September 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Nimda Worm - BugTraq
by Milan Goellner 20 Sep '01

20 Sep '01

>** is that true ? the readme executes without being explicitly opened? >** >** thank > >yes it's true >also it can getcha if you go tot a webpage that has been haxored by >these guys... all w/o your permission or even knowledge ( i.e. it >doesn't ask it just does it ) Only when using IE5.x without SP2 for any of the IE5.x Versions though. IE5.x's with their respective SP2s, IE4 and IE6 ask the user whether he/she would like to open or execute the javascript which gets you your personal copy of Nimda. The same principal applies to your readme.exe in your mail ... IE5.x without SP2 simply executes, all other IE's ask. If the user now hits YES ... you'll end up with some major extra hours cleaning your systems. Mit freundlichen Grüßen / Kind Regards Milan Goellner Network Technician ---------------------------------------------------------------- Compu-Shack Electronic GmbH Ringstrasse 56-58 56564 Neuwied Germany Telefon +49/(0) 26 31-9 83-962 Email milan.goellner(a)compu-shack.com http://www.compu-shack.com

2 1

RE: [suse-security] port based routing
by Andreas Achtzehn 20 Sep '01

20 Sep '01

> From: Vicente Arteaga [mailto:varteaga@competitiveness.com] > > You can masquerade incoming packets to port 22 of your ISDN > line, to your server. > > Automaticaly, the server will get replies and send them back > through the ISDN line. > Dear Vicente, thank you for your answer first. But what would I have to do to masquerade the connection? What would the commands for a SuSE 7.2 based system look like? The routing table looks like this right now: 1.2.3.4 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP) 1.2.3.5 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP - Gateway provider) 1.2.3.6 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP of outside server) 192.168.200.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 192.168.200.240 0.0.0.0 UG 0 0 0 eth0 The iptables rules look like this right now: iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -j MASQUERADE -o ippp0 (masquerade connections to the outside world) iptables -A INPUT -s ! 192.168.200.0/24 -p tcp --destination-port 110 -j REJECT (deny connections to POP from outside) iptables -A INPUT -s ! 192.168.200.0/24 -p tcp --destination-port 6000 -j REJECT (deny connections to XServer from outside) iptables -A INPUT -s 192.168.200.0/24 -p tcp --destination-port 111 -j ACCEPT (allow connections to NFS from inside) iptables -A INPUT -s 1.2.3.6 -p tcp --destination-port 111 -j ACCEPT (that's a server in the outside world that I connect via NFS) iptables -A INPUT -p tcp --destination-port 111 -j REJECT (allow outside world to connect NFS) Would adding the following rule be sufficient? iptables -t nat -A POSTROUTING -s ! 1.2.3.6 -j MASQUERADE -o eth0 Thanks in advance! Andreas -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

1 0

port based routing
by Andreas Achtzehn 20 Sep '01

20 Sep '01

Hello everybody! For a server I need the following feature: I have two dedicated lines connected to it. One is ISDN-based (64 kbit/s) the other is a DSL-line (768 kbit/s downstream). The ISDN-line has a static IP, the DSL-line's IP is dynamic. In order to connect the server from the outside world I need kind of a port based routing. Following example: The server has a SSH-server running. I want to connect the server over the ISDN-line (I don't know the DSL IP). The server receives my connection packets and tries to return packets. Those packets are sent over the DSL-line, since it's the default gateway. This way the connection fails. What I need is kind of a port based router. If the server tries to send packets coming from port 22 (SSH) it has to use the ISDN line. Is it possible to do this in any way? Regards, Andreas -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

2 1

WEB IIS cmd exe requests
by Togan Muftuoglu 20 Sep '01

20 Sep '01

Hi, I thought Code RED was slowing down :-( Other then getting the regular GET "default.ida" requests I have been logging things like this for the last two hours from different IP's. 1) Anyone else getting similar things or is me ? 2) Is it worth to bother sending these logs to the provider of the ip's ? TIA Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 Sep 18 16:50:39 gardiyan last message repeated 3 times ::ffff:212.209.96.133%134580160 - - [18/Sep/2001:16:50:12 +0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:13 +0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:14 +0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:15 +0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:17 +0300] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:19 +0300] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:20 +0300] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:25 +0300] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" -- Togan Muftuoglu

10 12

Re: [suse-security] router / ipchains
by Markus Gaugusch 20 Sep '01

20 Sep '01

> would a proxy server not be more appropriate in this situation? it just wouldn't help (enough) . if firewall and other pc's are in the same subnet, only bridging can help. It should be like this: Internet->Firewall->PC's But it is like |>PC1 |>PC2 |>PC3 |>... Internet->| | | |>Firewall They are in parallel, so the firewall can't filter the packets for the PC's. A proxy would make it more secure, but not enough. -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

IPSEC - WIN2000
by Schulz, Wolfgang 20 Sep '01

20 Sep '01

Hello! We are using IPSEC (on SuSE 7.0) already for a VPN to another location of our company. I would like to setup the IPSEC gateway also to handle road warriors which are using Win2000 machines. I read that - PGPnet is not available for Win2000 - version 1.4 of IPSEC (which is on the 7.0 distribution) should be patched to work with PGPnet. Are both statements correct? Does anyone have experiences with other ipsec clients than PGPnet for Win2000? Which are available for Win2000? Which are recommended for Win2000? Thanks Wolfgang

2 1

Antwort: [suse-security] router / ipchains
by christian.burri＠synecta.ch 20 Sep '01

20 Sep '01

I suggest you talk to your ISP about giving your DSL router an IP- Address outside of your Network. This way the DSL router would have its external interface on that "outside" subnet. I would suggest a private range IP for the DSL router's internal IF. 10.X.X.X or so. The FW gets a 10.X.X.X on its external, and the DSL router must be configured to route traffic for your subnet to the FW's external IF. The Firewall routes all outbound traffic (default route) to the DSL router. The FW's internal IF must be part of your subnet, and that interface is then the default gateway for your network. Your ISP needs to give your DSL router an IP outside of your Subnet for this to work, tho. HTH Chr. Burri .-. /v\ L I N U X // \\ >I know Kung Fu!!< /( )\ ^^-^^ Hi all! I want to protect our network with a firewall that should run on a SuSE machine (kernel 2.2 stable). There is a router that provides a permantent DSL connection to the net. Normaly this router is the gateway for all machines on the local net - but not I want to put a firewall between. The network has official ip addresses and all machines shall use these, which means that I do not want to have masquerading. So I have put the firewall machine between router and local net. I have switched on ip_forwarding and - for testing - have set up all ipchains to ACCEPT. Now it should route/forward everything, yes? But it doesn't. I can ping the firewall machine both from outside and from inside. But I cannot reach another host in the network from outside (and the other way around). When I try to ping a host in the network from outside I get a answer from my dsl router that this host is not reachable. Maybe the problem is here, I don't know... Do you have an idea? Thanx a lot! Michael -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

ipchains code for strings (from: Re: [suse-security] WEB IIS cmd exe requests)
by Fluffy Bananachunks 19 Sep '01

19 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 18 September 2001 10:27 am, you wrote: > I have this for the older ones: > $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state > --state ESTABLISHED -j REJECT --reject-with tcp-reset After searching google and man, I'm guessing that there's no equivalent for ipchains, and that a second tool such as Snort or the like would need to be used in my case...? TIA geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7qHIXo2oOGEnz8fYRAgViAJ0SwBbTHUzRDbP78ef76/8xh1NpBgCgtxbR Z9CDeyCVfKvJ4wgImLANIQo= =xk6Y -----END PGP SIGNATURE-----

5 4

Nimda Worm - BugTraq
by Sp0oKeR 19 Sep '01

19 Sep '01

Hey, We have been receiving reports of a new worm from a large number of users. Instead of deluging BUGTRAQ with traffic more appropriate for INCIDENTS, we are posting a summary of the worm and the vulnerabilities it exploits: A new worm named W32/Nimda-A (known aliases are Nimda, Minda, Concept V, Code Rainbow) began to proliferate the morning of September 18, 2001 on an extremely large scale that targets the Microsoft Windows platform. It attempts to spread via three mechanisms; as an email attachment, a web defacement download, and through exploitation of known IIS vulnerabilities. Collateral damage include network performance degradation due to high consumption of bandwidth during the propagation process. There have been reports of Apache Servers being inadvertantly affected by Nimda by being subjected to a denial of service condition (the configuration of these servers is not known). This worm takes advantage of multiple vulnerabilities and backdoors. The worm spreads via e-mail and the web. Through the e-mail vector, the worm arrives in the users inbox as a message with a variable subject line. The e-mail contains an attachment named 'readme.exe'. This worm formats the e-mail in such a way as to take advantage of a hole in older versions of Internet Explorer. Outlook mail clients use the Internet Explorer libraries to display HTML e-mail, so by extension Outlook and Outlook Express are vulnerable as well, if Internet Explorer is vulnerable. The hole allows the readme.exe program to execute automatically as soon as the e-mail is previewed or read. Once it has infected a new victim, it mails copies of itself to other potential victims, and begins scanning for vulnerable IIS Web servers. When scanning for vulnerable IIS servers, it attempts to exploit the Unicode hole (bid 1806) and the escaped characters decoding command execution vulnerability (bid 2708). It also attempts to access the system via the root.exe backdoor left by Code Red II. Once it finds a vulnerable IIS server, it installs itself in such a way that visitors to the now-infected web site will be sent a copy of a .eml file, which is a copy of the e-mail that gets sent. If the victim is using Internet Explorer as their browser, and they are vulnerable to the hole, they will execute the readme.exe attachment in the same way as if they had viewed an infected e-mail message. Attack Data: Examination of the worm reveals the following attack strings used to exploit IIS Web servers. '/scripts/..%255c..' '/_vti_bin/..%255c../..%255c../..%255c..' '/_mem_bin/..%255c../..%255c../..%255c..' '/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%' '/scripts/..%c1%1c..' '/scripts/..%c0%2f..' '/scripts/..%c0%af..' '/scripts/..%c1%9c..' '/scripts/..%%35%63..' '/scripts/..%%35c..' '/scripts/..%25%35%63..' '/scripts/..%252f..' To those strings are added /winnt/system32/cmd.exe?/c+dir Other attacks include: '/scripts/root.exe?/c+dir' '/MSADC/root.exe?/c+dir' It is believed that all of the vulnerabilities exploited by this worm are known. The links below provide fix information. Administrators and users are advised to apply patches as soon as possible. If further analysis concludes that other vulnerabilities are involved, updated information will be posted to the list. See: Bugtraq ID: 2524 / CVE ID: CAN-2001-0154 Microsoft Security Bulletin MS01-020 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS01-020.asp VulDB: http://www.securityfocus.com/bid/2524 Bugtraq ID: 2708 / CVE ID: CAN-2001-0333 Microsoft Security Bulletin MS01-026 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS01-026.asp VulDB: http://www.securityfocus.com/bid/2708 Bugtraq ID: 1806 / CVE ID: CVE-2000-0884 Microsoft Security Bulletin MS00-078 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS00-078.asp http://www.securityfocus.com/bid/1806 Microsoft IIS Lockdown Tool: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsoluti… s/security/tools/locktool.asp References: Symantec W32.Nimda.A@mm http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html McAfee W32/Nimda@MM http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 Sophos W32/Nimda-A http://www.sophos.com/virusinfo/analyses/w32nimdaa.html For discussion of infection or attack attempts, subscribe to the INCIDENTS mailing list. For discussion of the worm itself and others, FORENSICS and FOCUS-VIRUS are more appropriate than BUGTRAQ. --- Dave Ahmad Security Focus www.securityfocus.com -------------------------------------------------------

4 3

Re: [suse-security] IPSEC - WIN2000
by michael.ryan＠storm.ie 19 Sep '01

19 Sep '01

I use SafeNet/Soft-PK v5.1 for my W2K Pro laptop users to allow them establish secure VPN connections to a SuSE 6.4 gateway running FreeS/WAN 1.4 It's pretty reliable once you manage to get it configured. Regards, Michael "Schulz, Wolfgang" To: "SUSE (E-Mail)" <suse-security(a)suse.de> <W.Schulz@ove cc: .at> Subject: [suse-security] IPSEC - WIN2000 09/19/2001 03:58 PM Hello! We are using IPSEC (on SuSE 7.0) already for a VPN to another location of our company. I would like to setup the IPSEC gateway also to handle road warriors which are using Win2000 machines. I read that - PGPnet is not available for Win2000 - version 1.4 of IPSEC (which is on the 7.0 distribution) should be patched to work with PGPnet. Are both statements correct? Does anyone have experiences with other ipsec clients than PGPnet for Win2000? Which are available for Win2000? Which are recommended for Win2000? Thanks Wolfgang -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0