January 2002 - openSUSE Security - openSUSE Mailing Lists

Fwd: SuSE Firewall question
by Tim Harrell 28 Jan '02

28 Jan '02

Hello, Can I upgrade from using ipchains to iptables by using the SuseFirewall2 rpm from the 7.3 area (I am using 7.2 which doesn't have FW2)? Also, there is an upgrade to version 5.0 in the 7.3 updates area for the older (ipchains-based) SuSEfirewall. Why is this update not also in the 7.2 area? Does anyone know what this update is for? Regards, Tim Harrell <suse-ml(a)tharrell.com>

2 2

Re: [suse-security] Info: new email based virus
by JW 28 Jan '02

28 Jan '02

At 05:56 PM 1/28/2002 +0100, you wrote: >ok, you're right, was another (new?) virus, sorry for that. Yes, This isn't a hoax either - I just received notification on another mailing list (totally un-related to UNIX or security - for DV editing) from one of the member that they'd caught it and were afraid it may have been sent to the list before they stopped it. >here is the complete virus: >Subject: new photos from my party! > >Hello! > >My party... It was absolutely amazing! >I have attached my web page with new photos! >If you can please make color prints of my photos. Thanks! > > >>begin 666 www.myparty.yahoo.com >M35J0``,````$````__\``+@`````````0``````````````````````````` >M````````````````````@`````X?N@X`M`G-(;@!3,TA5&AI<R!P<F]G<F%M >M(&-A;FYO="!B92!R=6X@:6X@1$]3(&UO9&4N#0T*)`````````!010``3`$# >M`)(B4CP``````````.``#P$+`04``'`````0````T```X$P!``#@````4`$` > >(the > is added so that no client will interpret that as >attachment :) > > > >-- >intraDAT AG http://www.intradat.com >Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 >D - 60329 Frankfurt am Main Fax: +49 69-25629-256 > Junk mail is war. RFCs do not apply. > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

Info: new email based virus
by Sven Michels 28 Jan '02

28 Jan '02

Hi, for the whom it may concern: another email worm is moving around. The name is: W32/Myparty@MM Same like everytime. Seems to be some more dangerous for the drive c:\ cause it adds a format c: /y to the autoexec.bat. More infos: http://vil.nai.com/vil/content/v_99332.htm have a nice day ;) -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256 Junk mail is war. RFCs do not apply.

2 2

is washington imap secure
by Georg Gassner 28 Jan '02

28 Jan '02

Hi all I'd like to use the Washington IMAP server (Version: 2000c - 110) instead of POP3 on SuSE 7.3 but in the conf file following comment is given: # Imapd - Interactive Mail Access Protocol server # Attention: this service is very insecure my question is, should I use IMAP or rather wait for a patch? thanx Georg

4 4

glibc security update
by Christoph Egger 28 Jan '02

28 Jan '02

Hi! I updated glibc on my SuSE 7.3 system. But: bash: # rpm -U glibc.rpm package BIG5.so not found in file index package UNICODE.so not found in file index bash: # What does this message mean? Where can I find the two missing libs? -- CU, Christoph

1 0

openssl directory in suse 7.3
by Philipp Snizek 28 Jan '02

28 Jan '02

Hi all Just a dumb question: How can I found out where openssl is installed? whereis command sais /usr/bin/openssl, but this is not sufficient for squid 2.5 ssl support enabled. I'm looking for the headers and/or development directory. thanx Philipp

4 3

apache log
by Thomas Neukirch 28 Jan '02

28 Jan '02

hi list, a few month ago i changed my website from microsoft iis to linux/apache. the following line is in the access_log (same like in iis-log): 213.168.123.157 - - [24/Jan/2002:20:47:25 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 294 can anyone explain me whats going on here ? thank you

3 2

after ip ....
by Juan Carlos S.C 28 Jan '02

28 Jan '02

Ok, thanks whois is what I wanted. Now, what should I do? Is usefull to write an e-mail asking for an intrusion from that domain? I meant, sysadmin from ISP take care of that situation or simply drop this king of mail to /dev/null. Thanks again.

2 1

RE: [suse-security] after ip ....
by Barry Gill 28 Jan '02

28 Jan '02

::Good mail addresses to write to are root@, abuse@, ::postmaster@, webmaster@ or ::even info@. other good ones are also support@ and help@

1 0

SuSEFirewall2, smtp, nntp, telnet
by R. Ullenboom 28 Jan '02

28 Jan '02

Hi, got probs with configuring SuSEFirewall2 (SF2). Transparent proxiing (Squid) with Web-Browser works. Also Masquerading (ping_to_Internet) From some aacounts i can get eMail with my eMail-Client (Outlook) over Masq. But I can't send them. Even telnet through the Firewall for testing mail-traffic does not work. And at least I tried to get nntp over Squid-SSL and it does not work. Whats wrong with my configuration: Thanx 4 help and Here it is: FW_DEV_EXT="ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/16 10.0.0.0/16" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="25 80" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="23 25 53 110 119 3128" FW_SERVICES_INT_UDP="23 25 53 110 119" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/16 10.0.0.0/16" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="192.168.0.0/16,0/0,tcp,80,3128 192.168.0.0/16,0/0,tcp,21,3128 192.168.0.0/16,0/0,udp,80,3128 192.168.0.0/16,0/0,udp,21,3128 192.168.0.0/16,0/0,tcp,443,3128 192.168.0.0/16,0/0,udp,443,3128 192.168.0.0/16,0/0,tcp,563,3128 192.168.0.0/16,0/0,udp,563,3128" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="no" #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - I left them on default!! # # # #-------------------------------------------------------------------------#

2 2