May 2001 - openSUSE Security - openSUSE Mailing Lists

man segfault
by Togan Muftuoglu 15 May '01

15 May '01

Hi I have read this on the securityfocus >Heap Based Overflow of man via -S option gives GID man. > Due to a slight error in a length check, the -S option to > man can cause a buffer overflow on the heap, allowing redirection of > execution into user supplied code. > man -S `perl -e 'print ":" x 100'` >redhat 7.0 with man-1.5h1-10 (default > package) and earlier. but running it on suse with man-2.3.10d69s-190 I also get the same thing $ man -S `perl -e 'print ":" x 100'` sometext Segmentation fault -- Togan Muftuoglu

1 0

Using SuSEfirewall for the internal lan
by Togan Muftuoglu 15 May '01

15 May '01

Hi I am getting 1 of probes to port 80 since yesterday to my home network which consists of SuSE 7.1 firewall/router serving 3 1 which are also running SuSE 7.1 and 1 Windows 98 laptop. Although firewall/router has ipchains blocking for all ports except forwarding port 25 can using ipchains firewall in the masquareded 5 increase my security and if so how will it affect the performance. I am planning to use Marc's SuSEfirewall-4.6 but I could not figure out what is my dev_world if I just say eth0 then it will get the address of the NIC but that is not how the packets are coming to the 0 lan since it is masquared. Any guidance is 0 TIA -- Togan Muftuoglu

1 0

Obtuse smtp
by Togan Muftuoglu 14 May '01

14 May '01

Hi I have enabled fort portwarding for port 25 on the firewall. I have the sendmail running on the masquareded machine 192.168.1.3. I have edited the inetd.conf as it says in the INSTALL smtp stream nowait root /usr/sbin/smtpd smtpd I have restarted inetd started smtpfwdd and this is what I am receiving in the messages smtp/tcp(2) bind:adress already in use ???? 1)I have chagned the sendmail option to -q10m in sendmail.rc.config 2) I could not find an init script for smtpfwdd 3) In order to use the anitspam rules it says smtpd should be compiled with CHECK_ADDRESS=1 is this the case for Suse TIA -- Togan Muftuoglu

2 2

Re: [suse-security] Kernel RPMs
by Roman Drahtmueller 14 May '01

14 May '01

> > Hi together, > > ftp://ftp.suse.com/pub/suse/i386/update/6.4/kernel/RPMs/ > > 7. To avoid complaints from the kernel about an old mount, update the > > util-linux (util for 7.0 and older), too, using rpm -Uhv <packname>. > > is the util-package "util-2.11b-0.i386.rpm" correctly packaged? > I'm missing 'setserial' after update. Right. This needs to be changed. Thanks for the note. > > Peter Wiersig > Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

3 3

RE: [suse-security] vanished user accounts?
by Marco van Beek 14 May '01

14 May '01

You may also find that the system is saving the username/group as a number, and simply recreating the user doesn't mean they inherit the old permissions. I have noticed that when using YaST it often deletes and re-adds when you edit a username or group. Marco van Beek. -----Original Message----- From: Peer-Christoph Mettelem [SMTP:Peer-Christoph.Mettelem@bezreg-muenster.nrw.de] Sent: Monday, May 14, 2001 11:53 AM To: suse-security Subject: RE: [suse-security] vanished user accounts? never use test as username, dirname or something. It's a command and may cause problems. -----Original Message----- From: Night Watcher [mailto:theeagle84@hotmail.com] Sent: Monday, May 14, 2001 12:43 PM To: suse-security(a)suse.com Subject: [suse-security] vanished user accounts? Hi all, i have the following problem on my three suse 7.0 and one 7.1 box, after a while when i wanted to log in under my test account, the message was, cannot switch to homedir (no access or something) i relogged in under my root account and then i wanted to correct this problem, i used midnight commander to look where the directory and user permissions of the /home/test account were, these stuff were correctly displayed: i found out that all the permissions still belonged to user test, this was very strange in my opinion, i thought well that is not right but reinstall might help, so i did that, and then my other three boxes suddenly displayed the same problem, all after 2 to 3 weeks, i am pretty sure that i didn't change the userpermissions on the machines ( i can make an mistake but not on 4 machines :)*) so i am guessing that it's an bug, removing the users and readding them does NOT work, so anyone, can u help me? or someone of the SuSE team : is this correcT? met vriendelijke groeten, with kind regards, Remko JC @ irc.super-chat.nl (tech-Admin) NightWatcher @ irc.grunn.org / irc2.grunn.org (IRCoperator) [DrL] Member [Grunn] Coders [Zyber] /* hope the day after you die is an nice one */ niets uit deze mail mag worden gecopieerd of aan derden gelezen laten worden zonder toestemming van de auteur. al deze emails vallen onder briefgeheim. wetboek van strafrecht. Nothing from this mail may be duplicated of may be read by others then the target name. you need authorization from the owner to duplicate it. these mails are secure and restricted confirming the dutch book of law _________________________________________________________________ ________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. ----------------------------------------------------------------- ---- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

The curiose Mysql Problems
by Thomas Nowak 14 May '01

14 May '01

Hi list, May its a little bit OT but I don't understand the follow facts: First of all I usinig SuSE 6.4 and mysql. A nice feature of SuSE is the cleaning script which deletes file from the /tmp directory if they are not owned by root. The first Problem is, that mysql has in the standard installation his socket file in this location which is owned by the mysql user so this file is removed after one week. ( I havend found this error in the SuSE Support DB ! ) So I have put the socket file to /var/run ( In my opinion it should the perfect place ) :-) With "/sbin/init.d/mysql start" all is OK, but after each restart mysql will not automatic start. I had found that this is becaus the /var/run directory ist owned by root.uucp and has 775 pemissions, so mysql can't create the socket file as user mysql! But what is the great difference betwwen the start of the script /sbin/init.d/mysql from init and by "hand" as root In both cases I should be root or not? Bye Thomas

1 0

Kernel RPMs
by Roman Drahtmueller 14 May '01

14 May '01

Hi together, As some of you may have seen, I've just put the kernel RPMs for the Intel i386 distributions 6.3, 6.4, 7.0 and 7.1 in place. You can find them at ftp://ftp.suse.com/pub/suse/i386/update/6.3/kernel/RPMs/ ftp://ftp.suse.com/pub/suse/i386/update/6.4/kernel/RPMs/ ftp://ftp.suse.com/pub/suse/i386/update/7.0/kernel/RPMs/ ftp://ftp.suse.com/pub/suse/i386/update/7.1/kernel/RPMs/ for download. The announcement is waiting to be published, but you get the preliminary version. A kernel update is not rocket science, but it is more sensitive than exchanging a package that you have never heard of for a stupid tempfile race. You should carefully follow each step before you reboot your machine for the freshly installed kernel to become active. We decided to update the kernel packages on all supported distributions to the most recent version 2.2.19 instead of fixing the known security bugs with patches. Tons of other problems have been fixed with the release of the 2.2.19 kernel, and we believe that this is the most stable kernel in the 2.2 release row. To find out which package to download use the command rpm -qf `awk '/^image =/ { print $3 }' < /etc/lilo.conf` Additional stuff can be found in the respective misc/ directory under ftp://ftp.suse.com/pub/suse/i386/update/<distvers>/kernel/misc, such as the .config used for kernel configuration, the output of the compile run and the specfile for the RPM packages. To install the kernel, proceed as follows: 1. Download the kernel rpm for your installation. 2. Install the kernel using the command rpm -Uhv k_deflt.rpm or whatever the command necessary for your installation (see above). It may be necessary to either deinstall the old kernel package and modules package or to use the "--force --nodeps" commandline options for rpm in addition to -Uhv. 3. If you use an Adaptec aic7xxx scsi host adapter, please change "aic7xxx" in INITRD_MODULES on top of /etc/rc.config to read "aic7xxx_old". 4. Execute mk_initrd An error indicates that the initrd is not written to disk. It is possible that your machine will not boot if you have a scsi system. 5. Execute lilo If you did not change the line starting with "initrd" in /etc/lilo.conf, then the freshly created init-Ramdisk will be loaded together with the kernel by lilo upon system boot. This initrd contains the drivers that are necessary for the kernel to mount the root filesystem of the system. On scsi systems, you can't boot without the modules contained in the initrd. 6. If you use lvm, update the lvm package as well. It is contained in the same directory as the kernel rpms. 7. To avoid complaints from the kernel about an old mount, update the util-linux (util for 7.0 and older), too, using rpm -Uhv <packname>. 8. The 7.0 distribution contained a bug in the glibc that is triggered by 2.2.19. The bug may result in mounted nfs filesystems to report -EIO when listing directories in some rare cases. Get the update package for shlibs (the other sub-packages are not needed) from i386/update/7.0/a1/shlibs.rpm, and install it, again, using "rpm -Uhv <packname>". Keep your machine in a quiet state during this upgrade; if at all possible, bring the machine into single user mode, using the command "init 1" Execute "ldconfig" after completion of the rpm command. 9. Execute init 6 or shutdown -r now # which is the same without warning ...and if it fails, drop me a mail, please. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

7 15

https
by Dietmar Strasdat 14 May '01

14 May '01

Hello suse-security-list, i have installed a suse 7.0 with squid 2.3 stable 3 and Marcs firewall script 4.5. For ftp is proxy suite installed and so long it works fine. But i can t connect to a https url. in firewall.rc.config: FW_SERVICES_INTERNAL_TCP="22 25 53 80 110 119 443 3128" Any hints? -- Best regards, Dietmar mailto:earthmate@gmx.net

1 0

Re: [suse-security] shadow doesn't work anymore with kernel 2.2.19
by Togan Muftuoglu <toganm 13 May '01

13 May '01

* Thomas Schweikle <tschweikle(a)fiducia.de> [010514 02:30]: > In this case someting must have gone wrong updating KDE, Kernel, and X. Any > hint, where I might look? I do not know the answer and its better to hit reply all so the list gets the mail as well incerasing your chance to get answer -- Togan Muftuoglu

1 0

shadow doesn't work anymore with kernel 2.2.19
by Thomas Schweikle 13 May '01

13 May '01

Hi! I've noticed shadow not working anymore since I've installed kernel 2.2.19. Passwords changed will be entered into /etc/passwd directly, even if the shadow-package is installed. Anyone else noticed this? -- Thomas

2 1