November 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] IIS Worms
by mailinglists＠belfin.ch 27 Nov '02

27 Nov '02

Hi to me this looks like some kind of nimda or code red. you can filter this using iptables string match. Philipp > -----Original Message----- > From: Marcel Erkens [mailto:merkens@safenebraska.org] > Sent: Wednesday, November 27, 2002 9:30 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] IIS Worms > > > hehe.. good luck dealing with isp's on this... > > http://freebsdmatrix.net/iisworm/ > > A fun little script that'll automatically send out emails to > parent netblock > owners... > > Might be easier then doing all the work manually ;) > > On Wednesday 27 November 2002 11:41, Andreas Bittner wrote: > > nslookup/whois the ip (www.ripe.net (euro/africa/mid-east) > , www.arin.net > > (americas) or www.apnic.net (asia pacific), these are the > big three ip > > address maintainers worldwide, whois the ip addy there or > nslookup the > > ipadress and report to its owner/provider and so forth.... > > > > cheers, > > andy > > > > ----- Original Message ----- > > From: "Mario Ohnewald" <mario.ohnewald(a)gmx.de> > > To: <suse-security(a)suse.com> > > Sent: Wednesday, November 27, 2002 12:33 PM > > Subject: [suse-security] IIS Worms > > > > > > Hello! > > What can i do against these worms? > > > > [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..Á^\../winnt/system32/cmd.exe > > [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:18:53 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe > > [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..Á234../winnt/system32/cmd.exe > > [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..%5c../winnt/system32/cmd.exe > > [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..%2f../winnt/system32/cmd.exe > > [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] > File does not > > exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe > > [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/.%2e/.%2e/winnt/system32/cmd.ex > > [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..%5c%5c../winnt/system32/cmd. > > [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 07:59:16 2002] [error] [client 210.241.51.68] > client sent > > HTTP/1.1 request without hostname (see RFC2616 section 14.23): / > > [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/scripts/root.exe > > [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/MSADC/root.exe > > [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/scripts/root.exe > > [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/MSADC/root.exe > > [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/c/winnt/system32/cmd.exe > > [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/d/winnt/system32/cmd.exe > > [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > > > How can i reverse the ip to an address like whois does. > > What do u do against it? I am just bothered because of my > mini bandwitdth. > > > > cheers, Mario > > -- > "They that give up essential liberty to obtain a little > temporary safety... > deserve neither safety nor liberty." - Benjamin Franklin(1759) > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Kernel DoS
by Denis Hoffmann 27 Nov '02

27 Nov '02

Hi there! I just came across this article: http://www.securiteam.com/exploits/6E00F2060U.html Summary: A vulnerability in the Linux kernel allows local attackers to cause it to halt. The flaw seems to be related to the kernel's handling of the nested task (NT) flag inside an lcall7. What says SuSE about this topic? Do you advise a kernel update? Which SuSE-versions are affected? Have a nice day! Denis Hoffmann

6 8

Antwort: [suse-security] ipchains and Portscan ( another possibility )
by BLeonhardt＠analytek.de 27 Nov '02

27 Nov '02

check /etc/inetd.conf and disable all listed ports / services ! Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de Volker Spies <v.spies(a)ascaron.com> 27.11.02 10:58 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains and Portscan Hallo, I have problems with my ipchains firewall. When I run a portscan with nmapwin to my linux box form the internet it shows me the following ports as open: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 43/tcp open whois 53/tcp open domain 70/tcp open gopher 79/tcp open finger 80/tcp open http 81/tcp open hosts2-ns 88/tcp open kerberos-sec 109/tcp open pop-2 110/tcp open pop-3 113/tcp open auth 119/tcp open nntp 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 443/tcp open https 465/tcp open smtps 513/tcp open login 554/tcp open rtsp 563/tcp open snews 569/tcp open ms-rome 636/tcp open ldapssl 749/tcp open kerberos-adm 993/tcp open imaps 995/tcp open pop3s 1002/tcp open unknown 1494/tcp open citrix-ica 1720/tcp open H.323/Q.931 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 5190/tcp open aol 5400/tcp open pcduo-old 6667/tcp open irc 7000/tcp open afs3-fileserver 7070/tcp open realserver 10000/tcp open snet-sensor-mgmt 12000/tcp open cce4x The only services that are running to the outside Sshd Httpd Ftpd There are other services but not reachable form outside: Smtp Imap Squid Webmin The rest is definitely blocked by the firewall rules (only to outside interface). The firewall log shows that the ports are blocked. I see the portscan and I see that, for example, Port 25 is denied. Wired: On Port 10000 i've webmin running only reachable from the inside. Why does nmap show snet-sensor-mgmt ???? Why shows nmapwin (and other port scanners) that so many ports are in the state OPEN??? By the way when I start nmap locally on the firewall then it shows the correct ports open Sshd Httpd Ftpd Smtp Imap Squid webmin Best regards Volker

1 0

Antwort: [suse-security] ipchains and Portscan
by BLeonhardt＠analytek.de 27 Nov '02

27 Nov '02

maybe you're not running the test from outside ??? setup a dedicated host with a isdn-card - inet-connection and then try again - be sure there is no networkconnection ! Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de Volker Spies <v.spies(a)ascaron.com> 27.11.02 10:58 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains and Portscan Hallo, I have problems with my ipchains firewall. When I run a portscan with nmapwin to my linux box form the internet it shows me the following ports as open: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 43/tcp open whois 53/tcp open domain 70/tcp open gopher 79/tcp open finger 80/tcp open http 81/tcp open hosts2-ns 88/tcp open kerberos-sec 109/tcp open pop-2 110/tcp open pop-3 113/tcp open auth 119/tcp open nntp 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 443/tcp open https 465/tcp open smtps 513/tcp open login 554/tcp open rtsp 563/tcp open snews 569/tcp open ms-rome 636/tcp open ldapssl 749/tcp open kerberos-adm 993/tcp open imaps 995/tcp open pop3s 1002/tcp open unknown 1494/tcp open citrix-ica 1720/tcp open H.323/Q.931 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 5190/tcp open aol 5400/tcp open pcduo-old 6667/tcp open irc 7000/tcp open afs3-fileserver 7070/tcp open realserver 10000/tcp open snet-sensor-mgmt 12000/tcp open cce4x The only services that are running to the outside Sshd Httpd Ftpd There are other services but not reachable form outside: Smtp Imap Squid Webmin The rest is definitely blocked by the firewall rules (only to outside interface). The firewall log shows that the ports are blocked. I see the portscan and I see that, for example, Port 25 is denied. Wired: On Port 10000 i've webmin running only reachable from the inside. Why does nmap show snet-sensor-mgmt ???? Why shows nmapwin (and other port scanners) that so many ports are in the state OPEN??? By the way when I start nmap locally on the firewall then it shows the correct ports open Sshd Httpd Ftpd Smtp Imap Squid webmin Best regards Volker

1 0

Re: [suse-security] SuSEfirewall2: external ip aliases with forward / masq?
by Togan Muftuoglu 26 Nov '02

26 Nov '02

* Howard, Neal; <nhoward(a)cwftx.net> on 26 Nov, 2002 wrote: >I'll try it out tomorrow, it's been a long day here in Texas too and my >brain hurts right now! I know the feeling :-) > >I'm guessing I should use the external ip aliases in the first part of >each stanza of FW_FORWARD_MASQ instead of putting the vendor's ip address >in that place like I was doing? Now although I said > >FW_DEV_EXT="eth0 eth0:1 eth0:2" It's better to have the aliases eth0:1 and eth0:2 in FW_DEV_DMZ and then FW_FORWARD_MASQ them for the vendor this way it should be both secure and doable (cross your fingers) -- Togan Muftuoglu

1 0

SuSEfirewall2: external ip aliases with forward / masq?
by Howard, Neal 26 Nov '02

26 Nov '02

Hello all, I've searched thru FAQs & archives for a couple days now and haven't found anything exactly like my problem, so I will describe it and maybe someone here can offer good advice. I have installed a SuSE 8.0 machine to be an Internet firewall. I have a whole Internet-routable public class C address range to work with on my external interface. I am running only private RFC1918 addresses on my interior network. I have some Windows PCs on the internal network that I need to allow a vendor on the outside to remotely manage via PCAnywhere. Thanks to Togan Muftuoglu's most excellent "Understanding and Using SuSE Firewall2" document, I have been able to configure SuSEfirewall2 to perform the FW_FORWARD_MASQ to make this work for one single internal Windows PC. Now I need to be able to have ip aliases on the external interface eth0 (let's call them A.B.C.100 as the primary address and A.B.C.101 and A.B.C.102 as the ip aliases on the external interface). The internal interface (eth1) of the firewall is 192.168.1.1 and there are no aliases on that one. My internal Windows machines are 192.168.1.10 , 192.168.1.11 and 192.168.1.12 and PCAnywhere is listening on the normal 5631/tcp and 5632/udp ports on each of these machines. I also need to be able to limit the inbound PCAnywhere connection requests to a specific source address. Let's call the vendor's address X.Y.Z.123. To get the firewall to work for the one PCA machine, I used these rules in the /etc/sysconfig/SuSEfirewall2 file: [mundane config stuff that's normally self-explanatory left out] FW_SERVICES_EXT_TCP="5631" FW_SERVICES_EXT_UDP="5632" FW_TRUSTED_NETS="X.Y.Z.123" FW_FORWARD_MASQ="X.Y.Z.123,192.168.1.10,tcp,5631 \ X.Y.Z .123,192.168.1.10,udp,5632" This work great for PCAnywhere to get thru to the one machine. Now I need to set up a similar forward/masq deal happening for some external ip aliases to get forwarded and masqueraded to the other two machines on these tcp/udp ports like: A.B.C.101 -> 192.168.1.11 (both 5631/tcp and 5632/udp) A.B.C.102 -> 192.168.1.12 (both 5631/tcp and 5632/udp) Also only allow X.Y.Z.123 from the outside to be permitted to use these services. In Togan's document, he mentions how to do this using alternative tcp and udp port numbers for multiple internal PCAnywhere machines (i.e. 5631/5632 for first pc, 5633/5634 for second, 5635/5636 for the third one, etc) and only one ip address on the SuSEfirewall2's external address, but my vendor is stubbornly demanding that I provide separate ip addresses for each machine and stick with the standard PCAnywhere port numbers. I already have the aliased external ip addreses on eth0, that part was easy. Does anyone know how to make SuSEfirewall2 scripts support them for my need? Or am I going to have to make an entire script of raw iptables commands from scratch to accomplish such an animal. If so, is there a way of getting the raw list of iptables commands that the SuSEfirewall2 startup processes generates into one big textfile so I may be able to see all that it is doing, and all in correct order, so that I may use it as a learn-by-example script? Thanks, Neal

2 1

block msn behind firewall
by security 26 Nov '02

26 Nov '02

Hi, Is there anyway to block access to msn messenger from masquerading internal network behind firewall, using SuSefirewall2 ??? thinks

2 1

Mail Gateway w/ Amavis and Postfix on SuSE 7.2
by christian.burri＠synecta.ch 26 Nov '02

26 Nov '02

Hello List, I have a small Problem with an Amavis installation... In /var/log/mail I get: Nov 25 18:47:43 horus amavis[13592]: Virus scanner failure: /usr/local/bin/uvscan (error code: 16777215) The mails go thru tho, also the X_Virus_Scanned Tag appears. What does the error message in the logs mean? Could it be Amavis had trouble opening a packed attachment or something? Cheers Chr. Burri .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^

2 2

Starting Firewall Initialization: (phase 2 of 3) failed
by Mario Ohnewald 26 Nov '02

26 Nov '02

Hello! I was playing agounf with QoS and the new Versions of IPtables witch works fine. But since then my Firewall2 wont initialize anymore! Starting Firewall Initialization: (phase 2 of 3) failed I can´t find any errors in messages, firewall or warn! Where am i supposed to look for hints now? I have already installed the "old" iptables to see if its works with them, but it doesnt. A debug mode for SuSEfirewall2 would be great now! :) Cheers, Mario p.s. I have SuSE7.3 with the standard 2.4.10 Kernel.

2 1

Maybe OT: martian sources and new dev eth
by Miguel Albuquerque 26 Nov '02

26 Nov '02

Hi, I've noticed that since I installed a new network card, I have lots of "martian sources" on dev eth1 which it happens to be down. It looks like it grabs all broadcast/martian packets in the active netcard. Not exactly a problem but annoying, hun? Or maybe the card is damaged? Could some 1 explain me that? Regards, -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch "Was Sind und was Sollen die Zahlen?" Dedekind. ____________________________________________________________

2 1