July 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] unwanted virus infected email spam
by Sven Michels 18 Jul '01

18 Jul '01

> although I don't know where you edit sendmail.cf (probably have to recompile > it) > > but... > > When you find out HOW. Ya ought to add these too: > > I'd allow > *.JPG,*.JPEG,*.PNG,*.GIF,*.ICO,*.WMF,*.EMF,*.VCF,*.EML,*.MSG afaik allowing .eml is not a good idea, outlook forwards a mail as an eml attachment, including all content of the mail, also the attachments... just my 2 cents :) Sven

2 1

Re: [suse-security] unwanted virus infected email spam
by Martin Leweling 18 Jul '01

18 Jul '01

Hi Michael, On Wednesday 18 July 2001 16:35, you wrote: > Michael/Martin > > Thanks for the replies and info :) > At this point, I am strongly considering whether to simply reject all mail > with .scr or .vbs attachments - presumably, this requires an edit to my > sendmail.cf file ... question now is where/what exactly do I need to > change? ;) > > Tnx, Michael Hehehe, while we're at it, I just got this funny mail immediately after posting to suse-security: "VIRUS ALERT - your computer may have been infected From: Mail Delivery System <Mailer-Daemon(a)owat.kis.keele.ac.uk> To: lewelin(a)uni-muenster.de **** IMPORTANT NOTICE **** The mail system at Keele University has received a message from you which appears to contain the Hybris virus. You are probably unaware that the virus has used your mail account to send a message as it does it secretly. You should contact your systems administrator who can advise you on what action to take to fix this problem." It seems they are running some kind of virus checker (AMAVIS?) and the "HYBRIS" string in my email triggered this respone. Damn, I did it again ... ;-) Obviously, my machine is NOT infected since it's runnng SuSE ... ;-) Judging from this response, running a virus checker as a filter on your mailing system should solve the problem ... Regards, Martin -- Martin Leweling Institut fuer Planetologie, WWU Muenster Wilhelm-Klemm-Str. 10, 48149 Muenster, Germany

2 1

Re: [suse-security] unwanted virus infected email spam
by michael.ryan＠storm.ie 18 Jul '01

18 Jul '01

Michael/Martin Thanks for the replies and info :) At this point, I am strongly considering whether to simply reject all mail with .scr or .vbs attachments - presumably, this requires an edit to my sendmail.cf file ... question now is where/what exactly do I need to change? ;) Tnx, Michael Martin Leweling <lewelin@uni-mu To: michael.ryan(a)storm.ie, suse-security(a)suse.com enster.de> cc: Subject: Re: [suse-security] unwanted virus infected email spam 07/18/2001 03:30 PM Please respond to lewelin Hi, On Wednesday 18 July 2001 15:39, michael.ryan(a)storm.ie wrote: > (kind of off topic) > Has anyone been receiving periodic emails with virus infected attachments > from an address proporting to be hahaha(a)sexyfun.net? Yes. I've got three of them during the last three days. This is a virus worm known as "Hybris". It's modular nature makes allows for uploading new "features" all the time. > It is really annoying me at this point because this w**ker seems to be > sequentially trying all combinations ********(a)storm.ie and I am getting a > couple of quarantine notifications every week from the antivirus software > on our mail server. > > I did try adding a REJECT rule for hahaha(a)sexyfun.net to /etc/mail/access - > this seemed to work for a week or two but the problem has since returned. > Any ideas as to what I might try next as this kind of mindless activity > really does my head in ... Blocking this email-Adress won't help, because there are other senders with the same virus. The subject line and attachment names are also highly variable. The only solution to identify it is to run "strings" on the attachment and looking for the appearance of the string "HYBRIS". > > Thanks, > > Michael Regards, Martin -- Martin Leweling Institut fuer Planetologie, WWU Muenster Wilhelm-Klemm-Str. 10, 48149 Muenster, Germany -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

scan outgoing mail free software
by angela 18 Jul '01

18 Jul '01

Hi Do you have scan outgoing mail free software? Thank you Angela

1 0

Strange Log Message
by Richard Ibbotson 18 Jul '01

18 Jul '01

Dear All Just installed a new SuSE 7.1 machine and installed the updates as well. The machine was disconnected from the network when I installed it. I'm getting an unusual message on the console which says..... Packet log: output DENY ippp0 PROTO=17 xxx.xxx.xxx.xxx: 61417 194.247.47.47 L=78 S=0x00 I=36552 F=0x4000 T=63 (#5) Both the 61417 and the 36552 numbers rise all of the time to the next one and then drop back down to another one. Also getting ........ IP_MASQ: lp_fw_masquerade(): change masq.addr from xxx.xxx.xxx.xx to xxx..xxx.xxxx.xx. Both these addresses are on this machine. One of them is eth0 and the other is the address of the machine. Seen this on every SuSE 7.1 machine that I've installed. Anyone know what to do about it ? Thanks -- Richard

1 0

Snort
by Richard Ibbotson 18 Jul '01

18 Jul '01

Dear All I've installed snort from the SuSE RPM package and changed a few things in /etc/snort/snort-lib as the installation notice told me to. Thing is .... how do I get the snort alert messages to show up on the console under /var/log/messages ? Can I do that by changing something in snort-lib ? Thanks -- Richard

2 1

tis and plug-gw to more than 1 Port 80
by brina30＠gmx.li 17 Jul '01

17 Jul '01

Hi all, I have a firewall with SuSE 7.1 und I am using the TIS FWTK. In my net there are 2 Webserver: 192.168.99.1 192.168.99.2 and my problem is, that I have to plug the port 80 on two different IP's The following way in the netperm-table is not working -----schnipp------------------------ plug-gw: 80 : -plug to 192.168.99.1 plug-gw: 80 : -plug to 192.168.99.2 -----schnapp------------------------ I get the message that port 80 is already in use. I am happy about every tip. Bye Brina -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net GMX Tipp: Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a

1 0

Re: [suse-security] temp directories /home/tmp /tmp several questions.
by Sven Michels 17 Jul '01

17 Jul '01

> Unfortunately, the article fails to mention that the noexec mount option > is basically useless. > > $ /lib/ld-linux.so.2 /bin/echo eins > eins > $ > > ...while /bin is on a noexec-mounted filesystem. jup but the most exploits will be stopped by a noexec tmp cause the 'kiddies' are to stupid to fix that ;) but in general, its not usefull... Sven

1 0

Suse firewall script question
by maillist 17 Jul '01

17 Jul '01

Hello I´m trying to set up a linux firewall box with 3 network devices. The first points to the internet gateway, the second to the DMZ(192.168.1.x) and the third to the internal network(192.168.2.x). I´m using Suse 7.0 and have installed the firewall script and squid proxy server. The squid runs fine html,ftp works. In the firewall script I have disabled routing and masquerading. Now I want to ping the internet from my internal network. But no request gets an answer. I have set the following options to yes fw_allow_ping_fw = yes fw_allow_incoming_highports_udp=yes fw_allow_fw_traceroute=yes Referencing to the technical dokumentation these 3 options set to yes allows the icmp ping to pass the firewall. But it didn´t work :-( Has anyone an idea? Thx for any help Regards Björn Berger

6 7

Possible compromised service
by John Bland 17 Jul '01

17 Jul '01

Hi, A German warez group (from what I have been able to track down) has been uploading files to our server. The problem is that they've been appearing in our ftp incoming directory *but not through our ftp daemon*. Any such connections would have logged and they haven't been. Neither were any ftpd processes seen running at a time when files were actively being uploaded. This (to my untrained eye) points to a compromised network service of some description. First things first is this the right place to discuss such things or would there be somewhere more relavent? I'm running SuSE 7.1 with a self compiled 2.4.2 kernel, and running apache 1.3.19, proftpd 1.2.2rc2, openssh 2.5.1p1, telnet, postfix-20010228pl03-9, qpopper-3.1.2, nfs-2.2, pidentd 3.1a17, samba 2.0.10, lprng 3.7.4, netatalk 1.4.99, portmap 5beta, XFree86 4.0.2 + kdm/kde2 2.1.1. Some of which being compiled from 7.2ftp source rpms but the same exploit was taking place with standard 7.1ftp. As I'm running SuSE packages which have no known exploits that I can see this is worrying for me and a potential worry for other SuSE users. I've spent all day on a wild goose chase but hopefully tomorrow I'll be able to find more information (I'm tcpdumping all network traffic atm, so it just needs correlating the time files are uploaded with the traffic going on at the time, a lengthy process on a busy server ;0). Any help will be greatly appreciated, John Bland -- John Bland M.Phys (Hons) AMInstP / \ PhD Student & Sys Admin Email: j.bland at cmp.liv.ac.uk / \ Condensed Matter Group http://ringtail.cmp.liv.ac.uk/ / \ Liverpool University "Hey, I wonder how much meat you get on a womble?" -- Eddie

2 3