December 2002 - openSUSE Security - openSUSE Mailing Lists

Re: Postgres 7.3
by Thomas Seliger 04 Dec '02

04 Dec '02

I put it in the wrong words i guess. I meant "up to date". No matter for what apache tree i decide, I want to be able to install a fixed version of it in short time. When I install a piece of server software and i can disable features that i dont want/need, i can do that at compile time. While server software in linux distributions is often build to support a broad public, you may want to build your own smaller thing. Sometimes its "security feature" against "security fix": e.g. I wanted to use the privsep option in OpenSSH, while the SuSE package was a fix of the actual version, IMHO it increased the overall security of that service. Concerning openssl i decided to use the up to date source, instead of the SuSE packages. Again: i meant "up to date" mainly patchwise. SuSE is fast with their bugfixes usually, but sometimes you want to be able to bugfix as soon as you can grab the sourcecode. Since i have to test it anyways, if it breaks something on production machines, i decided to compile and test, instead of waiting for the rpm and test. Concerning the "security fix" against "security features" issue: Depending on the thing you use your DBMS for, the new features can be considered an improvement (of the overall security, the application security, whatever). The drawback is that there is new code. But somtimes the gain of the new features outweighs the "code risk". > 7.3 doesn't contain security *fixes* (AFAIK) but new security *features* > and that's a different thing. Right :). And some of them have been awaited longtime. Network security maybe one motivation. Features that enable your developers to write a more secure application DBMS wise, can increase security too. Oh and theres also this line in the changelog: Security fixes for password negotiation memory allocation (Neil) Know what that exactly means, or how relevant this is security wise? peace, Tom

1 0

RE: Wake On Lan
by Mario Ohnewald 04 Dec '02

04 Dec '02

Hi, > From: Thomas Preissler [mailto:Preissler@internetx.de] > Sent: Mittwoch, 4. Dezember 2002 11:02 > > > Mario Ohnewald schrieb am 04. December 2002: > > > Hi! > > Wie kann ich denn meinen Rechner der eine WakeOnLan fähige > Netzwerkkarte hat > > aufwecken? > > Ich weis nur das ich ein bestimmtes Packet an eine > bestimmte MAC Adresse > > schicken muss. > > Mehr info konnte ich dazu leider nicht finden. > > Ich hab eine RE100tx (8139too) Karte. Ist WakeOnLan bei > jeder Karte anders > > (abgesehen von der MAC) ? > > > > Schonmal Danke im Vorraus! > > Such im Google nach "donald becker etherwake" GEIL, es geht! Danke!

1 0

firewall setup fails in suse7.1
by gclinux 04 Dec '02

04 Dec '02

hi list, I'm new to linux, upon bootup before the gui login( whats that called in linux? anyway),i get a message saying the firewall script needs to know the external internet interface. How do i fix this in simple terms. I don't have any luck figuring out what the manuals are trying to say. I have suse7.1 , behind a dlink 704p router & ADSL. Unfortunately I am still a gui moron, I have been through yast 2 many times and have been able to enable most of the items the manuals mention, but i still can't find how to tell the firewall script the external internet interface. tyia

3 2

Postgres 7.3
by Peter Nixon 03 Dec '02

03 Dec '02

Is SuSE planning on releasing an update to Postgres 7.3 as it seems to have fixed some nasty bugs. (As well as having some much waited for new features!) -- Viel Spaß Peter Nixon - nix(a)susesecurity.com SuSE Security FAQ Maintainer http://www.susesecurity.com/faq/ "If you think cryptography will solve the problem, then you don't understand cryptography and you don't understand your problem."

5 7

Fwd: pre-login buffer overflow in Cyrus IMAP server
by Stefan Suurmeijer 03 Dec '02

03 Dec '02

Can anyone from SuSE tell me if the vulnerability below is known yet and if so, if a fix is being made? (I checked the Carnegie Mellon pages for news, but found nothing). This one is kinda important to me :-/ as I use Cyrus imapd and sieve extensively (there is also a vulnerability in sieve, check bugtraq or the cyrus mailinglist if you want to know more). If a fix takes too long, I'll have to patch myself, which I'd rather not do.... TIA Stefan ---------- Forwarded Message ---------- Subject: pre-login buffer overflow in Cyrus IMAP server Date: Mon, 2 Dec 2002 19:56:06 +0200 From: Timo Sirainen <tss(a)iki.fi> To: bugtraq(a)securityfocus.com problem ------- Cyrus IMAP server has a a remotely exploitable pre-login buffer overflow. I checked versions 1.4 (oldest in web page) and 2.1.10 which both had it, so apparently all versions are affected. Problem is that literal lengths aren't verified to be in any reasonable range. The length + 2 is then malloc()ed and later written into. So given length of 2^32-1, we get malloc(1) call but ability to write 2^32-1 bytes there. Note that you don't have to log in before exploiting this, and since Cyrus runs everything under one UID, it's possible to read every user's mail in the system. I verified that this is exploitable with GLIBC 2.3.1. Probably possible with older glibcs as well although they had somewhat different malloc() code. No idea about other libcs, BSD ones look safe. There could be of course other ways to exploit it than just malloc headers. (BTW. Why is it that glibc's malloc implementation is almost begging to be exploited? I don't think it would be that difficult to create safer implementation with internal structures in separate memory pages, possibly even separated with non-writable page(s) between. Could even be faster because of better CPU cache utilization, and maybe made to take less memory.) There's several other malloc/integer related problems where it's possible to read over 2GB strings from clients into memory accessing it with signed integers, finally wrapping into -2^31. That's probably not too bad since it can work only with >2GB process limits (only 64bit architectures I'd think) and even then it would quite likely access only unmapped memory. Authors were first contacted 30. October, I think it's way past the fix time. semi-exploit ------------ perl -e 'print "x login {4294967295}\r\n\xf0\xef\xff\xbf\x90\xef\xff\xbf\xfc\xff\xff\xff\xfc\xff\xff \xff";'|nc localhost imap2 <ctrl-c> The first 4 bytes specify the address where you want to write to in memory and the next 4 bytes is the data to be written there (must be a readable memory address). Rest of the bytes are overwriting prev_size and size in malloc header. The above values work with cyrus21 package in Debian unstable/x86. gdb verifies that the call was successful: Program received signal SIGSEGV, Segmentation fault. 0xbfffef90 in ?? () (gdb) bt #0 0xbfffef90 in ?? () #1 0x400233e9 in prop_dispose () from /usr/lib/libsasl2.so.2 #2 0x4002ae1a in sasl_setpass () from /usr/lib/libsasl2.so.2 #3 0x40026cd2 in sasl_dispose () from /usr/lib/libsasl2.so.2 Shouldn't be too hard to come up with a real exploit from there on. You also need to make one "x logout\n" connection first to trigger the exploit (Cyrus reuses the processes). fix --- Apply the included patch and set some reasonable ulimits to make sure the other integer overflows won't hit you in future. diff -ru cyrus-imapd-2.1.10-old/imap/imapparse.c cyrus-imapd-2.1.10/imap/imapparse.c --- cyrus-imapd-2.1.10-old/imap/imapparse.c 2002-06-24 21:58:41.000000000 +0300 +++ cyrus-imapd-2.1.10/imap/imapparse.c 2002-11-29 00:20:44.000000000 +0200 @@ -97,7 +97,7 @@ struct buf *buf, int type) { int c; - int i; + unsigned int i; unsigned int len = 0; int sawdigit = 0; int isnowait; @@ -228,6 +228,16 @@ if (c != EOF) prot_ungetc(c, pin); return EOF; } + if (len > 65536) { + if (isnowait) { + for (i = 0; i < len; i++) + c = prot_getc(pin); + } + prot_printf(pout, "* BAD Literal too large\r\n"); + prot_flush(pout); + if (c != EOF) prot_ungetc(c, pin); + return EOF; + } if (len >= buf->alloc) { buf->alloc = len+1; buf->s = xrealloc(buf->s, buf->alloc+1); ------------------------------------------------------- -- ================================================================ Stefan Suurmeijer University of Groningen, Rekencentrum P.O. Box 800, NL-9700 AV Groningen, The Netherlands tel: (+31) 50 363 8258 - fax: (+31) 50 363 3406 E-mail: S.M.Suurmeijer(a)rc.rug.nl E-mail: stefan(a)raptorweb.nl (private) ================================================================ PGP fingerprint:3FCE 2BA5 325D 1456 9834 0427 1871 EA88 AE67 3C69 Quies custodiet ipsos custodes? (Who'll watch the watchmen?) #define question ((bb) || (!bb)) - William Shakespeare

1 0

RE: [suse-security] securityfocus.com
by mailinglists＠belfin.ch 03 Dec '02

03 Dec '02

> * mailinglists(a)belfin.ch wrote on Mon, Dec 02, 2002 at 12:05 +0100: > > what happened to www.securityfocus.com? > > I have a time out error when I try to connect to them. > > And now you feel unsafe or why are you posting this? a) to resurrect the list - it became quite silent during last months b) I feel very unsafe. I bought myself a gun. c) My heater is broke, too. d) to get flames from guys like you now pick one. > http://www.just-some-domain.org/ seems to be down also - it does > not even DNS resolve :) Really? I didn't know you have been trying to look up security information on a nonsense link that is dead on first glance. To explain it to you: For me this is (was) board no1 to get security information. hence the mail. Philipp

2 1

securityfocus.com
by mailinglists＠belfin.ch 02 Dec '02

02 Dec '02

Hi what happened to www.securityfocus.com? I have a time out error when I try to connect to them. philipp

3 2

Problem with SuSEfirewall2 on 8.1
by RalfGue＠t-online.de 02 Dec '02

02 Dec '02

Hi everyone I activated SuSEfirewall2 on 8.1 and I have the following questions: - Although I set logging in such a fashion, that only critical drops should be logged, the firewall logs and logs tons of packets from guys trying to connect to P2P-software on ports like 4662 or 1214. Is that considered "critical" ?? - I wanted to get firewall messages in a separate file, so I added an entry kern.* - /var/log/firewall to /etc/syslog.conf, but now it logs to BOTH files. Any ideas how to cure this? Oh yeah: Am I the only one thinking that "SuSEfirewall2" is one heck of a command to type if you just want to stop/start? "sfw2" or something would be much faster to type... I know, I know I could use ln -s ;-) Thank you very much for any help Cheers Ralf G.

2 2

Presario 715
by Joao Reis 02 Dec '02

02 Dec '02

Hi! I am sorry about sending a message that is not directly related with this mailing list, but in the laptop mailling list no one answers me, and i am becoming very consurned about the well funcioning of my laptop. The question is very simple: Does anybody knows if the Suse 8.1 ACPI module works in a Compaq Presario 715? My laptop stays very hot all the time and if ACPI of 8.1 works well i will buy this distribution right away! Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

1 0

Applications to build a firewall, similar to TIS FWTK
by Juan Torres 02 Dec '02

02 Dec '02

Hello, I have been trying to build a Firewall with the TIS FWTK, but I think that it doesn't work properly with the last versions of SUSE Linux (maybe it's too old) It's any program similar than FWTK? It's to make a work for the University, so I need an application that provides FTP, TELNET, and HTTP proxies and with open source code. Could anybody help me.? It's my last exam to finish my studies. Thank you very much, and sorry for my English :-D Torres.

1 0