5.9p1-79.i386.rpm 8a25b40ba081be885b214410b3c662ce source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/sudo-1.5.9p1-79.src.rpm 9a13efa0d76a4fe3cbda7dcd2e2befe0 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/sudo-1.5.9p1-80.i386.rpm a6e359c6449d764199bce3b7bc2867d8 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/sudo-1.5.9p1-80.src.rpm b89db78d5b8d04b10ac6e17c29cec1c4 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/ap1/sudo-1.5.9p1-79.i386.rpm c3fbbff2219bf948f9b209eefafab4fe source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/sudo-1.5.9p1-79.src.rpm 85ae3e3b9ef159201bb661e8f83e82d3 SuSE-6.1 Packets for 6.1 won't be available, sorry. Try to install the 6.2-RPM, please. Sprac Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/ap1/sudo-1.6.3p6-8.sparc.rpm 5531c5be20082b084e940d4e66dffea0 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/sudo-1.6.3p6-8.src.rpm 98fb9920e8de32727deb5e4295ee70d4 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/sudo-1.6.3p6-9.sparc.rpm cdd87431019ace22d0a2b0d46b294856 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/sudo-1.6.3p6-9.src.rpm 846035dcf0e42d22aac5d0dc77d90a02 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/ap1/sudo-1.6.3p6-12.alpha.rpm c0fea14a3c0e565892f150cf97d971ed source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/sudo-1.6.3p6-12.src.rpm 42651a443d7ca62415bc2d3ef3dc5bde SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/sudo-1.5.9p1-79.alpha.rpm 9a177de02176df90d8006fc7e8adae0d source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/sudo-1.5.9p1-79.src.rpm 9f52a3df082ba513cbc0af5da6cccbe4 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/sudo-1.5.9p1-79.alpha.rpm 5bbe1f211cb53758ad2840d192280269 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/sudo-1.5.9p1-79.src.rpm 4687f818ab5dbc50b1c0a3b907775f30 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/ap1/sudo-1.6.3p6-5.ppc.rpm 199a677423a84bc577a7a9199e5e22d4 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/sudo-1.6.3p6-5.src.rpm 49ed607375823b56d819e0610e3a8d31 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/sudo-1.6.3p6-10.ppc.rpm 03ffbcf07ba9a4222c75b162c97f9292 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/sudo-1.6.3p6-10.src.rpm a07d0b0283ca83e14c4d58ca9bcc933c SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/sudo-1.5.9p1-80.ppc.rpm b5c9dee89ee0101fa8ac5795c1e8e49c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/sudo-1.5.9p1-80.src.rpm bfc917660898fdf9f2de170895ca7b22 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - New RPMs for HylaFax, a Fax Server, are currently being build, which fix a format bug in hfaxd, which could lead to local root privilege. - NEdit a GUI-style text editor needs an update due to a tmp race condition. The source code is currently being reviewed and new RPMs will be available within the next days. - Updated man RPMs will be available in a few days. - In the past weeks, some security related bugs in the Linux kernel 2.2 and 2.4 were found. An announcement, that addresses this will be released this week. - Samba has serveral security problems, which could lead to local root access. Samba 2.0.8 fixes these problems. New RPMs are currently being build. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOt6upXey5gA9JdPZAQE56gf/ezpPVXpQRzpr8BLU1bVi476xG64cRdWs XEtnrjPHo6AJH1WpPM6ousQrYnP0PJW2yasmIg0zEVjQiiI3TmjxDayKKh5SaMmY zq4Gm98XAJotBN/pNszmjlWJ1kAfLllux2m1GC8d24adS87YPoRROgBLx3//RxRj DRsrw6wIEKIBfJkY1TMaS8lCT7Vdl5QhVsVDxKpygEtwwiSy2u0YKyRrfaY45vg4 M63exyEauwwn/Kyg79vQSbqI/u7dB2l9pW1TuMAy9BYZkkCJGKvaVUC/bnmMmTCx dYRl7yFX/C69bfNMb4BcSAmkPct/FN4Lvq8RF7nTy4eiKTjB+TOJvw== =mDVO -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

3 3