December 2002 - openSUSE Security - openSUSE Mailing Lists

Unsubscribe
by brigitteb.brun 11 Dec '02

11 Dec '02

Please could you unsubscribe me from the list? Thanks, Brigitte > hi list hi suse security team > > Iam still wondering when there will ba a patch for this problem! > > We use cyrus imap on suse (7.3 and 8.1). > We have no problem with the users with a fix IP (firewall - we allowed > only the users with fix ips access to our mailserver) but the users with > a simple dail-up isp are going kill us soon - they have no access to > their mails. > > So my question to suse security - when will there be a patch? > Are there any porblen - if so tell us > > Mark > > -- > Mark Wassermann > intos IT Solutions & Consulting GmbH > St. Veiter Straße 4 a, A-9020 Klagenfurt > mailto:mwassermann@intos.com > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,13 /mn) ; tél : 08 92 68 13 50 (0,34/mn)"

4 3

AW: [suse-security] problem with linux suse
by Ulrich Roth 11 Dec '02

11 Dec '02

Hi, > I need your help and I hope somebody can help me. > I work with linux suse 7.2 > I modify my /etc/profile, and I put this line at end of this > file (profile) > PATH=/usr/java/jdbc/pgjdbc7.3.jar I think you wanted to enter CLASSPATH=/usr/java/jdbc/pgjdbc7.3.jar Also here you better use CLASSPATH=$CLASSPATH:/usr/java/jdbc/pgjdbc7.3.jar as it is possible that the classpath is defined elsewhere before this statement (I'm not a Java programmer). Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

problem with linux suse
by Ricardo Javier Aranibar León 11 Dec '02

11 Dec '02

Hi list, I need your help and I hope somebody can help me. I work with linux suse 7.2 I modify my /etc/profile, and I put this line at end of this file (profile) PATH=/usr/java/jdbc/pgjdbc7.3.jar When I restart my system, I can login to my system, but when i am in the pront i can't execute any command, It is the message that appear when io try to execute startx bash: tee: command not found and when I try ls the same with vi bash: ls: command not found but i can surf by the directories with cd then I like modify of /etc/profile but i can't because the vi, pico don't execute I create two disk the boot and the rescue, but when i connect with this i can into to my system I need modify my /etc/profile and to remove this line PATH=/usr/java/jdbc/pgjdbc7.3.jar I think that its the problem If somebody can help me i will thankfull Regards, Ricardo _________________________________________________________________ MSN Fotos: la forma más fácil de compartir e imprimir fotos. http://photos.msn.es/support/worldwide.aspx

3 2

Re: [suse-security] Buffer overflow in Cyrus Imapd
by Stefan Suurmeijer 10 Dec '02

10 Dec '02

On Tuesday 10 December 2002 14:19, Markus Gaugusch wrote: > > I asked about this last Tuesday (I think). Roman posted a message > > (Friday?) that a patch is being worked on atm. > > Yeah, I knew there was something, but didn't find it again :( > I'm anxiously awaiting the patch myself ;-) > > As for a page with known vulnerabilities: do you mean something like: > > http://www.suse.com/us/private/support/security/index.html > > This only contains announcements. Usually SuSE doesn't write an > announcement without fixed packages to announce. What I'm missing is a > "pending vulnerabilities" list. According to my suggestion, this list In every security announcement there is a pending vulnerabilities list (see the openldap announcement under 2) for instance). Well done to SuSE ;-) > would NOT be done by SuSE people, but by us. > This would take some work off from them (although very little), but > everything would be more transparent. > > Markus it seems the SuSE boys have taken that off our hands already. Thank God :-) Stefan

2 1

Buffer overflow in Cyrus Imapd
by Markus Gaugusch 10 Dec '02

10 Dec '02

Hi, According to http://www.securiteam.com/unixfocus/6Y0041F6AA.html, there is a buffer overflow in Cyrus Imapd <= 2.1.10. Since this package is delivered with SuSE 8.1, I'd like to know when a fix will be out. Probably you already know this and are doing a full audit, but there was no notice in the last announcement about this one. I'm also worried about the kernel update. There is one available, but according to information in the update directory, it doesn't contain security fixes. Why? One last word to cyrus: Why can't i do rpm -bb cyrus-imapd.spec, even if all programs listed there are installed? There is some link error with ucdsnmp. I found a hint, that --disable-ucdsnmp fixes this. It worked, but how can you at SuSE build the packages? There is only one ucdsnmp package (not even a -devel one), so I'm rather confused. I think that a page with known vulnerabilities in SuSE Products would be a very-nice-to-have thing. I don't mean those, that are kept secret (for whatever reason), but the others that have been published elsewhere already (like this one). I know, it takes some time to check whether a vulnerability exists. But this is the place where the community can come to play. I'm sure there are a lot of capable users and admins here on suse-security who are willing to test in such a way. In conjunction with a public bugtracking system , this could give necessary information about vulnerabilities in a very short time. (I'm not thinking about bugzilla, which is an ugly and huge beast, but something more cute) Please note again, I'm only talking about published vulnerabilities here and don't want to interfer with those that are found by SuSE auditors or other people, who are closely working together with vendors and distributors (there have been some discussions about this, which I want to prevent). kind regards, Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

2 2

bootp/dhclient
by Piet Roorda 09 Dec '02

09 Dec '02

suse7.3/2.4.19 again I have a messages when starting SuSEfirewall2: BOOTP/DHCLIENT in /etc/rc.config but I use DHCPclient and that is ssaid yes in susefirewall2 so why does this occurs and how can I avoid this?? piet

1 0

Re: [suse-security] pam_krb5 & kdm: local root compromise (or misconfiguration?)
by Helge Bahmann 09 Dec '02

09 Dec '02

Hello Olaf, thanks for your quick response. On Fri, 6 Dec 2002 Olaf Kirch assaulted the keyboard and produced: > On Fri, Dec 06, 2002 at 07:21:42PM +0100, Helge Bahmann wrote: > > - tickets are obtained and validated from kdc > > - credentials cache file /tmp/krb5cc_0 (!) is created and KRB5CCNAME set > > accordingly for the session > > You should check the README that comes with our pam_krb5 RPM. > It describes how to use separate cc files for all sessions. you are referring to the ccache parameter? yes I know, I'm using it; but since the cc file names are still quite easily guessable, the possibility of the root compromise remains (unless there is some misconfiguration on my part, which I'm still not sure about -- the behvior is just too strange). Will try to produce some more information. Best regards -- Helge Bahmann <bahmann(a)math.tu-freiberg.de> /| \__ The past: Smart users in front of dumb terminals /_|____\ _/\ | __) $ ./configure \\ \|__/__| checking whether build environment is sane... yes \\/___/ | checking for AIX... no (we already did this) |

1 0

pam_krb5 & kdm: local root compromise (or misconfiguration?)
by Helge Bahmann 09 Dec '02

09 Dec '02

Hello list, in the process of installing Suse 8.1Prof I am configuring all workstations to authenticate against a kerberos 5 server, using ldap for directory services. I stumbled about something which looks to me like a very dangerous security hole, but maybe I did some blatant misconfiguration (in that case I would be more than thankful if someone could point it out to me). Configuration: - using nss_ldap for users and groups - /etc/krb5.conf configured for our realm - created host principal for workstation and added to /etc/krb5.keytab - inserted "auth sufficient pam_krb5.so debug" line to the beginning of /etc/pam.d/xdm, according lines for "account" and "session" The problem goes as follows: - user logs in via kdm - tickets are obtained and validated from kdc - credentials cache file /tmp/krb5cc_0 (!) is created and KRB5CCNAME set accordingly for the session - user logs out, but credentials file is *not* deleted - log in as a different (!) user - tickets are obtained and validated from kdc - cc file /tmp/krb5cc_0 already exists, and cannot be written (according to logs, pam_krb5 module returns 'error in service module') - error return is discarded, login continues and all processes strangely start up with root privileges I think the naming of the cc file (krb5cc_0) is already indicative that root privileges are retained for too long. Furthermore the fact that the cc file is not correctly removed on logout is already a security concern in itself. Additional info: - sshd behaves correctly, i.e. the cc file is named /tmp/krb5cc_{uid}, and it is removed after logout - gdm behaves semi-correctly, i.e. the cc file is named /tmp/krb5cc_0, it is removed after logout, and the case of an existing unwritable cache file is treated by refusing login (of course this still qualifies a DoS attack against the workstation) - maybe part of the problem is related to an incorrect ordering of pam calls inside kdm (in fact I had posted a bug report about something similiar three years ago, I wonder if it still has not fixed ?) Can someone reproduce or comment on this? I can provide additional info, complete log- and configuration-files on request. Regards -- Helge Bahmann <bahmann(a)math.tu-freiberg.de> /| \__ The past: Smart users in front of dumb terminals /_|____\ _/\ | __) $ ./configure \\ \|__/__| checking whether build environment is sane... yes \\/___/ | checking for AIX... no (we already did this) |

2 2

RPM buggy or db corruption?
by Lars Ellenberg 08 Dec '02

08 Dec '02

System in question is i386 SuSE 8.1 newly installed about four weeks ago. I consider this security, since, if the package manager is buggy, that would affect the whole system. although it seems like there are only two specific packages affected so far. Problem: -------- Index entries have vanished from the rpm database. nothing even complained. hardware is stable, and proven to be good. overall system is stable. not connected to the net. physical access: me. files are there and seem unchanged. the rpm databases are intact. no metadata corruption. yet the index entries are *wrong*, i.e. not in sync with the actual system status. the only "suspicious" thing is, I used patch.rpms for all necessary updates; this might or might not be relevant. I recognized this when an rpm -Uhv failed with the message ... yast2-core is needed for ... ok, so what I did to verify this issue is, brute force straight ahead: rpm -qal | sort > rpm-qal.sort # umount unnecessary stuff find /bin /etc /opt /sbin /usr /var | sort > find.sort join -v rpm-qal find.sort > not-owned.orig cp not-owned.orig not-owned.edited # edit not-owned.edited, i.e. # delete chunks of obviously misleading stuff by hand, # like /usr/src/linux , which I forgot to exclude above :) now, whats left is about 500 files I'm not sure about. so I checked further: zcat /CD1/ARCHIVES.gz > ARCHIVES # I told you, 'tis brute cat /var/SuSE-updates/ARCHIVES \ | sed -ne 's/ -> .*//; s/$.*$: \+[dl-][rwx-]\{9\}.*[0-9] $\/.*$/\1 \2/p;' \ | sort -k 2,2 > ARCHIVES.sort join -1 1 -2 2 not-owned.edited ARCHIVES.sort \ | sort > not-owned.but.in-ARCHIVES and I ended up with a list containing only file entries belonging to these packages: ./CD1/suse/i586/yast2-bootloader-2.6.54-1.i586.rpm ./CD1/suse/i586/yast2-core-2.6.42-4.i586.rpm rpm -q * # shows "not installed" rpm -qlp * | xargs ls -l # lists all files, so they are there. all of them. rpm -yp * # shows up only few changes rpm --whatrequires * # shows a bunch of dependencies! they have been installed. they are required. I never used --force or -nodeps, never ereased any package, and for sure not these two. what I did was to install the update packages by suse, all necessary ones, by hand, using rpm -Uhv * for each update I used the *.patch.rpm when it was available. I have a copy of each of the update rpms. all --checksig ok. WHAT has gone wrong, and WHEN ? what can delete the corresponding index entries? any idea? someone? tia, Lars

1 0

Re: [suse-security] Analyzing FW logs
by Richard King 07 Dec '02

07 Dec '02

It's still especially good with iptables, as I posted yesterday, as opposed to ipchains. The iptable rules can pick up far more flags than ipchains sets, and can record more chains than just ipchains target of deny or reject. On the whole, I believe you should really run it in conjunction with snort and snort_stat.pl to put your snort results into html, then you can really see what's been trying to get in and out of your network through a browser. At least one of the Top Level Domains uses this technique. All the best. On Friday 06 December 2002 17:43, Ed Coates wrote: > Quoting Olafur Gardarsson <oli(a)itn.is>: > > To those who have some experience in working with/analyzing Firewall > > logs. Are there any software packages out there you can recommend? > > > > Regards, > > > > Oli > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > fwlogwatch is an excellent tool for analyzing firewall logs from either > ipchains or iptables. It will also spit out html format files to view on > a web page. > > Ed > > ------------------------------------------------- > This mail sent through IMP: http://horde.org/imp/ ------------------------------------------------------- -- Richard King Technical Director Generation Technology Ltd www.generationtechnology.co.uk +44(0)1702 433 975

2 2