October 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

> On Friday 11 October 2002 13:28, mailinglists(a)belfin.ch wrote: > > Who's sleeping here? > > This isn't neither nimda nor code red. This is a scan. it came from > > a dial up account. Nimda and Code red never came from dial up > > accounts. They always came from static IP addresses. > > Why nimda or code red _must_ come from static ip addresses? > Think of IIS installed on WinPCs which are 24/7 up and accessible via > DynDNS names. Such systems are vulnerable too... > We have do differentate between dhcp assigned ip addresses to always online internet links and old fashioned dial up accounts. The source of our scan looks very much like a dial up account: dig -x ip.address: 90.99.11.217.in-addr.arpa. 86383 IN PTR dialup-90.iberbanda.es. I've seen a lot of logs dealing with nimda and code red a year ago. But I never saw this coming from a dial up link. Philipp

3 2

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Who's sleeping here? This isn't neither nimda nor code red. This is a scan. it came from a dial up account. Nimda and Code red never came from dial up accounts. They always came from static IP addresses. (Thanks, Thomas, for your suggestion.) Philipp > -----Original Message----- > From: Wolfgang Kueter [mailto:wolfgang@shconnect.de] > Sent: Friday, October 11, 2002 3:51 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] does anybody know such a log > > > On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: > > > Hello > > > > our reverse proxy picked this up > > > > [typical Nimda Code Red stuff] > > Is there some new IIS/Windows worm spreading? > > New? How deep have you been sleeping during the last 14 months? The > requests you see are typical Code Red and Nimda requests. > > http://www.google.de/search?q=msadc+Nimda&ie=UTF-8&oe=UTF-8&hl > =de&btnG=Google-Suche&meta= > > You might like to tell you proxy to block these though the > requests don't > harm Apache. > > Wolfgang > -- > shconnect Internet Service > web: http://www.shconnect.de EMail: info(a)shconnect.de > Bundesstrasse 2, 24392 Dollrottfeld, Fed. Rep. Germany > phone: +49 4641 644 > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

4 3

RE: [suse-security] does anybody know such a log
by m3047＠inwa.net 11 Oct '02

11 Oct '02

Wolfgang Kueter wrote: >On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: >> This isn't neither nimda nor code red. > >I'm pretty sure it is. > >> This is a scan. it came from a dial up account. Nimda and Code red >> never came from dial up accounts. > >Wrong, there were and stil are lots aof systems even of home users beeing >infected with these. Though it hard be believe for Linux users, there are >lots of people arounf running an IIS on a dial-up machine, often they even >know that they are ruuning it. Win2000 installs IIS by default. Having seen it with my own eyes, it is true; and I suspect there are many people out there with IIS installed and activated who don't even know it. Just wait until one of your friends asks you why his computer keeps dialing out on the modem and go take a look.. -- Fred Morris m3047(a)inwa.net

2 1

RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

HI http://www.cert.org/advisories/CA-2001-19.html Code Red :) Philipp > -----Original Message----- > From: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] > Sent: Friday, October 11, 2002 5:30 PM > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] Re: **maillist-work:: Re: [suse-security] > doe s anybody know such a log > > > Hi, > > What about this: > schebish.c.crosslink.net - - [11/Oct/2002:17:02:57 +0200] "GET > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u90 > 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190 > %u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a > HTTP/1.0" 400 329 ?? > > > > Hi > > > > yes, it's really possible. Our reverse proxy just today > picked up the same > > logs coming from a french IP address. > > I'm just checking what exactly this is. > > > > Philipp > > > > > >>-----Original Message----- > >>From: Thomas Seliger [mailto:CRJLJAKTJORB@spammotel.com] > >>Sent: Friday, October 11, 2002 2:01 PM > >>To: suse-security(a)suse.com > >>Subject: [suse-security] Re: **maillist-work:: Re: > >>[suse-security] does > >>anybody know such a log > >> > >> > >>Hi, > >> > >>What Hannes says is true. There are quite a few nimda > >>infected computers > >>out there that are connected to the internet via T-DSL, even > >>some with > >>ISDN. With "flatrates" getting affordable, people often have > >>their PCs > >>connected their PCs almost 24h to (e.g. for download or P2P). Also > >>running a Webserver on such hosts isn't as uncommon as it > used to be. > >> > >>peace, > >>Tom > >> > >> > >>Johannes Studt wrote: > >> > >> > >>>On Friday 11 October 2002 13:28, mailinglists(a)belfin.ch wrote: > >>> > >>> > >>>>Who's sleeping here? > >>>>This isn't neither nimda nor code red. This is a scan. it > came from > >>>>a dial up account. Nimda and Code red never came from dial up > >>>>accounts. They always came from static IP addresses. > >>>> > >>> > >>>Why nimda or code red _must_ come from static ip addresses? > >>>Think of IIS installed on WinPCs which are 24/7 up and > >>> > >>accessible via > >> > >>>DynDNS names. Such systems are vulnerable too... > >>> > >>>Hannes > >>> > >>> > >> > >>-- > >>Check the headers for your unsubscription address > >>For additional commands, e-mail: suse-security-help(a)suse.com > >>Security-related bug reports go to security(a)suse.de, not here > >> > >> > > > > > -- > .-. e-SecureNet > /v\ We Run SuSE Project Manager > // \\ *The LINUX Experts* c/o Miguel Albuquerque > /( )\ Av. Miremont 46 > ^^-^^ 1202 - GE, SWITZERLAND > > Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 > mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Under the hood access to iptables
by Ian Hunter 11 Oct '02

11 Oct '02

OK, I have an i586 running SuSE 8.0 (2.4.18-4GB) acting as a firewall and doing forwarding and masquerading. I have read every conceivable FAQ on firewalls and iptables. I don't claim to understand everything I've read, and my brain is bleeding through my ears now, but I want more. My system is presently working fine. I have a DSL modem connected to eth1 and am using rp-pppoe to get my ppp0 up and running so that several systems on the subnet attached to eth0 can get to the internet. All is well. I even have a machine (SuSE 7.3 SPARC) on the internal network running www, dns, and a couple other things that the firewall machine is forwarding things to, as appropriate. When I run iptables -L, I get reams and reams of junk. I've gone through it and understand more than half of it, but it seems like there are some rules there that I don't want, and there are some that I do that aren't there. I can manually tweak the chains a little bit (for instance, I manually disabled and reenabled forwarding 8079 on the gateway to 8080 on the Sun box via iptables -t nat -R blah blah blah... yay!) but I can't find where the rules live. Is there a cental config file that has all the rules? If I change things via the command line, and like my changes, how do I make them effective after a restart? Another thing I can't figure out is how to allow the internal network to access my domain just like an outside user would; for instance, I'm at 192.168.0.1 and I want to hit http://example.com, which is currently DNATed to 192.168.0.3:80 -- how can I tweak my config such that 192.168.0.1 can surf to http://example.com and have everything get resolved OK? Where do I find this stuff out? Thanks much, Ian

2 1

RE: [suse-security] Under the hood access to iptables
by Reckhard, Tobias 11 Oct '02

11 Oct '02

> When I run iptables -L, I get reams and reams of junk. I've > gone through it and understand more than half of it, but it > seems like there are some rules there that I don't want, and > there are some that I do that aren't there. I can manually > tweak the chains a little bit (for instance, I manually > disabled and reenabled forwarding 8079 on the gateway to 8080 > on the Sun box via iptables -t nat -R blah blah blah... yay!) > but I can't find where the rules live. Is there a cental > config file that has all the rules? I presume you're using SuSEFirewall2. It probably has a central config file, try "rpm -ql SuSEfirewall2 | grep etc". There will also be one or more scripts in /etc/init.d/ that start up and stop the packet filter. You can read those to find out how the thing actually works. I don't use SFw2 myself (I prefer to roll my own), so I can't give you anything more specific. > If I change things via the command line, By using the iptables command, as you have already been doing. > and like my changes, > how do I make them effective after a restart? You need to change the config file and perhaps the SFw2 scripts for this. > Another thing I can't figure out is how to allow the internal > network to access my domain just like an outside user would; > for instance, I'm at 192.168.0.1 and I want to hit >http://example.com, which is currently DNATed to 192.168.0.3:80 -- > how can I tweak my config such that 192.168.0.1 can surf to > http://example.com and have everything get resolved OK? Well, I wouldn't even attempt to do that with IP packet munging, but would instead use internal DNS server and DNS cache to present data of example.com to the inside than the Internet sees. Cheers, Tobias

1 0

does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Hello our reverse proxy picked this up 1034211881.427 22 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c1%1c../winnt/system32/cmd.exe? - NONE/- - 1034211881.925 13 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c0%2f../winnt/system32/cmd.exe? - NONE/- - 1034211882.393 19 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c0%af../winnt/system32/cmd.exe? - NONE/- - 1034211882.852 10 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c1%9c../winnt/system32/cmd.exe? - NONE/- - 1034211883.297 5 217.11.99.90 TCP_MISS/503 1168 GET http://www/scripts/..%%35%63../winnt/system32/cmd.exe? - NONE/- - 1034211883.836 20 217.11.99.90 TCP_MISS/503 1164 GET http://www/scripts/..%%35c../winnt/system32/cmd.exe? - NONE/- - 1034211887.664 22 217.11.99.90 TCP_MISS/503 1172 GET http://www/scripts/..%25%35%63../winnt/system32/cmd.exe? - NONE/- - 1034211888.285 19 217.11.99.90 TCP_MISS/503 1164 GET http://www/scripts/..%252f../winnt/system32/cmd.exe? - NONE/- - 1034215688.223 16 217.11.99.90 TCP_MISS/503 1116 GET http://www/scripts/root.exe? - NONE/- - 1034215689.027 29 217.11.99.90 TCP_MISS/503 1112 GET http://www/MSADC/root.exe? - NONE/- - 1034215689.564 13 217.11.99.90 TCP_MISS/503 1132 GET http://www/c/winnt/system32/cmd.exe? - NONE/- - 1034215690.138 3 217.11.99.90 TCP_MISS/503 1132 GET http://www/d/winnt/system32/cmd.exe? - NONE/- - 1034215690.962 20 217.11.99.90 TCP_MISS/503 1164 GET http://www/scripts/..%255c../winnt/system32/cmd.exe? - NONE/- - 1034215691.552 27 217.11.99.90 TCP_MISS/503 1206 GET http://www/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe? - NONE/- - 1034215692.265 19 217.11.99.90 TCP_MISS/503 1206 GET http://www/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe? - NONE/- - 1034215693.017 10 217.11.99.90 TCP_MISS/503 1262 GET http://www/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c. ./winnt/s Is there some new IIS/Windows worm spreading? Thanks, Philipp

4 3

Re: [suse-security] problem with routing
by Robert Rottscholl 10 Oct '02

10 Oct '02

Hi Payam, ok, if the dns works from the router, than you have a routing problem. try tcpdump -i eth1 to look what packages are leaving and icoming on your "world device". You get this information by invoking the command above and trying "nslookup www.suse.com" from a client. Greets robert payam payami schrieb: >Hi Robert, > >I have win2k for router in our network now and is >working well, so , i want to replace it with suse 7.3 >I set an dns IP in control center (host name and name >server) in Xwindow & set this IP for dns in >clients(windows machine) >Router can see internet but clients (internal network) >that their OS is win2k can't see internet. >Also router (suse 7.3) can ping clients IP but clients >only can ping eth0(internal network) for router & >can't ping eth1(external network) for router >when i do this command in client machine : >nslookup suse.com >i get thie error: >can't find servername for address ( the Ip that i set >for dns that above told you ) :time out >default servers arenot availabe > ' > ' > ' > ' > ' >What can i do? > >Thanks for your help, >Payam > >--- Robert Rottscholl <lv426(a)rinx.de> wrote: > > >> Hi Payam, >> >>what about your dns server? You have one? Or do you >>add an external dns >>to your client configuration. >>What does nslookup or dig on a client say? (e.g. >>nslookup www.suse.com) >>If these programs can recieve an IP-Adress try to >>ping. >> >>Ciao ;-) >> >>Robert >> >>payam payami schrieb: >> >> >> >>>Hi Robert, >>>I did what did you tell me, FW_route & >>> >>> >>FW_MASQUERADE & >> >> >>>etc, without set the iptables rule but >>> >>> >>UNFORTUNATELY i >> >> >>>can't get result. >>>What can i do? >>> >>>Thanks for your help, >>>Payam >>> >>>--- Robert Rottscholl <lv426(a)rinx.de> wrote: >>> >>> >>> >>> >>>>Hi Payam, >>>>let me repeat what you try to do: You want to >>>> >>>> >>route >> >> >>>>the internet >>>>requests from the internal (eth0) interface to >>>> >>>> >>the >> >> >>>>external interface >>>>(eth1). >>>>You needn't set the rule you posted. >>>>Set >>>>FW_ROUTE="yes" >>>>FW_MASQUERADE="yes" >>>>FW_MASQ_DEV="eth1" >>>>FW_MASQ_NETS="" # to your internal subnet (e.g. >>>>192.168.0.0/24) >>>> >>>>Creets >>>> >>>>robert >>>> >>>>payam payami schrieb: >>>> >>>> >>>> >>>> >>>> >>>>>I want to use suse 7.3 for router & i want to do >>>>>masquerading. >>>>>I have 2 net card that one is for internal >>>>> >>>>> >>network >> >> >>>>> >>>>> >>>>> >>>>> >>>>& >>>> >>>> >>>> >>>> >>>>>another is for external network. >>>>>eth0 for internal network >>>>>eth1 for external network >>>>>I was setting in >>>>> >>>>> >>>>> >>>>> >>>>/etc/rc.config.d/firewall2.rc.config >>>> >>>> >>>> >>>> >>>>>(The options that related to masquerading) and >>>>> >>>>> >>type >> >> >>>>>this command in command line >>>>> >>>>>iptables -t nat -A POSTROUTING -j MASQUERADE -o >>>>> >>>>> >>>>> >>>>> >>>>eth1 >>>> >>>> >>>> >>>> >>>>>Is this any problem with this rule or in my >>>>>configuration file? >>>>>Because only router system can see internet and >>>>>another systems can't see internet >>>>>How can i solve this problem that another systems >>>>>(internal network) can see internet? >>>>> >>>>>Thanks for your help, >>>>>Payam >>>>> >>>>> >>>>> >>>>__________________________________________________ >>>> >>>> >>>>>Do you Yahoo!? >>>>>Yahoo! Mail Plus - Powerful. Affordable. Sign up >>>>> >>>>> >>>>> >>>>> >>>>now. >>>> >>>> >>>> >>>> >>>>>http://mailplus.yahoo.com >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>-- >>>>Check the headers for your unsubscription address >>>>For additional commands, e-mail: >>>>suse-security-help(a)suse.com >>>>Security-related bug reports go to >>>> >>>> >>security(a)suse.de, >> >> >>>>not here >>>> >>>> >>>> >>>> >>>> >>>__________________________________________________ >>>Do you Yahoo!? >>>Yahoo! Mail Plus - Powerful. Affordable. Sign up >>> >>> >>now. >> >> >>>http://mailplus.yahoo.com >>> >>> >>> >>> >>> >>> >> >>-- >>Check the headers for your unsubscription address >>For additional commands, e-mail: >>suse-security-help(a)suse.com >>Security-related bug reports go to security(a)suse.de, >>not here >> >> >> > >__________________________________________________ >Do you Yahoo!? >Yahoo! Mail Plus - Powerful. Affordable. Sign up now. >http://mailplus.yahoo.com > > > >

1 0

affected Systems (?)
by Joerg Henner 10 Oct '02

10 Oct '02

Hi, did anyone know about following CERT-Advisories are allready fixed in SuSE 8.x - or about the patches will be released the next days: - fetchmail - bind - glibc Further infos (only in german) can be found here: http://cert.uni-stuttgart.de/ (Have a look at 09/2002 und 10/2002) Thanx for any advice, Greetings, -- Jörg Henner Fon: +49 (7 11) 48 90 83 - 0 ETES - EDV-Systemhaus GbR Fax: +49 (7 11) 48 90 83 - 50 Libanonstrasse 58 A * D-70184 Stuttgart Web: http://www.etes.de ______________________________________ Inflex - eMail Scanning and Protection Queries to: postmaster(a)etes.de

5 6

Re: [suse-security] SuSEfirewall2 and NAT
by Jan Dus 10 Oct '02

10 Oct '02

Good morning, thank you for your response. I have understood everything (I hope) and I agree. But I don't want (mustn't <- corp. policy) to use these public addresses in our private net. I need every traffic (all ports/protocols) from Internet to our public address <PUB1> to forward/masq to private address <PRIV1> and the same thing with the second -- <PUB2> to forward/masq to <PRIV2>. Is it possible to do it in SuSEfirewall2's configuration? May I use custom rules? --- Se srdecnym pozdravem/Best regards Jan Dus (CNA, CNE, CNS) AG COM, a.s. Smirice Czech Republic kancelar/office +420 495 421 312 fax +420 495 421 108 Andreas J Mueller <andy(a)muelli.net> 08.10.2002 17:14 Komu: suse-security(a)suse.com Kopie: Předmět: Re: [suse-security] SuSEfirewall2 and NAT -----BEGIN PGP SIGNED MESSAGE----- Hi Jan! > I have enough public IP address - there is no problem but is there a > possibility to arrange the same trafic to the second server? Not as long as your firewall has only one public IP address. If you have enough public IP addresses, masquerading is not necessary. You could assign public addresses to your servers and use FW_FORWARD instead of FW_FORWARD_MASQ. They will still be protected by the firewall (i.e., only those ports you actually forward from the FW will be reachable from the outside). I'm sure there are also other possibilities (SNAT?). Regards, Andy - -- Andreas J. Mueller email: <andy(a)muelli.net> PGP RSA Public Key ID 0x3D41D941 FP: ED261973D51D3D20 C840B0542E69F602 We strongly urge you to encrypt information sent by email. Our public PGP key is available from http://132.176.114.28/q4408950/pubkey.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (MingW32) iQC9AwUBPaL2YvobN5o9QdlBAQHEmQU/d1pRoLt5S84CFSE2G8QIEkALJFbraUg5 b3uExJJl75q3g/BdodlEPhz7KHE1QPPNySZlUDw3hDDzgpB8PoZrGsN5GU5NAwXj R5qoOUfF1WxHcBCH1vKb8RIkOTLToWXC8DTZXXz6yx2MfFwe+SqLExJ6OnDh7IwM y1Astan7B27hsVcK19nUEW6oKwXaQIyXn1852/Bzf9hhMls/X5piA+3QcGZl8vgF =LqgG -----END PGP SIGNATURE----- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1